Files
kubevela/pkg/features/controller_features.go
Ayush Kumar 36f217e258 Feat: webhook reject unknown cr outputs (#6932)
* feat: implement output resource existence validation in component, trait, and policy definitions

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add validation tests for ComponentDefinition and TraitDefinition outputs

- Implement tests for ComponentDefinition with non-existent CRDs in outputs, ensuring they are rejected.
- Add tests for valid outputs in ComponentDefinition, confirming acceptance.
- Include tests for mixed valid and non-K8s outputs in ComponentDefinition, verifying they pass validation.
- Test handling of empty outputs in ComponentDefinition, ensuring they are accepted.
- Introduce tests for invalid apiVersion formats in ComponentDefinition, confirming rejection.
- Add tests for TraitDefinition with mixed valid and invalid outputs, ensuring proper rejection.
- Create YAML manifests for valid and invalid ComponentDefinitions and TraitDefinitions to support e2e tests.
- Ensure comprehensive coverage of edge cases in output validation logic.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

fix: handle errors in resource validation for component, trait, and policy definitions

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

fix: improve error handling in Go module tidy and resource validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add webhook debugging setup and validation tests for ComponentDefinition and TraitDefinition

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add VS Code launch configuration for debugging webhook validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

refactor: streamline error handling in Go module tidy and remove obsolete test manifests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add mock context support for CUE template compilation

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance validation for WorkflowStepDefinition resources and improve output resource checks

Signed-off-by: viskumar <viskumar@guidewire.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: implement resource validation for CUE templates and add unit tests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance logging and validation for component, policy, and trait definitions

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: improve error handling and logging in validation handlers for component, policy, trait, and workflow step definitions

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

Remove testUnknownResource folder from repository

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: implement structured logging for validation handlers and remove deprecated request_logger

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance structured logging and error handling in admission validation handlers

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: improve logging messages in validating handlers for better clarity

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: refactor logging field definitions for consistency and improve error handling in resource validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

chore: add license header to invalid_resource_check.go and invalid_resource_check_test.go

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance validation tests for WorkflowStepDefinition and improve error messages

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add e2e-test-local target for k3d cluster setup and webhook validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add webhook configuration for workflow step definitions with validation rules

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: update e2e-test-local configuration and improve Ingress API version compatibility

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add installation of FluxCD CRDs in pre-hook to prevent webhook validation errors

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add ValidateResourcesExist feature gate and enhance resource validation in webhook handlers

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance resource validation in e2e tests and improve addon definition checks

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: enhance addon definition detection by using owner references for validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: add ValidateResourcesExist feature gate and implement webhook validation for resource existence

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: update Ingress API version to v1 and adjust service references in tests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

chore: remove webhook test commands and related YAML files from makefiles and tests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

chore: remove architecture section from webhook debugging guide

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

feat: update webhook setup script with k3d host gateway IP note and improve cluster creation logic

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Fix: Correct path in Ingress resource definition in template tests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Chore: add empty line to re-trigger failing workflow

Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com>

* Chore: remove space to re-trigger workflow

Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com>

---------

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com>
Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com>
Co-authored-by: Chaitanya Reddy Onteddu <chaitanyareddy0702@gmail.com>
Co-authored-by: Amit Singh <amisingh@guidewire.com>
2025-09-30 09:30:53 -07:00

159 lines
9.6 KiB
Go

/*
Copyright 2021 The KubeVela Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package features
import (
"k8s.io/apimachinery/pkg/util/runtime"
"k8s.io/apiserver/pkg/util/feature"
"k8s.io/component-base/featuregate"
)
const (
// Compatibility Features
// DeprecatedPolicySpec enable the use of deprecated policy spec
DeprecatedPolicySpec featuregate.Feature = "DeprecatedPolicySpec"
// LegacyObjectTypeIdentifier enable the use of legacy object type identifier for selecting ref-object
LegacyObjectTypeIdentifier featuregate.Feature = "LegacyObjectTypeIdentifier"
// DeprecatedObjectLabelSelector enable the use of deprecated object label selector for selecting ref-object
DeprecatedObjectLabelSelector featuregate.Feature = "DeprecatedObjectLabelSelector"
// LegacyResourceTrackerGC enable the gc of legacy resource tracker in managed clusters
LegacyResourceTrackerGC featuregate.Feature = "LegacyResourceTrackerGC"
// LegacyResourceOwnerValidation if enabled, the resource dispatch will allow existing resource not to have owner
// application and the current application will take over it
LegacyResourceOwnerValidation featuregate.Feature = "LegacyResourceOwnerValidation"
// DisableReferObjectsFromURL if set, the url ref objects will be disallowed
DisableReferObjectsFromURL featuregate.Feature = "DisableReferObjectsFromURL"
// ApplyResourceByReplace enforces the modification of resource through PUT requests.
// If not set, the resource modification will use patch requests (three-way-strategy-merge-patch).
// The side effect of enabling this feature is that the request traffic will increase due to
// the increase of bytes transferred and the more frequent resource mutation failure due to the
// potential conflicts.
// If set, KubeVela controller will enforce strong restriction on the managed resource that external
// system would be unable to make modifications to the KubeVela managed resource. In other words,
// no merge for modifications from multiple sources. Only KubeVela keeps the Source-of-Truth for the
// resource.
ApplyResourceByReplace featuregate.Feature = "ApplyResourceByReplace"
// Edge Features
// AuthenticateApplication enable the authentication for application
AuthenticateApplication featuregate.Feature = "AuthenticateApplication"
// ValidateDefinitionPermissions enables RBAC validation for definition access in applications
ValidateDefinitionPermissions featuregate.Feature = "ValidateDefinitionPermissions"
// GzipResourceTracker enables the gzip compression for ResourceTracker. It can be useful if you have large
// application that needs to dispatch lots of resources or large resources (like CRD or huge ConfigMap),
// which at the cost of slower processing speed due to the extra overhead for compression and decompression.
GzipResourceTracker featuregate.Feature = "GzipResourceTracker"
// ZstdResourceTracker enables the zstd compression for ResourceTracker.
// Refer to GzipResourceTracker for its use-cases. It is much faster and more
// efficient than gzip, about 2x faster and compresses to smaller size.
// If you are dealing with very large ResourceTrackers (1MB or so), it should
// have almost NO performance penalties compared to no compression at all.
// If dealing with smaller ResourceTrackers (10KB - 1MB), the performance
// penalties are minimal.
ZstdResourceTracker featuregate.Feature = "ZstdResourceTracker"
// GzipApplicationRevision serves the same purpose as GzipResourceTracker,
// but for ApplicationRevision.
GzipApplicationRevision featuregate.Feature = "GzipApplicationRevision"
// ZstdApplicationRevision serves the same purpose as ZstdResourceTracker,
// but for ApplicationRevision.
ZstdApplicationRevision featuregate.Feature = "ZstdApplicationRevision"
// ApplyOnce enable the apply-once feature for all applications
// If enabled, no StateKeep will be run, ResourceTracker will also disable the storage of all resource data, only
// metadata will be kept
ApplyOnce featuregate.Feature = "ApplyOnce"
// MultiStageComponentApply enable multi-stage feature for component
// If enabled, the dispatch of manifests is performed in batches according to the stage
MultiStageComponentApply featuregate.Feature = "MultiStageComponentApply"
// PreDispatchDryRun enable dryrun before dispatching resources
// Enable this flag can help prevent unsuccessful dispatch resources entering resourcetracker and improve the
// user experiences of gc but at the cost of increasing network requests.
PreDispatchDryRun featuregate.Feature = "PreDispatchDryRun"
// ValidateComponentWhenSharding validate component in sharding mode
// In sharding mode, since ApplicationRevision will not be cached for webhook, the validation of component
// need to call Kubernetes APIServer which can be slow and take up some network traffic. So by default, the
// validation of component will be disabled.
ValidateComponentWhenSharding = "ValidateComponentWhenSharding"
// DisableWebhookAutoSchedule disable auto schedule for application mutating webhook when sharding enabled
// If set to true, the webhook will not make auto schedule for applications and users can make customized
// scheduler for assigning shards to applications
DisableWebhookAutoSchedule = "DisableWebhookAutoSchedule"
// DisableBootstrapClusterInfo disable the cluster info bootstrap at the starting of the controller
DisableBootstrapClusterInfo = "DisableBootstrapClusterInfo"
// InformerCacheFilterUnnecessaryFields filter unnecessary fields for informer cache
InformerCacheFilterUnnecessaryFields = "InformerCacheFilterUnnecessaryFields"
// SharedDefinitionStorageForApplicationRevision use definition cache to reduce duplicated definition storage
// for application revision, must be used with InformerCacheFilterUnnecessaryFields
SharedDefinitionStorageForApplicationRevision = "SharedDefinitionStorageForApplicationRevision"
// DisableWorkflowContextConfigMapCache disable the workflow context's configmap informer cache
DisableWorkflowContextConfigMapCache = "DisableWorkflowContextConfigMapCache"
// EnableCueValidation enable strict cue validation fields for the required parameter field verification
EnableCueValidation = "EnableCueValidation"
// EnableApplicationStatusMetrics enable the collection and export of application status metrics and structured logging
EnableApplicationStatusMetrics = "EnableApplicationStatusMetrics"
// ValidateResourcesExist enables webhook validation to check if resource types referenced in
// ComponentDefinition/TraitDefinition/WorkflowStepDefinition/PolicyDefinition CUE templates exist in the cluster
ValidateResourcesExist = "ValidateResourcesExist"
)
var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
DeprecatedPolicySpec: {Default: false, PreRelease: featuregate.Alpha},
LegacyObjectTypeIdentifier: {Default: false, PreRelease: featuregate.Alpha},
DeprecatedObjectLabelSelector: {Default: false, PreRelease: featuregate.Alpha},
LegacyResourceTrackerGC: {Default: false, PreRelease: featuregate.Beta},
LegacyResourceOwnerValidation: {Default: false, PreRelease: featuregate.Alpha},
DisableReferObjectsFromURL: {Default: false, PreRelease: featuregate.Alpha},
ApplyResourceByReplace: {Default: false, PreRelease: featuregate.Alpha},
AuthenticateApplication: {Default: false, PreRelease: featuregate.Alpha},
ValidateDefinitionPermissions: {Default: false, PreRelease: featuregate.Alpha},
GzipResourceTracker: {Default: false, PreRelease: featuregate.Alpha},
ZstdResourceTracker: {Default: false, PreRelease: featuregate.Alpha},
ApplyOnce: {Default: false, PreRelease: featuregate.Alpha},
MultiStageComponentApply: {Default: false, PreRelease: featuregate.Alpha},
GzipApplicationRevision: {Default: false, PreRelease: featuregate.Alpha},
ZstdApplicationRevision: {Default: false, PreRelease: featuregate.Alpha},
PreDispatchDryRun: {Default: true, PreRelease: featuregate.Alpha},
ValidateComponentWhenSharding: {Default: false, PreRelease: featuregate.Alpha},
DisableWebhookAutoSchedule: {Default: false, PreRelease: featuregate.Alpha},
DisableBootstrapClusterInfo: {Default: false, PreRelease: featuregate.Alpha},
InformerCacheFilterUnnecessaryFields: {Default: true, PreRelease: featuregate.Alpha},
SharedDefinitionStorageForApplicationRevision: {Default: true, PreRelease: featuregate.Alpha},
DisableWorkflowContextConfigMapCache: {Default: true, PreRelease: featuregate.Alpha},
EnableCueValidation: {Default: false, PreRelease: featuregate.Beta},
EnableApplicationStatusMetrics: {Default: false, PreRelease: featuregate.Alpha},
ValidateResourcesExist: {Default: false, PreRelease: featuregate.Alpha},
}
func init() {
runtime.Must(feature.DefaultMutableFeatureGate.Add(defaultFeatureGates))
}