kyverno/pkg/policy/webhookregistration.go

package policy

import (
	"github.com/golang/glog"
	kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
	"k8s.io/apimachinery/pkg/labels"
)

func (pc *PolicyController) removeResourceWebhookConfiguration() error {
	removeWebhookConfig := func() error {
		var err error
		// check informer cache
		configName := pc.webhookRegistrationClient.GetResourceMutatingWebhookConfigName()
		config, err := pc.mWebhookConfigLister.Get(configName)
		if err != nil {
			glog.V(4).Infof("failed to list mutating webhook config: %v", err)
			return err
		}
		if config == nil {
			// as no resource is found
			return nil
		}
		err = pc.webhookRegistrationClient.RemoveResourceMutatingWebhookConfiguration()
		if err != nil {
			return err
		}
		glog.V(4).Info("removed resource webhook configuration")
		return nil
	}

	var err error
	// get all existing policies
	policies, err := pc.pLister.List(labels.NewSelector())
	if err != nil {
		glog.V(4).Infof("failed to list policies: %v", err)
		return err
	}

	if len(policies) == 0 {
		glog.V(4).Info("no policies loaded, removing resource webhook configuration if one exists")
		return removeWebhookConfig()
	}

	// if polices only have generate rules, we dont need the webhook
	if !hasMutateOrValidatePolicies(policies) {
		glog.V(4).Info("no policies with mutating or validating webhook configurations, remove resource webhook configuration if one exists")
		return removeWebhookConfig()
	}

	return nil
}

func (pc *PolicyController) createResourceMutatingWebhookConfigurationIfRequired(policy kyverno.ClusterPolicy) error {
	// if the policy contains mutating & validation rules and it config does not exist we create one
	if policy.HasMutateOrValidate() {
		// check cache
		configName := pc.webhookRegistrationClient.GetResourceMutatingWebhookConfigName()
		config, err := pc.mWebhookConfigLister.Get(configName)
		if err != nil {
			glog.V(4).Infof("failed to list mutating webhook configuration: %v", err)
			return err
		}
		if config != nil {
			// mutating webhoook configuration already exists
			return nil
		}
		if err := pc.webhookRegistrationClient.CreateResourceMutatingWebhookConfiguration(); err != nil {
			return err
		}
	}
	return nil
}

func hasMutateOrValidatePolicies(policies []*kyverno.ClusterPolicy) bool {
	for _, policy := range policies {
		if (*policy).HasMutateOrValidate() {
			return true
		}
	}
	return false
}