Skip to content

Commit c02169b

Browse files
github-actions[bot]lingdie
github-actions[bot]
and
lingdie
authored
chore(admission webhookl): upgrade admission webhook controller runtime version (#6521)
chore(admission webhookl): upgrade admission webhook controller runtime version (#6518) * feat(admission): upgrade admission webhook controller runtime version * feat(admission): upgrade admission webhook controller runtime version * feat(admission): upgrade admission webhook controller runtime version * feat(admission): upgrade admission webhook controller runtime version * feat(admission): upgrade admission webhook controller runtime version * feat(admission): upgrade admission webhook controller runtime version Co-authored-by: yy <56745951+lingdie@users.noreply.github.com>
1 parent e9a302b commit c02169b

10 files changed

Lines changed: 996 additions & 456 deletions

File tree

‎webhooks/admission/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,14 +65,14 @@ test: manifests generate fmt vet envtest ## Run tests.
6565

6666
.PHONY: build
6767
build: ## Build manager binary.
68-
CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -trimpath -o bin/manager cmd/main.go
68+
CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -trimpath -o bin/manager cmd/main.go
6969

7070
.PHONY: run
7171
run: manifests generate fmt vet ## Run a controller from your host.
7272
go run ./main.go
7373

7474
.PHONY: docker-build
75-
docker-build: test build ## Build docker image with the manager.
75+
docker-build: build ## Build docker image with the manager.
7676
mv bin/manager bin/webhook-admission-${TARGETARCH}
7777
chmod +x bin/webhook-admission-${TARGETARCH}
7878
docker build -t ${IMG} . --build-arg TARGETARCH=${TARGETARCH}

‎webhooks/admission/api/v1/icp.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ type IcpValidator struct {
4646
cache *cache.Cache
4747
}
4848

49-
func NewIcpValidator(icpEnabled bool, icpEndpoint string, icpKey string) *IcpValidator {
49+
func NewIcpValidator(icpEnabled bool, icpEndpoint, icpKey string) *IcpValidator {
5050
return &IcpValidator{
5151
enabled: icpEnabled,
5252
endpoint: icpEndpoint,
@@ -64,7 +64,7 @@ func (i *IcpValidator) Query(rule *netv1.IngressRule) (*IcpResponse, error) {
6464
// Check if result is already cached
6565
cached, found := i.cache.Get(domainName)
6666
if found {
67-
return cached.(*IcpResponse), nil
67+
return cached.(*IcpResponse), nil //nolint:errcheck // cache stores *IcpResponse
6868
}
6969

7070
// Query ICP

‎webhooks/admission/api/v1/icp_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222

2323
func TestIcpValidator_Query(t *testing.T) {
2424
icpValidator := NewIcpValidator(true, "http://v.juhe.cn/siteTools/app/NewDomain/query.php", "")
25-
for i := 0; i <= 3; i++ {
25+
for range 4 {
2626
rule := &v1.IngressRule{
2727
Host: "sealos.cn",
2828
}

‎webhooks/admission/api/v1/ingress_webhook.go‎

Lines changed: 162 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import (
2626
"time"
2727

2828
"github.com/labring/sealos/webhook/admission/pkg/code"
29-
3029
netv1 "k8s.io/api/networking/v1"
3130
"k8s.io/apimachinery/pkg/runtime"
3231
ctrl "sigs.k8s.io/controller-runtime"
@@ -67,7 +66,13 @@ func (m *IngressMutator) Default(_ context.Context, obj runtime.Object) error {
6766

6867
for _, domain := range m.Domains {
6968
if isUserNamespace(i.Namespace) && hasSubDomain(i, domain) {
70-
ilog.Info("mutating ingress in user ns", "ingress namespace", i.Namespace, "ingress name", i.Name)
69+
ilog.Info(
70+
"mutating ingress in user ns",
71+
"ingress namespace",
72+
i.Namespace,
73+
"ingress name",
74+
i.Name,
75+
)
7176
m.mutateUserIngressAnnotations(i)
7277
}
7378
}
@@ -109,7 +114,7 @@ func (v *IngressValidator) SetupWithManager(mgr ctrl.Manager) error {
109114
&netv1.Ingress{},
110115
IngressHostIndex,
111116
func(obj client.Object) []string {
112-
ingress := obj.(*netv1.Ingress)
117+
ingress := obj.(*netv1.Ingress) //nolint:errcheck // IndexField is registered for Ingress objects only
113118
var hosts []string
114119
for _, rule := range ingress.Spec.Rules {
115120
hosts = append(hosts, rule.Host)
@@ -129,50 +134,79 @@ func (v *IngressValidator) SetupWithManager(mgr ctrl.Manager) error {
129134

130135
//+kubebuilder:webhook:path=/validate-networking-k8s-io-v1-ingress,mutating=false,failurePolicy=ignore,sideEffects=None,groups=networking.k8s.io,resources=ingresses,verbs=create;update;delete,versions=v1,name=vingress.sealos.io,admissionReviewVersions=v1
131136

132-
func (v *IngressValidator) ValidateCreate(ctx context.Context, obj runtime.Object) error {
137+
func (v *IngressValidator) ValidateCreate(
138+
ctx context.Context,
139+
obj runtime.Object,
140+
) (admission.Warnings, error) {
133141
i, ok := obj.(*netv1.Ingress)
134142
if !ok {
135-
return errors.New("obj convert Ingress is error")
143+
return nil, errors.New("obj convert Ingress is error")
136144
}
137145

138146
ilog.Info("validating create", "ingress namespace", i.Namespace, "ingress name", i.Name)
139-
return v.validate(ctx, i)
147+
err := v.validate(ctx, i)
148+
return nil, err
140149
}
141150

142-
func (v *IngressValidator) ValidateUpdate(ctx context.Context, _, newObj runtime.Object) error {
151+
func (v *IngressValidator) ValidateUpdate(
152+
ctx context.Context,
153+
_, newObj runtime.Object,
154+
) (admission.Warnings, error) {
143155
ni, ok := newObj.(*netv1.Ingress)
144156
if !ok {
145-
return errors.New("obj convert Ingress is error")
157+
return nil, errors.New("obj convert Ingress is error")
146158
}
147-
//oi, ok := oldObj.(*netv1.Ingress)
148-
//if !ok {
159+
// oi, ok := oldObj.(*netv1.Ingress)
160+
// if !ok {
149161
// return errors.New("obj convert Ingress is error")
150162
//}
151163
ilog.Info("validating update", "ingress namespace", ni.Namespace, "ingress name", ni.Name)
152-
return v.validate(ctx, ni)
164+
err := v.validate(ctx, ni)
165+
return nil, err
153166
}
154167

155-
func (v *IngressValidator) ValidateDelete(_ context.Context, obj runtime.Object) error {
168+
func (v *IngressValidator) ValidateDelete(
169+
_ context.Context,
170+
obj runtime.Object,
171+
) (admission.Warnings, error) {
156172
i, ok := obj.(*netv1.Ingress)
157173
if !ok {
158-
return errors.New("obj convert Ingress is error")
174+
return nil, errors.New("obj convert Ingress is error")
159175
}
160176

161177
ilog.Info("validating delete", "ingress namespace", i.Namespace, "ingress name", i.Name)
162178
// delete ingress, pass validate
163-
return nil
179+
return nil, nil
164180
}
165181

166182
func (v *IngressValidator) validate(ctx context.Context, i *netv1.Ingress) error {
167183
// count validate cost time
168184

169185
startTime := time.Now()
170186
defer func() {
171-
ilog.Info("finished validate", "ingress namespace", i.Namespace, "ingress name", i.Name, "cost", time.Since(startTime))
187+
ilog.Info(
188+
"finished validate",
189+
"ingress namespace",
190+
i.Namespace,
191+
"ingress name",
192+
i.Name,
193+
"cost",
194+
time.Since(startTime),
195+
)
172196
}()
173197

174198
request, _ := admission.RequestFromContext(ctx)
175-
ilog.Info("validating", "ingress namespace", i.Namespace, "ingress name", i.Name, "user", request.UserInfo.Username, "userGroups", request.UserInfo.Groups)
199+
ilog.Info(
200+
"validating",
201+
"ingress namespace",
202+
i.Namespace,
203+
"ingress name",
204+
i.Name,
205+
"user",
206+
request.UserInfo.Username,
207+
"userGroups",
208+
request.UserInfo.Groups,
209+
)
176210
if !isUserServiceAccount(request.UserInfo.Username) {
177211
ilog.Info("user is not user's serviceaccount, skip validate")
178212
return nil
@@ -201,7 +235,15 @@ func (v *IngressValidator) validate(ctx context.Context, i *netv1.Ingress) error
201235
}
202236

203237
func (v *IngressValidator) checkCname(i *netv1.Ingress, rule *netv1.IngressRule) error {
204-
ilog.Info("checking cname", "ingress namespace", i.Namespace, "ingress name", i.Name, "rule host", rule.Host)
238+
ilog.Info(
239+
"checking cname",
240+
"ingress namespace",
241+
i.Namespace,
242+
"ingress name",
243+
i.Name,
244+
"rule host",
245+
rule.Host,
246+
)
205247
ilog.Info("domains:", "domains", strings.Join(v.Domains, ","))
206248
// get cname and check if it is cname to domain
207249
cname, err := net.LookupCNAME(rule.Host)
@@ -214,57 +256,147 @@ func (v *IngressValidator) checkCname(i *netv1.Ingress, rule *netv1.IngressRule)
214256
for _, domain := range v.Domains {
215257
// check if ingress host is end with domain
216258
if strings.HasSuffix(rule.Host, domain) {
217-
ilog.Info("ingress host is end with "+domain+", skip validate", "ingress namespace", i.Namespace, "ingress name", i.Name)
259+
ilog.Info(
260+
"ingress host is end with "+domain+", skip validate",
261+
"ingress namespace",
262+
i.Namespace,
263+
"ingress name",
264+
i.Name,
265+
)
218266
return nil
219267
}
220268
// if cname is not end with domain, return error
221269
if strings.HasSuffix(cname, domain) {
222-
ilog.Info("ingress host "+rule.Host+" is cname to "+cname+", pass checkCname validate", "ingress namespace", i.Namespace, "ingress name", i.Name, "cname", cname)
270+
ilog.Info(
271+
"ingress host "+rule.Host+" is cname to "+cname+", pass checkCname validate",
272+
"ingress namespace",
273+
i.Namespace,
274+
"ingress name",
275+
i.Name,
276+
"cname",
277+
cname,
278+
)
223279
return nil
224280
}
225281
}
226-
return fmt.Errorf(code.MessageFormat, code.IngressFailedCnameCheck, "can not verify ingress host "+rule.Host+", cname is not end with any domains in "+strings.Join(v.Domains, ","))
282+
return fmt.Errorf(
283+
code.MessageFormat,
284+
code.IngressFailedCnameCheck,
285+
"can not verify ingress host "+rule.Host+", cname is not end with any domains in "+strings.Join(
286+
v.Domains,
287+
",",
288+
),
289+
)
227290
}
228291

229292
func (v *IngressValidator) checkOwner(i *netv1.Ingress, rule *netv1.IngressRule) error {
230293
iList := &netv1.IngressList{}
231-
if err := v.cache.List(context.Background(), iList, client.MatchingFields{IngressHostIndex: rule.Host}); err != nil {
294+
if err := v.cache.List(
295+
context.Background(),
296+
iList,
297+
client.MatchingFields{IngressHostIndex: rule.Host},
298+
); err != nil {
232299
ilog.Error(err, "can not verify ingress host "+rule.Host+", list ingress error")
233300
return fmt.Errorf(code.MessageFormat, code.IngressFailedOwnerCheck, err.Error())
234301
}
235302

236303
for _, exitsIngress := range iList.Items {
237304
if exitsIngress.Namespace != i.Namespace {
238-
ilog.Info("ingress host "+rule.Host+" is owned by "+i.Namespace+", failed validate", "ingress namespace", i.Namespace, "ingress name", i.Name)
239-
return fmt.Errorf(code.MessageFormat, code.IngressFailedOwnerCheck, "ingress host "+rule.Host+" is owned by other user, you can not create ingress with same host.")
305+
ilog.Info(
306+
"ingress host "+rule.Host+" is owned by "+i.Namespace+", failed validate",
307+
"ingress namespace",
308+
i.Namespace,
309+
"ingress name",
310+
i.Name,
311+
)
312+
return fmt.Errorf(
313+
code.MessageFormat,
314+
code.IngressFailedOwnerCheck,
315+
"ingress host "+rule.Host+" is owned by other user, you can not create ingress with same host.",
316+
)
240317
}
241318
}
242319
// pass owner check
243-
ilog.Info("ingress host "+rule.Host+" pass checkOwner validate", "ingress namespace", i.Namespace, "ingress name", i.Name)
320+
ilog.Info(
321+
"ingress host "+rule.Host+" pass checkOwner validate",
322+
"ingress namespace",
323+
i.Namespace,
324+
"ingress name",
325+
i.Name,
326+
)
244327
return nil
245328
}
246329

247330
func (v *IngressValidator) checkIcp(i *netv1.Ingress, rule *netv1.IngressRule) error {
248331
if !v.IcpValidator.enabled {
249-
ilog.Info("icp is disabled, skip check icp", "ingress namespace", i.Namespace, "ingress name", i.Name, "rule host", rule.Host)
332+
ilog.Info(
333+
"icp is disabled, skip check icp",
334+
"ingress namespace",
335+
i.Namespace,
336+
"ingress name",
337+
i.Name,
338+
"rule host",
339+
rule.Host,
340+
)
250341
return nil
251342
}
252343
// check rule.host icp
253344
icpRep, err := v.IcpValidator.Query(rule)
254345
if err != nil {
255346
ilog.Error(err, "can not verify ingress host "+rule.Host+", icp query error")
256-
return fmt.Errorf(code.MessageFormat, code.IngressWebhookInternalError, "can not verify ingress host "+rule.Host+", icp query error")
347+
return fmt.Errorf(
348+
code.MessageFormat,
349+
code.IngressWebhookInternalError,
350+
"can not verify ingress host "+rule.Host+", icp query error",
351+
)
257352
}
258353
if icpRep.ErrorCode != 0 {
259-
ilog.Error(err, "icp query error", "ingress namespace", i.Namespace, "ingress name", i.Name, "rule host", rule.Host, "icp error code", icpRep.ErrorCode, "icp reason", icpRep.Reason)
354+
ilog.Error(
355+
err,
356+
"icp query error",
357+
"ingress namespace",
358+
i.Namespace,
359+
"ingress name",
360+
i.Name,
361+
"rule host",
362+
rule.Host,
363+
"icp error code",
364+
icpRep.ErrorCode,
365+
"icp reason",
366+
icpRep.Reason,
367+
)
260368
return fmt.Errorf(code.MessageFormat, code.IngressWebhookInternalError, icpRep.Reason)
261369
}
262370
// if icpRep.Result.SiteLicense is empty, return error, failed validate
263371
if icpRep.Result.SiteLicense == "" {
264-
ilog.Info("deny ingress host "+rule.Host+", icp query result is empty", "ingress namespace", i.Namespace, "ingress name", i.Name, "rule host", rule.Host, "icp result", icpRep.Result)
265-
return fmt.Errorf(code.MessageFormat, code.IngressFailedIcpCheck, "icp query result is empty")
372+
ilog.Info(
373+
"deny ingress host "+rule.Host+", icp query result is empty",
374+
"ingress namespace",
375+
i.Namespace,
376+
"ingress name",
377+
i.Name,
378+
"rule host",
379+
rule.Host,
380+
"icp result",
381+
icpRep.Result,
382+
)
383+
return fmt.Errorf(
384+
code.MessageFormat,
385+
code.IngressFailedIcpCheck,
386+
"icp query result is empty",
387+
)
266388
}
267389
// pass icp check
268-
ilog.Info("ingress host "+rule.Host+" pass checkIcp validate", "ingress namespace", i.Namespace, "ingress name", i.Name, "rule host", rule.Host, "icp result", icpRep.Result)
390+
ilog.Info(
391+
"ingress host "+rule.Host+" pass checkIcp validate",
392+
"ingress namespace",
393+
i.Namespace,
394+
"ingress name",
395+
i.Name,
396+
"rule host",
397+
rule.Host,
398+
"icp result",
399+
icpRep.Result,
400+
)
269401
return nil
270402
}

0 commit comments

Comments
 (0)