mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 10:28:36 +00:00
Code Activity

refactor: add a function to check if VAPs are registered in the API server (#10014)

Browse source 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Mariam Fahmy 2024-04-17 18:01:00 +08:00 • committed by GitHub
parent 3db5bdfad8
commit f98d7d86b3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
cmd/kyverno/main.go
View file

@ -37,6 +37,7 @@ import (
"github.com/kyverno/kyverno/pkg/toggle"
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
runtimeutils "github.com/kyverno/kyverno/pkg/utils/runtime"
"github.com/kyverno/kyverno/pkg/validatingadmissionpolicy"
"github.com/kyverno/kyverno/pkg/validation/exception"
"github.com/kyverno/kyverno/pkg/validation/globalcontext"
"github.com/kyverno/kyverno/pkg/webhooks"
@ -48,7 +49,6 @@ import (
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
corev1 "k8s.io/api/core/v1"
apiserver "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apimachinery/pkg/runtime/schema"
kubeinformers "k8s.io/client-go/informers"
corev1informers "k8s.io/client-go/informers/core/v1"
"k8s.io/client-go/kubernetes"
@ -314,9 +314,9 @@ func main() {
// check if validating admission policies are registered in the API server
generateValidatingAdmissionPolicy := toggle.FromContext(context.TODO()).GenerateValidatingAdmissionPolicy()
if generateValidatingAdmissionPolicy {
groupVersion := schema.GroupVersion{Group: "admissionregistration.k8s.io", Version: "v1alpha1"}
if _, err := setup.KyvernoDynamicClient.GetKubeClient().Discovery().ServerResourcesForGroupVersion(groupVersion.String()); err != nil {
setup.Logger.Error(err, "validating admission policies aren't supported.")
registered, err := validatingadmissionpolicy.IsValidatingAdmissionPolicyRegistered(setup.KubeClient)
if !registered {
setup.Logger.Error(err, "ValidatingAdmissionPolicies isn't supported in the API server")
os.Exit(1)
}
}

8
cmd/reports-controller/main.go
View file

@ -26,8 +26,8 @@ import (
"github.com/kyverno/kyverno/pkg/leaderelection"
"github.com/kyverno/kyverno/pkg/logging"
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
"github.com/kyverno/kyverno/pkg/validatingadmissionpolicy"
apiserver "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apimachinery/pkg/runtime/schema"
kubeinformers "k8s.io/client-go/informers"
admissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
metadatainformers "k8s.io/client-go/metadata/metadatainformer"
@ -253,9 +253,9 @@ func main() {
setup.Logger.Info("background scan interval", "duration", backgroundScanInterval.String())
// check if validating admission policies are registered in the API server
if validatingAdmissionPolicyReports {
groupVersion := schema.GroupVersion{Group: "admissionregistration.k8s.io", Version: "v1alpha1"}
if _, err := setup.KyvernoDynamicClient.GetKubeClient().Discovery().ServerResourcesForGroupVersion(groupVersion.String()); err != nil {
setup.Logger.Error(err, "validating admission policies aren't supported.")
registered, err := validatingadmissionpolicy.IsValidatingAdmissionPolicyRegistered(setup.KubeClient)
if !registered {
setup.Logger.Error(err, "ValidatingAdmissionPolicies isn't supported in the API server")
os.Exit(1)
}
}

10
pkg/validatingadmissionpolicy/permissions_checker.go → pkg/validatingadmissionpolicy/utils.go
View file

@ -5,6 +5,7 @@ import (
"github.com/kyverno/kyverno/pkg/auth/checker"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/client-go/kubernetes"
)
func hasPermissions(resource schema.GroupVersionResource, s checker.AuthChecker) bool {
@ -28,3 +29,12 @@ func HasValidatingAdmissionPolicyBindingPermission(s checker.AuthChecker) bool {
gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "validatingadmissionpolicybindings"}
return hasPermissions(gvr, s)
}
// IsValidatingAdmissionPolicyRegistered checks if ValidatingAdmissionPolicies are registered in the API Server
func IsValidatingAdmissionPolicyRegistered(kubeClient kubernetes.Interface) (bool, error) {
groupVersion := schema.GroupVersion{Group: "admissionregistration.k8s.io", Version: "v1alpha1"}
if _, err := kubeClient.Discovery().ServerResourcesForGroupVersion(groupVersion.String()); err != nil {
return false, err
}
return true, nil
}