feat: blocking replicated resources write ops by tenant owners

controllers/resources/processor.go

@@ -26,6 +26,7 @@ import (
 )
 
 const (
+	Label     = "capsule.clastix.io/resources"
 	finalizer = "capsule.clastix.io/resources"
 )
 
@@ -121,7 +122,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant
 
 	objAnnotations[tenantLabel] = tnt.GetName()
 
-	objLabels["capsule.clastix.io/resources"] = fmt.Sprintf("%d", resourceIndex)
+	objLabels[Label] = fmt.Sprintf("%d", resourceIndex)
 	objLabels[tenantLabel] = tnt.GetName()
 	// processed will contain the sets of resources replicated, both for the raw and the Namespaced ones:
 	// these are required to perform a final pruning once the replication has been occurred.

main.go

@@ -50,6 +50,7 @@ import (
 	"github.com/clastix/capsule/pkg/webhook/route"
 	"github.com/clastix/capsule/pkg/webhook/service"
 	"github.com/clastix/capsule/pkg/webhook/tenant"
+	tntresource "github.com/clastix/capsule/pkg/webhook/tenantresource"
 	"github.com/clastix/capsule/pkg/webhook/utils"
 )
 
@@ -245,6 +246,7 @@ func main() {
 		route.Ingress(ingress.Class(cfg, kubeVersion), ingress.Hostnames(cfg), ingress.Collision(cfg), ingress.Wildcard()),
 		route.PVC(pvc.Validating(), pvc.PersistentVolumeReuse()),
 		route.Service(service.Handler()),
+		route.TenantResourceObjects(utils.InCapsuleGroups(cfg, tntresource.WriteOpsHandler())),
 		route.NetworkPolicy(utils.InCapsuleGroups(cfg, networkpolicy.Handler())),
 		route.Tenant(tenant.NameHandler(), tenant.RoleBindingRegexHandler(), tenant.IngressClassRegexHandler(), tenant.StorageClassRegexHandler(), tenant.ContainerRegistryRegexHandler(), tenant.HostnameRegexHandler(), tenant.FreezedEmitter(), tenant.ServiceAccountNameHandler(), tenant.ForbiddenAnnotationsRegexHandler(), tenant.ProtectedHandler()),
 		route.OwnerReference(utils.InCapsuleGroups(cfg, namespacewebhook.OwnerReferenceHandler(), ownerreference.Handler(cfg))),

pkg/indexer/indexer.go

@@ -20,6 +20,7 @@ import (
 	"github.com/clastix/capsule/pkg/indexer/ingress"
 	"github.com/clastix/capsule/pkg/indexer/namespace"
 	"github.com/clastix/capsule/pkg/indexer/tenant"
+	"github.com/clastix/capsule/pkg/indexer/tenantresource"
 )
 
 type CustomIndexer interface {
@@ -36,6 +37,8 @@ func AddToManager(ctx context.Context, log logr.Logger, mgr manager.Manager) err
 		ingress.HostnamePath{Obj: &extensionsv1beta1.Ingress{}},
 		ingress.HostnamePath{Obj: &networkingv1beta1.Ingress{}},
 		ingress.HostnamePath{Obj: &networkingv1.Ingress{}},
+		tenantresource.GlobalProcessedItems{},
+		tenantresource.LocalProcessedItems{},
 	}
 
 	for _, f := range indexers {

pkg/indexer/tenantresource/constants.go

@@ -0,0 +1,8 @@
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package tenantresource
+
+const (
+	IndexerFieldName = "status.processedItems"
+)

pkg/indexer/tenantresource/global.go

@@ -0,0 +1,34 @@
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+//nolint:dupl
+package tenantresource
+
+import (
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+)
+
+type GlobalProcessedItems struct{}
+
+func (g GlobalProcessedItems) Object() client.Object {
+	return &capsulev1beta2.GlobalTenantResource{}
+}
+
+func (g GlobalProcessedItems) Field() string {
+	return IndexerFieldName
+}
+
+func (g GlobalProcessedItems) Func() client.IndexerFunc {
+	return func(object client.Object) []string {
+		tgr := object.(*capsulev1beta2.GlobalTenantResource) //nolint:forcetypeassert
+
+		out := make([]string, 0, len(tgr.Status.ProcessedItems))
+		for _, pi := range tgr.Status.ProcessedItems {
+			out = append(out, pi.String())
+		}
+
+		return out
+	}
+}

pkg/indexer/tenantresource/local.go

@@ -0,0 +1,34 @@
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+//nolint:dupl
+package tenantresource
+
+import (
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+)
+
+type LocalProcessedItems struct{}
+
+func (g LocalProcessedItems) Object() client.Object {
+	return &capsulev1beta2.TenantResource{}
+}
+
+func (g LocalProcessedItems) Field() string {
+	return IndexerFieldName
+}
+
+func (g LocalProcessedItems) Func() client.IndexerFunc {
+	return func(object client.Object) []string {
+		tgr := object.(*capsulev1beta2.TenantResource) //nolint:forcetypeassert
+
+		out := make([]string, 0, len(tgr.Status.ProcessedItems))
+		for _, pi := range tgr.Status.ProcessedItems {
+			out = append(out, pi.String())
+		}
+
+		return out
+	}
+}

pkg/webhook/route/tenantresource_objs.go

@@ -0,0 +1,26 @@
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package route
+
+import (
+	capsulewebhook "github.com/clastix/capsule/pkg/webhook"
+)
+
+// +kubebuilder:webhook:path=/tenantresource-objects,mutating=false,sideEffects=None,admissionReviewVersions=v1,failurePolicy=fail,groups="*",resources="*",verbs=update;delete,versions="*",name=resource-objects.tenant.capsule.clastix.io
+
+type tntResourceObjs struct {
+	handlers []capsulewebhook.Handler
+}
+
+func TenantResourceObjects(handlers ...capsulewebhook.Handler) capsulewebhook.Webhook {
+	return &tntResourceObjs{handlers: handlers}
+}
+
+func (t tntResourceObjs) GetPath() string {
+	return "/tenantresource-objects"
+}
+
+func (t tntResourceObjs) GetHandlers() []capsulewebhook.Handler {
+	return t.handlers
+}

pkg/webhook/tenantresource/objects.go

@@ -0,0 +1,89 @@
+// Copyright 2020-2021 Clastix Labs
+// SPDX-License-Identifier: Apache-2.0
+
+package tenant
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/client-go/tools/record"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	capsulev1beta2 "github.com/clastix/capsule/api/v1beta2"
+	"github.com/clastix/capsule/pkg/indexer/tenantresource"
+	capsulewebhook "github.com/clastix/capsule/pkg/webhook"
+	"github.com/clastix/capsule/pkg/webhook/utils"
+)
+
+type cordoningHandler struct{}
+
+func WriteOpsHandler() capsulewebhook.Handler {
+	return &cordoningHandler{}
+}
+
+func (h *cordoningHandler) handler(ctx context.Context, clt client.Client, req admission.Request, recorder record.EventRecorder) *admission.Response {
+	tntList := &capsulev1beta2.TenantList{}
+
+	if err := clt.List(ctx, tntList, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(".status.namespaces", req.Namespace)}); err != nil {
+		return utils.ErroredResponse(err)
+	}
+	// resource is not inside a Tenant namespace:
+	// we can avoid any kind of extra check.
+	if len(tntList.Items) == 0 {
+		return nil
+	}
+	// Checking if the object is managed by a TenantResource, local or global
+	ors := capsulev1beta2.ObjectReferenceStatus{
+		ObjectReferenceAbstract: capsulev1beta2.ObjectReferenceAbstract{
+			Kind:       req.Kind.Kind,
+			Namespace:  req.Namespace,
+			APIVersion: req.Kind.Version,
+		},
+		Name: req.Name,
+	}
+
+	global, local := &capsulev1beta2.GlobalTenantResourceList{}, &capsulev1beta2.TenantResourceList{}
+
+	if err := clt.List(ctx, global, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(tenantresource.IndexerFieldName, ors.String())}); err != nil {
+		return utils.ErroredResponse(err)
+	}
+
+	if err := clt.List(ctx, local, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(tenantresource.IndexerFieldName, ors.String())}); err != nil {
+		return utils.ErroredResponse(err)
+	}
+
+	if len(local.Items) > 0 || len(global.Items) > 0 {
+		tnt := tntList.Items[0]
+
+		recorder.Eventf(&tnt, corev1.EventTypeWarning, "TenantResourceWriteOp", "%s %s/%s cannot be %sd, resource is managed by the Tenant", req.Kind.String(), req.Namespace, req.Name, strings.ToLower(string(req.Operation)))
+
+		response := admission.Denied(fmt.Sprintf("resource %s is managed at the Tenant level", req.Name))
+
+		return &response
+	}
+
+	return nil
+}
+
+func (h *cordoningHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		return nil
+	}
+}
+
+func (h *cordoningHandler) OnDelete(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		return h.handler(ctx, client, req, recorder)
+	}
+}
+
+func (h *cordoningHandler) OnUpdate(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		return h.handler(ctx, client, req, recorder)
+	}
+}