diff --git a/pkg/webhook/imagepullpolicy/errors.go b/pkg/webhook/imagepullpolicy/errors.go index 1792ddb2..fe8b803f 100644 --- a/pkg/webhook/imagepullpolicy/errors.go +++ b/pkg/webhook/imagepullpolicy/errors.go @@ -23,5 +23,5 @@ func NewImagePullPolicyForbidden(usedPullPolicy, containerName string, allowedPu } func (f podPriorityClassForbidden) Error() (err string) { - return fmt.Sprintf("the ImagePullPolicy %s for container %s is not allowed, use one of the followings: %s", f.usedPullPolicy, f.containerName, strings.Join(f.allowedPullPolicies, ", ")) + return fmt.Sprintf("the ImagePullPolicy %s for container %s is forbidden, use one of the followings: %s", f.usedPullPolicy, f.containerName, strings.Join(f.allowedPullPolicies, ", ")) } diff --git a/pkg/webhook/imagepullpolicy/validating.go b/pkg/webhook/imagepullpolicy/validating.go index ef0a77de..a1d83e13 100644 --- a/pkg/webhook/imagepullpolicy/validating.go +++ b/pkg/webhook/imagepullpolicy/validating.go @@ -78,7 +78,7 @@ func (r *handler) OnCreate(c client.Client, decoder *admission.Decoder, recorder usedPullPolicy := string(container.ImagePullPolicy) if !policy.IsPolicySupported(usedPullPolicy) { - recorder.Eventf(&tnt, corev1.EventTypeWarning, "PullPolicy", "Pod %s/%s pull policy %s is not allowed", req.Namespace, req.Name, usedPullPolicy) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "ForbiddenPullPolicy", "Pod %s/%s pull policy %s is forbidden for the current Tenant", req.Namespace, req.Name, usedPullPolicy) return admission.Denied(NewImagePullPolicyForbidden(usedPullPolicy, container.Name, policy.AllowedPullPolicies()).Error()) } diff --git a/pkg/webhook/ingress/validating.go b/pkg/webhook/ingress/validating.go index eb3f7897..63998b2b 100644 --- a/pkg/webhook/ingress/validating.go +++ b/pkg/webhook/ingress/validating.go @@ -191,16 +191,16 @@ func (r *handler) validateIngress(ctx context.Context, c client.Client, ingress if err := r.validateClass(tenant, ingress.IngressClass()); err != nil { if ic := ingress.IngressClass(); ic != nil { - recorder.Eventf(&tenant, corev1.EventTypeWarning, "InvalidIngressClass", "Ingress %s/%s class %s is forbidden for the current Tenant", ingress.Namespace(), ingress.Name(), *ic) + recorder.Eventf(&tenant, corev1.EventTypeWarning, "ForbidenIngressClass", "Ingress %s/%s class %s is forbidden for the current Tenant", ingress.Namespace(), ingress.Name(), *ic) } else { - recorder.Eventf(&tenant, corev1.EventTypeWarning, "MissingIngressClass", "Ingress %s/%s is missing required class for the current Tenant", ingress.Namespace(), ingress.Name()) + recorder.Eventf(&tenant, corev1.EventTypeWarning, "MissingIngressClass", "Ingress %s/%s is missing IngressClass", ingress.Namespace(), ingress.Name()) } return admission.Errored(http.StatusBadRequest, err) } if err := r.validateHostnames(tenant, ingress.Hostnames()); err != nil { - recorder.Eventf(&tenant, corev1.EventTypeWarning, "InvalidHostname", "Ingress %s/%s hostnames %s is forbidden for the current Tenant", ingress.Namespace(), ingress.Name(), strings.Join(ingress.Hostnames(), ",")) + recorder.Eventf(&tenant, corev1.EventTypeWarning, "ForbiddenHostname", "Ingress %s/%s hostnames %s is forbidden for the current Tenant", ingress.Namespace(), ingress.Name(), strings.Join(ingress.Hostnames(), ",")) return admission.Errored(http.StatusBadRequest, err) } diff --git a/pkg/webhook/namespacequota/validating.go b/pkg/webhook/namespacequota/validating.go index f9d2ffd2..5e14b399 100644 --- a/pkg/webhook/namespacequota/validating.go +++ b/pkg/webhook/namespacequota/validating.go @@ -62,7 +62,7 @@ func (r *handler) OnCreate(client client.Client, decoder *admission.Decoder, rec return admission.Errored(http.StatusBadRequest, err) } if tnt.IsFull() { - recorder.Eventf(tnt, corev1.EventTypeWarning, "NamespaceQuota", "Namespace %s cannot be attached, quota exceeded", ns.GetName()) + recorder.Eventf(tnt, corev1.EventTypeWarning, "NamespaceQuotaExceded", "Namespace %s cannot be attached, quota exceededi for the current Tenant", ns.GetName()) return admission.Denied(NewNamespaceQuotaExceededError().Error()) } diff --git a/pkg/webhook/podpriority/validating.go b/pkg/webhook/podpriority/validating.go index a3e92768..006c5009 100644 --- a/pkg/webhook/podpriority/validating.go +++ b/pkg/webhook/podpriority/validating.go @@ -79,7 +79,7 @@ func (h *handler) OnCreate(c client.Client, decoder *admission.Decoder, recorder // We don't have to force Pod to specify a Priority Class return admission.Allowed("") case !allowed.ExactMatch(priorityClassName) && !allowed.RegexMatch(priorityClassName): - recorder.Eventf(&tntList.Items[0], corev1.EventTypeWarning, "PriorityClass", "Pod %s/%s is using Priority Class %s not allowed for the current Tenant", pod.Namespace, pod.Name, priorityClassName) + recorder.Eventf(&tntList.Items[0], corev1.EventTypeWarning, "ForbiddenPriorityClass", "Pod %s/%s is using Priority Class %s is forbidden for the current Tenant", pod.Namespace, pod.Name, priorityClassName) return admission.Errored(http.StatusBadRequest, NewPodPriorityClassForbidden(priorityClassName, *allowed)) default: diff --git a/pkg/webhook/pvc/validating.go b/pkg/webhook/pvc/validating.go index a744ae11..b4225a47 100644 --- a/pkg/webhook/pvc/validating.go +++ b/pkg/webhook/pvc/validating.go @@ -73,7 +73,7 @@ func (h *handler) OnCreate(c client.Client, decoder *admission.Decoder, recorder } if pvc.Spec.StorageClassName == nil { - recorder.Eventf(&tnt, corev1.EventTypeWarning, "StorageClassInvalid", "PersistentVolumeClaim %s/%s is missing StorageClass", req.Namespace, req.Name) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "MissingStorageClass", "PersistentVolumeClaim %s/%s is missing StorageClass", req.Namespace, req.Name) return admission.Errored(http.StatusBadRequest, NewStorageClassNotValid(*tntList.Items[0].Spec.StorageClasses)) } @@ -82,7 +82,7 @@ func (h *handler) OnCreate(c client.Client, decoder *admission.Decoder, recorder valid = tnt.Spec.StorageClasses.ExactMatch(sc) matched = tnt.Spec.StorageClasses.RegexMatch(sc) if !valid && !matched { - recorder.Eventf(&tnt, corev1.EventTypeWarning, "StorageClassForbidden", "PersistentVolumeClaim %s/%s StorageClass %s is forbidden for the current Tenant", req.Namespace, req.Name, sc) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "ForbiddenStorageClass", "PersistentVolumeClaim %s/%s StorageClass %s is forbidden for the current Tenant", req.Namespace, req.Name, sc) return admission.Errored(http.StatusBadRequest, NewStorageClassForbidden(*pvc.Spec.StorageClassName, *tnt.Spec.StorageClasses)) } diff --git a/pkg/webhook/registry/validating.go b/pkg/webhook/registry/validating.go index 31cfa94a..cfecebd9 100644 --- a/pkg/webhook/registry/validating.go +++ b/pkg/webhook/registry/validating.go @@ -73,7 +73,7 @@ func (h *handler) OnCreate(c client.Client, decoder *admission.Decoder, recorder valid = tnt.Spec.ContainerRegistries.ExactMatch(registry.Registry()) matched = tnt.Spec.ContainerRegistries.RegexMatch(registry.Registry()) if !valid && !matched { - recorder.Eventf(&tnt, corev1.EventTypeWarning, "ContainerRegistry", "Pod %s/%s is using a forbidden registry %s", req.Namespace, req.Name, registry.Registry()) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "ForbiddenContainerRegistry", "Pod %s/%s is using a forbidden registry %s is forbidden for the current Tenant", req.Namespace, req.Name, registry.Registry()) return admission.Errored(http.StatusBadRequest, NewContainerRegistryForbidden(container.Image, *tnt.Spec.ContainerRegistries)) } diff --git a/pkg/webhook/services/errors.go b/pkg/webhook/services/errors.go index ac742406..dfb12921 100644 --- a/pkg/webhook/services/errors.go +++ b/pkg/webhook/services/errors.go @@ -35,5 +35,5 @@ func NewNodePortDisabledError() error { } func (nodePortDisabled) Error() string { - return "NodePort service types are disabled for a tenant: please, reach out to the system administrators" + return "NodePort service types are forbidden for the tenant: please, reach out to the system administrators" } diff --git a/pkg/webhook/services/validating.go b/pkg/webhook/services/validating.go index 5463169a..10c955e8 100644 --- a/pkg/webhook/services/validating.go +++ b/pkg/webhook/services/validating.go @@ -69,7 +69,7 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder tnt := tntList.Items[0] if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" { - recorder.Eventf(&tnt, corev1.EventTypeWarning, "NodePort", "Service %s/%s cannot be type of NodePort", req.Namespace, req.Name) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "ForbiddenNodePort", "Service %s/%s cannot be type of NodePort for the current Tenant", req.Namespace, req.Name) return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError()) } @@ -88,7 +88,7 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder } } - recorder.Eventf(&tnt, corev1.EventTypeWarning, "NodePort", "Service %s/%s external IPs %s are not in the expected range for the current Tenant", req.Namespace, req.Name, strings.Join(svc.Spec.ExternalIPs, ",")) + recorder.Eventf(&tnt, corev1.EventTypeWarning, "ExternalServiceIP", "Service %s/%s external IPs %s are not in the expected range for the current Tenant", req.Namespace, req.Name, strings.Join(svc.Spec.ExternalIPs, ",")) return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed)) } diff --git a/pkg/webhook/tenantprefix/validating.go b/pkg/webhook/tenantprefix/validating.go index 2bd3ccf0..2a5be32f 100644 --- a/pkg/webhook/tenantprefix/validating.go +++ b/pkg/webhook/tenantprefix/validating.go @@ -77,7 +77,7 @@ func (r *handler) OnCreate(clt client.Client, decoder *admission.Decoder, record return admission.Errored(http.StatusBadRequest, err) } if e := fmt.Sprintf("%s-%s", tnt.GetName(), ns.GetName()); !strings.HasPrefix(ns.GetName(), fmt.Sprintf("%s-", tnt.GetName())) { - recorder.Eventf(tnt, corev1.EventTypeWarning, "TenantPrefix", "Namespace %s does not match the expected Tenant prefix", ns.GetName()) + recorder.Eventf(tnt, corev1.EventTypeWarning, "InvalidTenantPrefix", "Namespace %s does not match the expected prefix for the current Tenant", ns.GetName()) return admission.Denied("The namespace doesn't match the tenant prefix, expected " + e) }