mirror of
https://github.com/projectcapsule/capsule.git
synced 2026-08-22 14:07:10 +00:00
copilot-swe-agent[bot]andoliverbaehler
700838e837
- Add GatewayNamespacedName, AllowedGatewaySpec, GatewayRuleSpec types to pkg/api/ - Add Gateways field to NamespaceRuleEnforceBody for per-namespace gateway rules - Add HTTPRoute validation webhook to enforce allowed gateways - Add HTTPRoute default mutation webhook to inject default Gateway parentRef - Update Helm chart with validating/mutating webhook configurations for httproutes - Update CRD schemas for tenants and rulestatuses - Add GatewayForbiddenError and ReasonForbiddenGateway event reason Co-authored-by: oliverbaehler <26610571+oliverbaehler@users.noreply.github.com>
73 lines
2.6 KiB
Go
73 lines
2.6 KiB
Go
// Copyright 2020-2026 Project Capsule Authors
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package defaults
|
|
|
|
import (
|
|
"context"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/util/version"
|
|
"k8s.io/client-go/tools/events"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
|
|
|
|
"github.com/projectcapsule/capsule/pkg/runtime/configuration"
|
|
"github.com/projectcapsule/capsule/pkg/runtime/handlers"
|
|
)
|
|
|
|
type handler struct {
|
|
cfg configuration.Configuration
|
|
version *version.Version
|
|
}
|
|
|
|
func Handler(cfg configuration.Configuration, version *version.Version) handlers.Handler {
|
|
return &handler{
|
|
cfg: cfg,
|
|
version: version,
|
|
}
|
|
}
|
|
|
|
func (h *handler) OnCreate(client client.Client, decoder admission.Decoder, _ events.EventRecorder) handlers.Func {
|
|
return func(ctx context.Context, req admission.Request) *admission.Response {
|
|
return h.mutate(ctx, req, client, decoder)
|
|
}
|
|
}
|
|
|
|
func (h *handler) OnDelete(client.Client, admission.Decoder, events.EventRecorder) handlers.Func {
|
|
return func(context.Context, admission.Request) *admission.Response {
|
|
return nil
|
|
}
|
|
}
|
|
|
|
func (h *handler) OnUpdate(client client.Client, decoder admission.Decoder, _ events.EventRecorder) handlers.Func {
|
|
return func(ctx context.Context, req admission.Request) *admission.Response {
|
|
return h.mutate(ctx, req, client, decoder)
|
|
}
|
|
}
|
|
|
|
func (h *handler) mutate(ctx context.Context, req admission.Request, c client.Client, decoder admission.Decoder) *admission.Response {
|
|
var response *admission.Response
|
|
|
|
switch req.Resource {
|
|
case metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}:
|
|
response = mutatePodDefaults(ctx, req, c, decoder, req.Namespace)
|
|
case metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumeclaims"}:
|
|
response = mutatePVCDefaults(ctx, req, c, decoder, req.Namespace)
|
|
case metav1.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresses"}, metav1.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ingresses"}:
|
|
response = mutateIngressDefaults(ctx, req, h.version, c, decoder, req.Namespace)
|
|
case metav1.GroupVersionResource{Group: "gateway.networking.k8s.io", Version: "v1", Resource: "gateways"}:
|
|
response = mutateGatewayDefaults(ctx, req, c, decoder, req.Namespace)
|
|
case metav1.GroupVersionResource{Group: "gateway.networking.k8s.io", Version: "v1", Resource: "httproutes"}:
|
|
response = mutateHTTPRouteDefaults(ctx, req, c, decoder, req.Namespace)
|
|
}
|
|
|
|
if response == nil {
|
|
skip := admission.Allowed("Skipping Mutation")
|
|
|
|
response = &skip
|
|
}
|
|
|
|
return response
|
|
}
|