github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: wrong order of checks in validating-external-service-ips webhook

Browse Source
This commit is contained in:
Maksim Fedotov
2021-05-27 19:27:43 +02:00
committed by Dario Tranchitella
parent bb6614d1e8
commit ef6eea62dc
1 changed files with 5 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/webhook/services/validating.go
+5 -9
View File
@@ -68,10 +68,6 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
return admission.Errored(http.StatusBadRequest, err)
}
if svc.Spec.ExternalIPs == nil {
return admission.Allowed("")
}
tntList := &v1alpha1.TenantList{}
if err := clt.List(ctx, tntList, client.MatchingFieldsSelector{
Selector: fields.OneTermEqualSelector(".status.namespaces", svc.GetNamespace()),
@@ -83,7 +79,11 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
}
tnt := tntList.Items[0]
if tnt.Spec.ExternalServiceIPs == nil {
if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" {
return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError())
}
if svc.Spec.ExternalIPs == nil || tnt.Spec.ExternalServiceIPs == nil {
return admission.Allowed("")
}
@@ -97,10 +97,6 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
}
}
if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" {
return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError())
}
return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed))
}