feat(dra): support dra device classes (#1759)

* feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> * feat(dra): support dra device classes Signed-off-by: Hristo Hristov <me@hhristov.info> --------- Signed-off-by: Hristo Hristov <me@hhristov.info>
2026-05-06 01:16:44 +00:00 · 2025-12-04 09:57:45 +02:00
parent 2f9e6c15e8
commit dd39e1a6d5
19 changed files with 1037 additions and 1 deletions
--- a/internal/webhook/dra/errors.go
+++ b/internal/webhook/dra/errors.go
@@ -0,0 +1,42 @@
+// Copyright 2020-2025 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+package dra
+
+import (
+	"fmt"
+
+	"github.com/projectcapsule/capsule/internal/webhook/utils"
+	"github.com/projectcapsule/capsule/pkg/api"
+)
+
+type deviceClassForbiddenError struct {
+	deviceClassName string
+	spec            api.SelectorAllowedListSpec
+}
+
+func (i deviceClassForbiddenError) Error() string {
+	err := fmt.Sprintf("Device Class %s is forbidden for the current Tenant: ", i.deviceClassName)
+
+	return utils.AllowedValuesErrorMessage(i.spec, err)
+}
+
+func NewDeviceClassForbidden(class string, spec api.SelectorAllowedListSpec) error {
+	return &deviceClassForbiddenError{
+		deviceClassName: class,
+		spec:            spec,
+	}
+}
+
+type deviceClassUndefinedError struct {
+	spec api.SelectorAllowedListSpec
+}
+
+func NewDeviceClassUndefined(spec api.SelectorAllowedListSpec) error {
+	return &deviceClassUndefinedError{
+		spec: spec,
+	}
+}
+
+func (i deviceClassUndefinedError) Error() string {
+	return utils.AllowedValuesErrorMessage(i.spec, "Selected DeviceClass is forbidden for the current Tenant or does not exist. Specify a device Class which is allowed by ")
+}
--- a/internal/webhook/dra/validate.go
+++ b/internal/webhook/dra/validate.go
@@ -0,0 +1,109 @@
+// Copyright 2020-2025 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package dra
+
+import (
+	"context"
+	"net/http"
+
+	corev1 "k8s.io/api/core/v1"
+	resources "k8s.io/api/resource/v1"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/tools/record"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	capsulewebhook "github.com/projectcapsule/capsule/internal/webhook"
+	"github.com/projectcapsule/capsule/internal/webhook/utils"
+	"github.com/projectcapsule/capsule/pkg/utils/tenant"
+)
+
+type deviceClass struct{}
+
+func DeviceClass() capsulewebhook.Handler {
+	return &deviceClass{}
+}
+
+func (h *deviceClass) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) *admission.Response {
+		switch res := req.Kind.Kind; res {
+		case "ResourceClaim":
+			rc := &resources.ResourceClaim{}
+			if err := decoder.Decode(req, rc); err != nil {
+				return utils.ErroredResponse(err)
+			}
+
+			return h.validateResourceRequest(ctx, c, decoder, recorder, req, rc.Namespace, rc.Spec.Devices.Requests)
+		case "ResourceClaimTemplate":
+			rct := &resources.ResourceClaimTemplate{}
+			if err := decoder.Decode(req, rct); err != nil {
+				return utils.ErroredResponse(err)
+			}
+
+			return h.validateResourceRequest(ctx, c, decoder, recorder, req, rct.Namespace, rct.Spec.Spec.Devices.Requests)
+		default:
+			return nil
+		}
+	}
+}
+
+func (h *deviceClass) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func {
+	return func(context.Context, admission.Request) *admission.Response {
+		return nil
+	}
+}
+
+func (h *deviceClass) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func {
+	return func(context.Context, admission.Request) *admission.Response {
+		return nil
+	}
+}
+
+func (h *deviceClass) validateResourceRequest(ctx context.Context, c client.Client, _ admission.Decoder, recorder record.EventRecorder, req admission.Request, namespace string, requests []resources.DeviceRequest) *admission.Response {
+	tnt, err := tenant.TenantByStatusNamespace(ctx, c, namespace)
+	if err != nil {
+		return utils.ErroredResponse(err)
+	}
+
+	if tnt == nil {
+		return nil
+	}
+
+	allowed := tnt.Spec.DeviceClasses
+	if allowed == nil {
+		return nil
+	}
+
+	for _, dr := range requests {
+		dc, err := utils.GetDeviceClassByName(ctx, c, dr.Exactly.DeviceClassName)
+		if err != nil && !k8serrors.IsNotFound(err) {
+			response := admission.Errored(http.StatusInternalServerError, err)
+
+			return &response
+		}
+
+		if dc == nil {
+			recorder.Eventf(tnt, corev1.EventTypeWarning, "MissingDeviceClass", "%s %s/%s is missing DeviceClass", req.Kind.Kind, req.Namespace, req.Name)
+
+			response := admission.Denied(NewDeviceClassUndefined(*allowed).Error())
+
+			return &response
+		}
+
+		selector := allowed.SelectorMatch(dc)
+
+		switch {
+		case allowed.Match(dc.Name) || selector:
+			return nil
+		default:
+			recorder.Eventf(tnt, corev1.EventTypeWarning, "ForbiddenDeviceClass", "%s %s/%s DeviceClass %s is forbidden for the current Tenant", req.Kind.Kind, req.Namespace, req.Name, &dc)
+
+			response := admission.Denied(NewDeviceClassForbidden(dc.Name, *allowed).Error())
+
+			return &response
+		}
+	}
+
+	return nil
+}
--- a/internal/webhook/route/deviceclass.go
+++ b/internal/webhook/route/deviceclass.go
@@ -0,0 +1,24 @@
+// Copyright 2020-2025 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package route
+
+import (
+	capsulewebhook "github.com/projectcapsule/capsule/internal/webhook"
+)
+
+type deviceClass struct {
+	handlers []capsulewebhook.Handler
+}
+
+func DeviceClass(handler ...capsulewebhook.Handler) capsulewebhook.Webhook {
+	return &deviceClass{handlers: handler}
+}
+
+func (w *deviceClass) GetHandlers() []capsulewebhook.Handler {
+	return w.handlers
+}
+
+func (w *deviceClass) GetPath() string {
+	return "/devices"
+}
--- a/internal/webhook/utils/error.go
+++ b/internal/webhook/utils/error.go
@@ -20,6 +20,10 @@ func ErroredResponse(err error) *admission.Response {
 }

 func DefaultAllowedValuesErrorMessage(allowed api.DefaultAllowedListSpec, err string) string {
+	return AllowedValuesErrorMessage(allowed.SelectorAllowedListSpec, err)
+}
+
+func AllowedValuesErrorMessage(allowed api.SelectorAllowedListSpec, err string) string {
 	var extra []string
 	if len(allowed.Exact) > 0 {
 		extra = append(extra, fmt.Sprintf("use one from the following list (%s)", strings.Join(allowed.Exact, ", ")))
--- a/internal/webhook/utils/resources.go
+++ b/internal/webhook/utils/resources.go
@@ -9,6 +9,7 @@ import (

 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	resources "k8s.io/api/resource/v1"
 	schedulev1 "k8s.io/api/scheduling/v1"
 	storagev1 "k8s.io/api/storage/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -77,6 +78,16 @@ func GetGatewayClassClassByObjectName(ctx context.Context, c client.Client, gate
 	return gatewayClass, nil
 }

+// Get DeviceClass by name (Does not return error if not found).
+func GetDeviceClassByName(ctx context.Context, c client.Client, name string) (*resources.DeviceClass, error) {
+	class := &resources.DeviceClass{}
+	if err := c.Get(ctx, types.NamespacedName{Name: name}, class); err != nil {
+		return nil, err
+	}
+
+	return class, nil
+}
+
 // IsDefaultPriorityClass checks if the given PriorityClass is cluster default.
 func IsDefaultPriorityClass(class *schedulev1.PriorityClass) bool {
 	if class != nil {