Merge pull request #55282 from mbohlool/webhooks

Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add MutatingWebhookConfiguration type

As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.

Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.

ref: kubernetes/enhancements#492

Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9

pkg/admission/configuration/BUILD

@@ -10,8 +10,9 @@ go_test(
     name = "go_default_test",
     srcs = [
         "configuration_manager_test.go",
-        "external_admission_hook_manager_test.go",
         "initializer_manager_test.go",
+        "mutating_webhook_manager_test.go",
+        "validating_webhook_manager_test.go",
     ],
     importpath = "k8s.io/apiserver/pkg/admission/configuration",
     library = ":go_default_library",
@@ -29,8 +30,9 @@ go_library(
     name = "go_default_library",
     srcs = [
         "configuration_manager.go",
-        "external_admission_hook_manager.go",
         "initializer_manager.go",
+        "mutating_webhook_manager.go",
+        "validating_webhook_manager.go",
     ],
     importpath = "k8s.io/apiserver/pkg/admission/configuration",
     deps = [

pkg/admission/configuration/mutating_webhook_manager.go

@@ -0,0 +1,101 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package configuration
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+
+	"github.com/golang/glog"
+
+	"k8s.io/api/admissionregistration/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type MutatingWebhookConfigurationLister interface {
+	List(opts metav1.ListOptions) (*v1alpha1.MutatingWebhookConfigurationList, error)
+}
+
+// MutatingWebhookConfigurationManager collects the mutating webhook objects so that they can be called.
+type MutatingWebhookConfigurationManager struct {
+	*poller
+}
+
+func NewMutatingWebhookConfigurationManager(c MutatingWebhookConfigurationLister) *MutatingWebhookConfigurationManager {
+	getFn := func() (runtime.Object, error) {
+		list, err := c.List(metav1.ListOptions{})
+		if err != nil {
+			if errors.IsNotFound(err) || errors.IsForbidden(err) {
+				glog.V(5).Infof("MutatingWebhookConfiguration are disabled due to an error: %v", err)
+				return nil, ErrDisabled
+			}
+			return nil, err
+		}
+		return mergeMutatingWebhookConfigurations(list), nil
+	}
+
+	return &MutatingWebhookConfigurationManager{
+		newPoller(getFn),
+	}
+}
+
+// Webhooks returns the merged MutatingWebhookConfiguration.
+func (im *MutatingWebhookConfigurationManager) Webhooks() (*v1alpha1.MutatingWebhookConfiguration, error) {
+	configuration, err := im.poller.configuration()
+	if err != nil {
+		return nil, err
+	}
+	mutatingWebhookConfiguration, ok := configuration.(*v1alpha1.MutatingWebhookConfiguration)
+	if !ok {
+		return nil, fmt.Errorf("expected type %v, got type %v", reflect.TypeOf(mutatingWebhookConfiguration), reflect.TypeOf(configuration))
+	}
+	return mutatingWebhookConfiguration, nil
+}
+
+func (im *MutatingWebhookConfigurationManager) Run(stopCh <-chan struct{}) {
+	im.poller.Run(stopCh)
+}
+
+func mergeMutatingWebhookConfigurations(
+	list *v1alpha1.MutatingWebhookConfigurationList,
+) *v1alpha1.MutatingWebhookConfiguration {
+	configurations := append([]v1alpha1.MutatingWebhookConfiguration{}, list.Items...)
+	var ret v1alpha1.MutatingWebhookConfiguration
+	// The internal order of webhooks for each configuration is provided by the user
+	// but configurations themselves can be in any order. As we are going to run these
+	// webhooks in serial, they are sorted here to have a deterministic order.
+	sort.Sort(byName(configurations))
+	for _, c := range configurations {
+		ret.Webhooks = append(ret.Webhooks, c.Webhooks...)
+	}
+	return &ret
+}
+
+// byName sorts MutatingWebhookConfiguration by name. These objects are all in
+// cluster namespace (aka no namespace) thus they all have unique names.
+type byName []v1alpha1.MutatingWebhookConfiguration
+
+func (x byName) Len() int { return len(x) }
+
+func (x byName) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byName) Less(i, j int) bool {
+	return x[i].ObjectMeta.Name < x[j].ObjectMeta.Name
+}

pkg/admission/configuration/mutating_webhook_manager_test.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package configuration
+
+import (
+	"testing"
+
+	"k8s.io/api/admissionregistration/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type disabledMutatingWebhookConfigLister struct{}
+
+func (l *disabledMutatingWebhookConfigLister) List(options metav1.ListOptions) (*v1alpha1.MutatingWebhookConfigurationList, error) {
+	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "MutatingWebhookConfigurations"}, "")
+}
+func TestMutatingWebhookConfigDisabled(t *testing.T) {
+	manager := NewMutatingWebhookConfigurationManager(&disabledMutatingWebhookConfigLister{})
+	manager.sync()
+	_, err := manager.Webhooks()
+	if err.Error() != ErrDisabled.Error() {
+		t.Errorf("expected %v, got %v", ErrDisabled, err)
+	}
+}

pkg/admission/configuration/validating_webhook_manager.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package configuration
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/golang/glog"
+
+	"k8s.io/api/admissionregistration/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type ValidatingWebhookConfigurationLister interface {
+	List(opts metav1.ListOptions) (*v1alpha1.ValidatingWebhookConfigurationList, error)
+}
+
+// ValidatingWebhookConfigurationManager collects the validating webhook objects so that they can be called.
+type ValidatingWebhookConfigurationManager struct {
+	*poller
+}
+
+func NewValidatingWebhookConfigurationManager(c ValidatingWebhookConfigurationLister) *ValidatingWebhookConfigurationManager {
+	getFn := func() (runtime.Object, error) {
+		list, err := c.List(metav1.ListOptions{})
+		if err != nil {
+			if errors.IsNotFound(err) || errors.IsForbidden(err) {
+				glog.V(5).Infof("ValidatingWebhookConfiguration are disabled due to an error: %v", err)
+				return nil, ErrDisabled
+			}
+			return nil, err
+		}
+		return mergeValidatingWebhookConfigurations(list), nil
+	}
+
+	return &ValidatingWebhookConfigurationManager{
+		newPoller(getFn),
+	}
+}
+
+// Webhooks returns the merged ValidatingWebhookConfiguration.
+func (im *ValidatingWebhookConfigurationManager) Webhooks() (*v1alpha1.ValidatingWebhookConfiguration, error) {
+	configuration, err := im.poller.configuration()
+	if err != nil {
+		return nil, err
+	}
+	validatingWebhookConfiguration, ok := configuration.(*v1alpha1.ValidatingWebhookConfiguration)
+	if !ok {
+		return nil, fmt.Errorf("expected type %v, got type %v", reflect.TypeOf(validatingWebhookConfiguration), reflect.TypeOf(configuration))
+	}
+	return validatingWebhookConfiguration, nil
+}
+
+func (im *ValidatingWebhookConfigurationManager) Run(stopCh <-chan struct{}) {
+	im.poller.Run(stopCh)
+}
+
+func mergeValidatingWebhookConfigurations(
+	list *v1alpha1.ValidatingWebhookConfigurationList,
+) *v1alpha1.ValidatingWebhookConfiguration {
+	configurations := list.Items
+	var ret v1alpha1.ValidatingWebhookConfiguration
+	for _, c := range configurations {
+		ret.Webhooks = append(ret.Webhooks, c.Webhooks...)
+	}
+	return &ret
+}

pkg/admission/configuration/external_admission_hook_manager_test.go → pkg/admission/configuration/validating_webhook_manager_test.go

@@ -25,15 +25,15 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
-type disabledWebhookConfigLister struct{}
+type disabledValidatingWebhookConfigLister struct{}
 
-func (l *disabledWebhookConfigLister) List(options metav1.ListOptions) (*v1alpha1.ExternalAdmissionHookConfigurationList, error) {
-	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "externalAdmissionHookConfigurations"}, "")
+func (l *disabledValidatingWebhookConfigLister) List(options metav1.ListOptions) (*v1alpha1.ValidatingWebhookConfigurationList, error) {
+	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "ValidatingWebhookConfigurations"}, "")
 }
 func TestWebhookConfigDisabled(t *testing.T) {
-	manager := NewExternalAdmissionHookConfigurationManager(&disabledWebhookConfigLister{})
+	manager := NewValidatingWebhookConfigurationManager(&disabledValidatingWebhookConfigLister{})
 	manager.sync()
-	_, err := manager.ExternalAdmissionHooks()
+	_, err := manager.Webhooks()
 	if err.Error() != ErrDisabled.Error() {
 		t.Errorf("expected %v, got %v", ErrDisabled, err)
 	}