capsule/internal/webhook/gateway/validate_class.go

// Copyright 2020-2026 Project Capsule Authors
// SPDX-License-Identifier: Apache-2.0

package gateway

import (
	"context"
	"fmt"
	"net/http"

	corev1 "k8s.io/api/core/v1"
	k8serrors "k8s.io/apimachinery/pkg/api/errors"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"

	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
	"github.com/projectcapsule/capsule/internal/webhook/utils"
	caperrors "github.com/projectcapsule/capsule/pkg/api/errors"
	ad "github.com/projectcapsule/capsule/pkg/runtime/admission"
	"github.com/projectcapsule/capsule/pkg/runtime/configuration"
	"github.com/projectcapsule/capsule/pkg/runtime/events"
	"github.com/projectcapsule/capsule/pkg/runtime/handlers"
)

type class struct {
	configuration configuration.Configuration
}

func Class(configuration configuration.Configuration) handlers.Handler {
	return &class{
		configuration: configuration,
	}
}

func (r *class) OnCreate(
	c client.Client,
	_ client.Reader,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) handlers.Func {
	return func(ctx context.Context, req admission.Request) *admission.Response {
		return r.validate(ctx, c, req, decoder, recorder)
	}
}

func (r *class) OnUpdate(
	c client.Client,
	_ client.Reader,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) handlers.Func {
	return func(ctx context.Context, req admission.Request) *admission.Response {
		return r.validate(ctx, c, req, decoder, recorder)
	}
}

func (r *class) OnDelete(
	client.Client,
	client.Reader,
	admission.Decoder,
	events.EventRecorder,
) handlers.Func {
	return func(context.Context, admission.Request) *admission.Response {
		return nil
	}
}

func (r *class) validate(
	ctx context.Context,
	c client.Client,
	req admission.Request,
	decoder admission.Decoder,
	recorder events.EventRecorder,
) *admission.Response {
	gatewayObj := &gatewayv1.Gateway{}
	if err := decoder.Decode(req, gatewayObj); err != nil {
		return ad.ErroredResponse(err)
	}

	var tnt *capsulev1beta2.Tenant

	tnt, err := TenantFromGateway(ctx, c, gatewayObj)
	if err != nil {
		return ad.ErroredResponse(err)
	}

	if tnt == nil {
		return nil
	}

	allowed := tnt.Spec.GatewayOptions.AllowedClasses

	if allowed == nil {
		return nil
	}

	gatewayClass, err := utils.GetGatewayClassClassByObjectName(ctx, c, gatewayObj.Spec.GatewayClassName)
	if err != nil {
		return ad.ErroredResponse(err)
	}

	if gatewayClass == nil {
		recorder.LabeledEvent(
			gatewayObj,
			corev1.EventTypeWarning,
			events.ReasonMissingGatewayClass,
			events.ActionValidationDenied,
			fmt.Sprintf("Gateway %s/%s is missing GatewayClass", req.Namespace, req.Name),
		).
			WithRelated(tnt).
			WithTenantLabel(tnt).
			WithRequestAnnotations(req).
			Emit(ctx)

		return ad.Deny(caperrors.NewGatewayClassUndefined(*allowed).Error())
	}

	selector := false
	// Verify if the GatewayClass exists and matches the label selector/expression
	if len(allowed.MatchExpressions) > 0 || len(allowed.MatchLabels) > 0 {
		gatewayClassObj, err := utils.GetGatewayClassClassByObjectName(ctx, c, gatewayObj.Spec.GatewayClassName)
		if err != nil && !k8serrors.IsNotFound(err) {
			response := admission.Errored(http.StatusInternalServerError, err)

			return &response
		}

		// Gateway Class is present, check if it matches the selector
		if gatewayClassObj != nil {
			selector = allowed.SelectorMatch(gatewayClassObj)
		}
	}

	switch {
	case allowed.MatchDefault(gatewayClass.Name):
		return nil
	case allowed.Match(gatewayClass.Name) || selector:
		return nil
	default:
		recorder.LabeledEvent(
			gatewayObj,
			corev1.EventTypeWarning,
			events.ReasonForbiddenGatewayClass,
			events.ActionValidationDenied,
			fmt.Sprintf("Gateway %s/%s GatewayClass %s is forbidden for the current Tenant", req.Namespace, req.Name, gatewayClass.GetName()),
		).
			WithRelated(tnt).
			WithTenantLabel(tnt).
			WithRequestAnnotations(req).
			Emit(ctx)

		return ad.Deny(caperrors.NewGatewayClassForbidden(gatewayObj.Name, *allowed).Error())
	}
}