github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-02-14 18:09:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(controller): change managed network policy label check (#1062)

Browse Source 
* fix(controller): change managed network policy label check

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* fix(controller): change managed network policy label check

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
This commit is contained in:
Oliver Bähler
2024-05-27 10:33:46 +02:00
committed by GitHub
parent 0571e419a3
commit 82995a3e66
1 changed files with 27 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
pkg/webhook/networkpolicy/validating.go
View File

@@ -6,14 +6,12 @@ package networkpolicy
import (
"context"
corev1 "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/client-go/tools/record"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
"github.com/projectcapsule/capsule/pkg/webhook/utils"
@@ -31,39 +29,14 @@ func (r *handler) OnCreate(client.Client, admission.Decoder, record.EventRecorde
}
}
func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (*capsulev1beta2.Tenant, error) {
var err error
np := &networkingv1.NetworkPolicy{}
if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
return nil, err
}
tnt := &capsulev1beta2.Tenant{}
l, _ := capsuleutils.GetTypeLabel(&capsulev1beta2.Tenant{})
if v, ok := np.GetLabels()[l]; ok {
if err = client.Get(ctx, types.NamespacedName{Name: v}, tnt); err != nil {
return nil, err
}
return tnt, nil
}
return nil, nil //nolint:nilnil
}
//nolint:dupl
func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
return func(ctx context.Context, req admission.Request) *admission.Response {
tnt, err := r.generic(ctx, req, client, decoder)
allowed, err := r.handle(ctx, req, client, decoder)
if err != nil {
return utils.ErroredResponse(err)
}
if tnt != nil {
recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyDeletion", "NetworkPolicy %s/%s cannot be deleted", req.Namespace, req.Name)
if !allowed {
response := admission.Denied("Capsule Network Policies cannot be deleted: please, reach out to the system administrators")
return &response
@@ -73,17 +46,14 @@ func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, reco
}
}
//nolint:dupl
func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
return func(ctx context.Context, req admission.Request) *admission.Response {
tnt, err := r.generic(ctx, req, client, decoder)
allowed, err := r.handle(ctx, req, client, decoder)
if err != nil {
return utils.ErroredResponse(err)
}
if tnt != nil {
recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyUpdate", "NetworkPolicy %s/%s cannot be updated", req.Namespace, req.Name)
if !allowed {
response := admission.Denied("Capsule Network Policies cannot be updated: please, reach out to the system administrators")
return &response
@@ -92,3 +62,24 @@ func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, reco
return nil
}
}
func (r *handler) handle(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (allowed bool, err error) {
allowed = true
np := &networkingv1.NetworkPolicy{}
if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
return false, err
}
objectLabel, err := capsuleutils.GetTypeLabel(&networkingv1.NetworkPolicy{})
if err != nil {
return
}
labels := np.GetLabels()
if _, ok := labels[objectLabel]; ok {
allowed = false
}
return
}