capsule/internal/webhook/ingress/validate_hostnames.go

// Copyright 2020-2026 Project Capsule Authors
// SPDX-License-Identifier: Apache-2.0

package ingress

import (
	"context"
	"regexp"

	"github.com/pkg/errors"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/util/sets"
	"k8s.io/client-go/tools/events"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"

	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
	"github.com/projectcapsule/capsule/internal/webhook/utils"
	caperrors "github.com/projectcapsule/capsule/pkg/api/errors"
	"github.com/projectcapsule/capsule/pkg/runtime/configuration"
	evt "github.com/projectcapsule/capsule/pkg/runtime/events"
	"github.com/projectcapsule/capsule/pkg/runtime/handlers"
)

type hostnames struct {
	configuration configuration.Configuration
}

func Hostnames(configuration configuration.Configuration) handlers.Handler {
	return &hostnames{configuration: configuration}
}

func (r *hostnames) OnCreate(c client.Client, decoder admission.Decoder, recorder events.EventRecorder) handlers.Func {
	return func(ctx context.Context, req admission.Request) *admission.Response {
		return r.validate(ctx, c, req, decoder, recorder)
	}
}

func (r *hostnames) OnUpdate(c client.Client, decoder admission.Decoder, recorder events.EventRecorder) handlers.Func {
	return func(ctx context.Context, req admission.Request) *admission.Response {
		return r.validate(ctx, c, req, decoder, recorder)
	}
}

func (r *hostnames) OnDelete(client.Client, admission.Decoder, events.EventRecorder) handlers.Func {
	return func(context.Context, admission.Request) *admission.Response {
		return nil
	}
}

func (r *hostnames) validate(ctx context.Context, client client.Client, req admission.Request, decoder admission.Decoder, recorder events.EventRecorder) *admission.Response {
	ingress, err := FromRequest(req, decoder)
	if err != nil {
		return utils.ErroredResponse(err)
	}

	var tenant *capsulev1beta2.Tenant

	tenant, err = TenantFromIngress(ctx, client, ingress)
	if err != nil {
		return utils.ErroredResponse(err)
	}

	if tenant == nil || tenant.Spec.IngressOptions.AllowedHostnames == nil {
		return nil
	}

	hostnameList := sets.New[string]()

	for hostname := range ingress.HostnamePathsPairs() {
		if len(hostname) == 0 {
			recorder.Eventf(tenant, nil, corev1.EventTypeWarning, evt.ReasonIngressHostnameEmpty, evt.ActionValidationDenied, "Ingress %s/%s hostname is empty", ingress.Namespace(), ingress.Name())

			return utils.ErroredResponse(caperrors.NewEmptyIngressHostname(*tenant.Spec.IngressOptions.AllowedHostnames))
		}

		hostnameList.Insert(hostname)
	}

	if err = r.validateHostnames(*tenant, hostnameList); err == nil {
		return nil
	}

	var hostnameNotValidErr *caperrors.IngressHostnameNotValidError
	if errors.As(err, &hostnameNotValidErr) {
		recorder.Eventf(tenant, nil, corev1.EventTypeWarning, evt.ReasonIngressHostnameNotValid, evt.ActionValidationDenied, "Ingress %s/%s hostname is not valid", ingress.Namespace(), ingress.Name())

		response := admission.Denied(err.Error())

		return &response
	}

	return utils.ErroredResponse(err)
}

func (r *hostnames) validateHostnames(tenant capsulev1beta2.Tenant, hostnames sets.Set[string]) error {
	if tenant.Spec.IngressOptions.AllowedHostnames == nil {
		return nil
	}

	var valid, matched bool

	tenantHostnameSet := sets.New[string](tenant.Spec.IngressOptions.AllowedHostnames.Exact...)

	var invalidHostnames []string

	if len(hostnames) > 0 {
		if diff := hostnames.Difference(tenantHostnameSet); len(diff) > 0 {
			invalidHostnames = append(invalidHostnames, diff.UnsortedList()...)
		}

		if len(invalidHostnames) == 0 {
			valid = true
		}
	}

	var notMatchingHostnames []string

	//nolint:staticcheck
	if allowedRegex := tenant.Spec.IngressOptions.AllowedHostnames.Regex; len(allowedRegex) > 0 {
		for currentHostname := range hostnames {
			matched, _ = regexp.MatchString(allowedRegex, currentHostname)
			if !matched {
				notMatchingHostnames = append(notMatchingHostnames, currentHostname)
			}
		}

		if len(notMatchingHostnames) == 0 {
			matched = true
		}
	}

	if !valid && !matched {
		return caperrors.NewIngressHostnamesNotValid(invalidHostnames, notMatchingHostnames, *tenant.Spec.IngressOptions.AllowedHostnames)
	}

	return nil
}