mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00
Code Activity

fix: use correct side effects in validating webhooks (#5080)

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2022-10-21 10:53:55 +02:00 • committed by GitHub
parent 5a496ca212
commit 5d0adadfa7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
cmd/kyverno/main.go
View file

@ -482,6 +482,7 @@ func createrLeaderControllers(
serverIP,
int32(webhookTimeout),
autoUpdateWebhooks,
admissionReports,
runtime,
)
return append(

2
pkg/controllers/report/background/controller.go
View file

@ -387,7 +387,7 @@ func (c *controller) reconcile(ctx context.Context, logger logr.Logger, key, nam
uid := types.UID(name)
resource, gvk, exists := c.metadataCache.GetResourceHash(uid)
// if the resource is not present it means we shouldn't have a report for it
// we can delete the report, we will recreate one if the resource come back
// we can delete the report, we will recreate one if the resource comes back
if !exists {
report, err := c.getMeta(namespace, name)
if err != nil {

20
pkg/controllers/webhook/controller.go
View file

@ -52,6 +52,7 @@ const (
)
var (
none = admissionregistrationv1.SideEffectClassNone
noneOnDryRun = admissionregistrationv1.SideEffectClassNoneOnDryRun
ifNeeded = admissionregistrationv1.IfNeededReinvocationPolicy
ignore = admissionregistrationv1.Ignore
@ -93,6 +94,7 @@ type controller struct {
server string
defaultTimeout int32
autoUpdateWebhooks bool
admissionReports bool
runtime runtimeutils.Runtime
// state
@ -117,6 +119,7 @@ func NewController(
server string,
defaultTimeout int32,
autoUpdateWebhooks bool,
admissionReports bool,
runtime runtimeutils.Runtime,
) controllers.Controller {
queue := workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName)
@ -138,6 +141,7 @@ func NewController(
server: server,
defaultTimeout: defaultTimeout,
autoUpdateWebhooks: autoUpdateWebhooks,
admissionReports: admissionReports,
runtime: runtime,
policyState: map[string]sets.String{
config.MutatingWebhookConfigurationName: sets.NewString(),
@ -562,7 +566,7 @@ func (c *controller) buildPolicyValidatingWebhookConfiguration(caBundle []byte)
},
}},
FailurePolicy: &ignore,
SideEffects: &noneOnDryRun,
SideEffects: &none,
AdmissionReviewVersions: []string{"v1beta1"},
}},
},
@ -676,6 +680,10 @@ func (c *controller) buildResourceMutatingWebhookConfiguration(caBundle []byte)
}
func (c *controller) buildDefaultResourceValidatingWebhookConfiguration(caBundle []byte) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
sideEffects := &none
if c.admissionReports {
sideEffects = &noneOnDryRun
}
return &admissionregistrationv1.ValidatingWebhookConfiguration{
ObjectMeta: objectMeta(config.ValidatingWebhookConfigurationName),
Webhooks: []admissionregistrationv1.ValidatingWebhook{{
@ -695,7 +703,7 @@ func (c *controller) buildDefaultResourceValidatingWebhookConfiguration(caBundle
},
}},
FailurePolicy: &ignore,
SideEffects: &noneOnDryRun,
SideEffects: sideEffects,
AdmissionReviewVersions: []string{"v1beta1"},
TimeoutSeconds: &c.defaultTimeout,
}},
@ -738,6 +746,10 @@ func (c *controller) buildResourceValidatingWebhookConfiguration(caBundle []byte
if len(webhookCfgs) > 0 {
webhookCfg = webhookCfgs[0]
}
sideEffects := &none
if c.admissionReports {
sideEffects = &noneOnDryRun
}
if !ignore.isEmpty() {
result.Webhooks = append(
result.Webhooks,
@ -748,7 +760,7 @@ func (c *controller) buildResourceValidatingWebhookConfiguration(caBundle []byte
ignore.buildRuleWithOperations(admissionregistrationv1.Create, admissionregistrationv1.Update, admissionregistrationv1.Delete, admissionregistrationv1.Connect),
},
FailurePolicy: &ignore.failurePolicy,
SideEffects: &noneOnDryRun,
SideEffects: sideEffects,
AdmissionReviewVersions: []string{"v1beta1"},
NamespaceSelector: webhookCfg.NamespaceSelector,
ObjectSelector: webhookCfg.ObjectSelector,
@ -766,7 +778,7 @@ func (c *controller) buildResourceValidatingWebhookConfiguration(caBundle []byte
fail.buildRuleWithOperations(admissionregistrationv1.Create, admissionregistrationv1.Update, admissionregistrationv1.Delete, admissionregistrationv1.Connect),
},
FailurePolicy: &fail.failurePolicy,
SideEffects: &noneOnDryRun,
SideEffects: sideEffects,
AdmissionReviewVersions: []string{"v1beta1"},
NamespaceSelector: webhookCfg.NamespaceSelector,
ObjectSelector: webhookCfg.ObjectSelector,