mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-09 09:26:54 +00:00
87fa77fbcc
* store policy names cache to reduce lookup time * add validate audit handler * fix #958, remove auto-gen annotation on Pod * formatting code * update processTime to readable format * #586, add back unit test * update logging info * remove unused interface * handle generate policy in a single thread in weboook * resolve pr comments
32 lines
1.1 KiB
Go
32 lines
1.1 KiB
Go
package webhooks
|
|
|
|
import (
|
|
policyvalidate "github.com/nirmata/kyverno/pkg/policy"
|
|
|
|
v1beta1 "k8s.io/api/admission/v1beta1"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
)
|
|
|
|
//HandlePolicyValidation performs the validation check on policy resource
|
|
func (ws *WebhookServer) policyValidation(request *v1beta1.AdmissionRequest) *v1beta1.AdmissionResponse {
|
|
logger := ws.log.WithValues("action", "policyvalidation", "uid", request.UID, "kind", request.Kind, "namespace", request.Namespace, "name", request.Name, "operation", request.Operation)
|
|
|
|
//TODO: can this happen? wont this be picked by OpenAPI spec schema ?
|
|
if err := policyvalidate.Validate(request.Object.Raw, ws.client, false, ws.openAPIController); err != nil {
|
|
logger.Error(err, "faield to validate policy")
|
|
return &v1beta1.AdmissionResponse{
|
|
Allowed: false,
|
|
Result: &metav1.Status{
|
|
Message: err.Error(),
|
|
},
|
|
}
|
|
}
|
|
|
|
// if the policy contains mutating & validation rules and it config does not exist we create one
|
|
// queue the request
|
|
ws.resourceWebhookWatcher.RegisterResourceWebhook()
|
|
return &v1beta1.AdmissionResponse{
|
|
Allowed: true,
|
|
}
|
|
}
|