Use caches and disable throttling

main.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/rancher/webhook/pkg/admission"
 	"github.com/rancher/wrangler/pkg/kubeconfig"
+	"github.com/rancher/wrangler/pkg/ratelimit"
 	"github.com/rancher/wrangler/pkg/signals"
 	"github.com/sirupsen/logrus"
 )
@@ -24,6 +25,8 @@ func run() error {
 		return err
 	}
 
+	cfg.RateLimiter = ratelimit.None
+
 	ctx := signals.SetupSignalHandler(context.Background())
 	if err := admission.ListenAndServe(ctx, cfg); err != nil {
 		return err

pkg/admission/server.go

@@ -34,7 +34,7 @@ func ListenAndServe(ctx context.Context, cfg *rest.Config) error {
 		return err
 	}
 
-	handler, err := Validation(cfg)
+	handler, err := Validation(ctx, cfg)
 	if err != nil {
 		return err
 	}

pkg/admission/validation.go

@@ -1,6 +1,7 @@
 package admission
 
 import (
+	"context"
 	"net/http"
 
 	"github.com/rancher/rancher/pkg/apis/management.cattle.io"
@@ -9,12 +10,13 @@ import (
 	"github.com/rancher/webhook/pkg/cluster"
 	mgmtcontrollers "github.com/rancher/webhook/pkg/generated/controllers/management.cattle.io"
 	"github.com/rancher/wrangler-api/pkg/generated/controllers/rbac"
+	"github.com/rancher/wrangler/pkg/start"
 	"github.com/rancher/wrangler/pkg/webhook"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )
 
-func Validation(cfg *rest.Config) (http.Handler, error) {
+func Validation(ctx context.Context, cfg *rest.Config) (http.Handler, error) {
 	grb, err := mgmtcontrollers.NewFactoryFromConfig(cfg)
 	if err != nil {
 		return nil, err
@@ -25,7 +27,7 @@ func Validation(cfg *rest.Config) (http.Handler, error) {
 		return nil, err
 	}
 
-	globalRoleBindings, err := auth.NewGRBValidator(grb.Management().V3().GlobalRole(), r.Rbac())
+	globalRoleBindings, err := auth.NewGRBValidator(grb.Management().V3().GlobalRole().Cache(), r.Rbac())
 	if err != nil {
 		return nil, err
 	}
@@ -47,5 +49,7 @@ func Validation(cfg *rest.Config) (http.Handler, error) {
 	router.Kind("ProjectRoleTemplateBinding").Group(management.GroupName).Type(&v3.ProjectRoleTemplateBinding{}).Handle(prtbs)
 	router.Kind("ClusterRoleTemplateBinding").Group(management.GroupName).Type(&v3.ClusterRoleTemplateBinding{}).Handle(crtbs)
 
+	starters := []start.Starter{r, grb}
+	start.All(ctx, 5, starters...)
 	return router, nil
 }

pkg/auth/clusterrtb.go

@@ -29,7 +29,7 @@ type clusterRoleTemplateBindingValidator struct {
 
 func (c *clusterRoleTemplateBindingValidator) Admit(response *webhook.Response, request *webhook.Request) error {
 	listTrace := trace.New("clusterRoleTemplateBindingValidator Admit", trace.Field{Key: "user", Value: request.UserInfo.Username})
-	defer listTrace.LogIfLong(1 * time.Second)
+	defer listTrace.LogIfLong(2 * time.Second)
 
 	crtb, err := crtbObject(request)
 	if err != nil {

pkg/auth/globarolebinding.go

@@ -23,36 +23,39 @@ import (
 	"k8s.io/utils/trace"
 )
 
-func NewGRBValidator(grClient v3.GlobalRoleClient, r rbac.Interface) (webhook.Handler, error) {
+func NewGRBValidator(grClient v3.GlobalRoleCache, r rbac.Interface) (webhook.Handler, error) {
 	rbacRestGetter := authentication.RBACRestGetter{
-		Interface: r,
+		Roles:               r.V1().Role().Cache(),
+		RoleBindings:        r.V1().RoleBinding().Cache(),
+		ClusterRoles:        r.V1().ClusterRole().Cache(),
+		ClusterRoleBindings: r.V1().ClusterRoleBinding().Cache(),
 	}
 
 	ruleResolver := rbacregistryvalidation.NewDefaultRuleResolver(rbacRestGetter, rbacRestGetter, rbacRestGetter, rbacRestGetter)
 
 	return &globalRoleBindingValidator{
-		globalRoleClient: grClient,
-		ruleSolver:       ruleResolver,
+		globalRoles: grClient,
+		ruleSolver:  ruleResolver,
 	}, nil
 
 }
 
 type globalRoleBindingValidator struct {
-	globalRoleClient v3.GlobalRoleClient
-	ruleSolver       validation.AuthorizationRuleResolver
+	globalRoles v3.GlobalRoleCache
+	ruleSolver  validation.AuthorizationRuleResolver
 }
 
 func (grbv *globalRoleBindingValidator) Admit(response *webhook.Response, request *webhook.Request) error {
 	listTrace := trace.New("globalRoleBindingValidator Admit", trace.Field{Key: "user", Value: request.UserInfo.Username})
-	defer listTrace.LogIfLong(1 * time.Second)
+	defer listTrace.LogIfLong(2 * time.Second)
 
 	newGRB, err := grbObject(request)
 	if err != nil {
 		return err
 	}
 
 	// Pull the global role to get the rules
-	globalRole, err := grbv.globalRoleClient.Get(newGRB.GlobalRoleName, metav1.GetOptions{})
+	globalRole, err := grbv.globalRoles.Get(newGRB.GlobalRoleName)
 	if err != nil {
 		return err
 	}

pkg/auth/projectrtb.go

@@ -24,7 +24,7 @@ type projectRoleTemplateBindingValidator struct {
 
 func (p *projectRoleTemplateBindingValidator) Admit(response *webhook.Response, request *webhook.Request) error {
 	listTrace := trace.New("projectRoleTemplateBindingValidator Admit", trace.Field{Key: "user", Value: request.UserInfo.Username})
-	defer listTrace.LogIfLong(1 * time.Second)
+	defer listTrace.LogIfLong(2 * time.Second)
 
 	prtb, err := prtbObject(request)
 	if err != nil {

pkg/authentication/rolegetter.go

@@ -1,43 +1,30 @@
 package authentication
 
 import (
-	"github.com/rancher/wrangler-api/pkg/generated/controllers/rbac"
+	wranglerv1 "github.com/rancher/wrangler-api/pkg/generated/controllers/rbac/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 )
 
 type RBACRestGetter struct {
-	rbac.Interface
+	Roles               wranglerv1.RoleCache
+	RoleBindings        wranglerv1.RoleBindingCache
+	ClusterRoles        wranglerv1.ClusterRoleCache
+	ClusterRoleBindings wranglerv1.ClusterRoleBindingCache
 }
 
 func (r RBACRestGetter) GetRole(namespace, name string) (*rbacv1.Role, error) {
-	return r.Interface.V1().Role().Get(namespace, name, metav1.GetOptions{})
+	return r.Roles.Get(namespace, name)
 }
 
 func (r RBACRestGetter) ListRoleBindings(namespace string) ([]*rbacv1.RoleBinding, error) {
-	rolebindings, err := r.Interface.V1().RoleBinding().List(namespace, metav1.ListOptions{})
-	if err != nil {
-		return nil, err
-	}
-	var rbs []*rbacv1.RoleBinding
-	for i := range rolebindings.Items {
-		rbs = append(rbs, &rolebindings.Items[i])
-	}
-	return rbs, nil
+	return r.RoleBindings.List(namespace, labels.NewSelector())
 }
 
 func (r RBACRestGetter) GetClusterRole(name string) (*rbacv1.ClusterRole, error) {
-	return r.Interface.V1().ClusterRole().Get(name, metav1.GetOptions{})
+	return r.ClusterRoles.Get(name)
 }
 
 func (r RBACRestGetter) ListClusterRoleBindings() ([]*rbacv1.ClusterRoleBinding, error) {
-	clusterrolebindings, err := r.Interface.V1().ClusterRoleBinding().List(metav1.ListOptions{})
-	if err != nil {
-		return nil, err
-	}
-	var crbs []*rbacv1.ClusterRoleBinding
-	for i := range clusterrolebindings.Items {
-		crbs = append(crbs, &clusterrolebindings.Items[i])
-	}
-	return crbs, nil
+	return r.ClusterRoleBindings.List(labels.NewSelector())
 }