mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

- fix validation to process on patched resource; - format code

Browse source
This commit is contained in:
Shuting Zhao 2020-01-07 11:32:52 -08:00
parent c97b3ce5b0
commit cafc3883a4
3 changed files with 24 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
pkg/webhooks/common.go
View file

@ -115,40 +115,40 @@ func containRBACinfo(policies []kyverno.ClusterPolicy) bool {
}
// extracts the new and old resource as unstructured
func extractResources(request *v1beta1.AdmissionRequest) (unstructured.Unstructured, unstructured.Unstructured, error) {
func extractResources(newRaw []byte, request *v1beta1.AdmissionRequest) (unstructured.Unstructured, unstructured.Unstructured, error) {
var emptyResource unstructured.Unstructured
var err error
// New Resource
newRaw := request.Object.Raw
if newRaw == nil {
return emptyResource, emptyResource, fmt.Errorf("new resource is not defined")
}
new, err := convertToUnstructured(newRaw)
new, err := convertResource(newRaw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
if err != nil {
return emptyResource, emptyResource, fmt.Errorf("failed to convert new raw to unstructured: %v", err)
}
new.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
new.SetNamespace(request.Namespace)
// Old Resource - Optional
oldRaw := request.OldObject.Raw
if oldRaw == nil {
return *new, emptyResource, nil
return new, emptyResource, nil
}
old, err := convertToUnstructured((oldRaw))
old, err := convertResource(oldRaw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
if err != nil {
return emptyResource, emptyResource, fmt.Errorf("failed to convert old raw to unstructured: %v", err)
}
old.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
old.SetNamespace(request.Namespace)
return *new, *old, err
return new, old, err
}
func convertToUnstructured(data []byte) (*unstructured.Unstructured, error) {
resource := &unstructured.Unstructured{}
err := resource.UnmarshalJSON(data)
// convertResource converts raw bytes to an unstructured object
func convertResource(raw []byte, group, version, kind, namespace string) (unstructured.Unstructured, error) {
obj, err := engine.ConvertToUnstructured(raw)
if err != nil {
glog.V(4).Infof("failed to unmarshall resource: %v", err)
return nil, err
return unstructured.Unstructured{}, fmt.Errorf("failed to convert raw to unstructured: %v", err)
}
return resource, nil
obj.SetGroupVersionKind(schema.GroupVersionKind{Group: group, Version: version, Kind: kind})
obj.SetNamespace(namespace)
return *obj, nil
}

17
pkg/webhooks/server.go
View file

@ -17,7 +17,6 @@ import (
kyvernolister "github.com/nirmata/kyverno/pkg/client/listers/kyverno/v1"
"github.com/nirmata/kyverno/pkg/config"
client "github.com/nirmata/kyverno/pkg/dclient"
"github.com/nirmata/kyverno/pkg/engine"
"github.com/nirmata/kyverno/pkg/event"
"github.com/nirmata/kyverno/pkg/policy"
"github.com/nirmata/kyverno/pkg/policystore"
@ -27,7 +26,6 @@ import (
"github.com/nirmata/kyverno/pkg/webhookconfig"
v1beta1 "k8s.io/api/admission/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime/schema"
rbacinformer "k8s.io/client-go/informers/rbac/v1"
rbaclister "k8s.io/client-go/listers/rbac/v1"
"k8s.io/client-go/tools/cache"
@ -209,23 +207,20 @@ func (ws *WebhookServer) handleAdmissionRequest(request *v1beta1.AdmissionReques
glog.V(4).Infof("Time: webhook GetRoleRef %v", time.Since(startTime))
// convert RAW to unstructured
resource, err := engine.ConvertToUnstructured(request.Object.Raw)
resource, err := convertResource(request.Object.Raw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
if err != nil {
msg := fmt.Sprintf("unable to convert raw resource to unstructured: %v", err)
glog.Errorf(msg)
glog.Errorf(err.Error())
return &v1beta1.AdmissionResponse{
Allowed: false,
Result: &metav1.Status{
Status: "Failure",
Message: msg,
Message: err.Error(),
},
}
}
// if not then set it from the api request
resource.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
resource.SetNamespace(request.Namespace)
if checkPodTemplateAnn(*resource) {
if checkPodTemplateAnn(resource) {
return &v1beta1.AdmissionResponse{
Allowed: true,
Result: &metav1.Status{
@ -235,7 +230,7 @@ func (ws *WebhookServer) handleAdmissionRequest(request *v1beta1.AdmissionReques
}
// MUTATION
ok, patches, msg := ws.HandleMutation(request, *resource, policies, roles, clusterRoles)
ok, patches, msg := ws.HandleMutation(request, resource, policies, roles, clusterRoles)
if !ok {
glog.V(4).Infof("Deny admission request: %v/%s/%s", request.Kind, request.Namespace, request.Name)
return &v1beta1.AdmissionResponse{

2
pkg/webhooks/validation.go
View file

@ -53,7 +53,7 @@ func (ws *WebhookServer) HandleValidation(request *v1beta1.AdmissionRequest, pol
}
// Get new and old resource
newR, oldR, err := extractResources(request)
newR, oldR, err := extractResources(patchedResource, request)
if err != nil {
// as resource cannot be parsed, we skip processing
glog.Error(err)