Skip to content

Commit

Permalink
Merge pull request #3779 from yike21/add-validation-for-mcs
Browse files Browse the repository at this point in the history
add validation for MultiClusterService
  • Loading branch information
karmada-bot authored Jul 12, 2023
2 parents 0b5106f + 9079268 commit a072609
Show file tree
Hide file tree
Showing 8 changed files with 260 additions and 15 deletions.
44 changes: 29 additions & 15 deletions artifacts/deploy/webhook-configuration.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: clusterpropagationpolicy.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -32,7 +32,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: overridepolicy.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -46,7 +46,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: work.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -60,7 +60,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: autoscaling.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -74,7 +74,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 10
timeoutSeconds: 3
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
Expand All @@ -96,7 +96,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: clusterpropagationpolicy.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -110,7 +110,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: overridepolicy.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -124,7 +124,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: clusteroverridepolicy.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -138,7 +138,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: config.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -152,7 +152,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: resourceinterpretercustomization.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -166,7 +166,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 10
timeoutSeconds: 3
- name: federatedresourcequota.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -180,7 +180,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 10
timeoutSeconds: 3
- name: multiclusteringress.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -194,7 +194,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 10
timeoutSeconds: 3
- name: federatedhpa.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -208,7 +208,7 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 10
timeoutSeconds: 3
- name: cronfederatedhpa.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -222,4 +222,18 @@ webhooks:
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 10
timeoutSeconds: 3
- name: multiclusterservice.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["networking.karmada.io"]
apiVersions: ["*"]
resources: ["multiclusterservices"]
scope: "Namespaced"
clientConfig:
url: https://karmada-webhook.karmada-system.svc:443/validate-multiclusterservice
caBundle: {{caBundle}}
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
14 changes: 14 additions & 0 deletions charts/karmada/templates/_karmada_webhook_configuration.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -199,4 +199,18 @@ webhooks:
sideEffects: None
admissionReviewVersions: ["v1"]
timeoutSeconds: 3
- name: multiclusterservice.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["networking.karmada.io"]
apiVersions: ["*"]
resources: ["multiclusterservices"]
scope: "Namespaced"
clientConfig:
url: https://{{ $name }}-webhook.{{ $namespace }}.svc:443/validate-multiclusterservice
{{- include "karmada.webhook.caBundle" . | nindent 6 }}
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
{{- end -}}
2 changes: 2 additions & 0 deletions cmd/webhook/app/webhook.go
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ import (
"github.com/karmada-io/karmada/pkg/webhook/federatedhpa"
"github.com/karmada-io/karmada/pkg/webhook/federatedresourcequota"
"github.com/karmada-io/karmada/pkg/webhook/multiclusteringress"
"github.com/karmada-io/karmada/pkg/webhook/multiclusterservice"
"github.com/karmada-io/karmada/pkg/webhook/overridepolicy"
"github.com/karmada-io/karmada/pkg/webhook/propagationpolicy"
"github.com/karmada-io/karmada/pkg/webhook/resourceinterpretercustomization"
Expand Down Expand Up @@ -133,6 +134,7 @@ func Run(ctx context.Context, opts *options.Options) error {
hookServer.Register("/validate-cronfederatedhpa", &webhook.Admission{Handler: &cronfederatedhpa.ValidatingAdmission{}})
hookServer.Register("/validate-resourceinterpretercustomization", &webhook.Admission{Handler: &resourceinterpretercustomization.ValidatingAdmission{Client: hookManager.GetClient()}})
hookServer.Register("/validate-multiclusteringress", &webhook.Admission{Handler: &multiclusteringress.ValidatingAdmission{}})
hookServer.Register("/validate-multiclusterservice", &webhook.Admission{Handler: &multiclusterservice.ValidatingAdmission{}})
hookServer.Register("/mutate-federatedhpa", &webhook.Admission{Handler: &federatedhpa.MutatingAdmission{}})
hookServer.WebhookMux.Handle("/readyz/", http.StripPrefix("/readyz/", &healthz.Handler{}))

Expand Down
14 changes: 14 additions & 0 deletions operator/pkg/karmadaresource/webhookconfiguration/manifests.go
Original file line number Diff line number Diff line change
Expand Up @@ -231,5 +231,19 @@ webhooks:
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
- name: multiclusterservice.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["networking.karmada.io"]
apiVersions: ["*"]
resources: ["multiclusterservices"]
scope: "Namespaced"
clientConfig:
url: https://{{ .Service }}.{{ .Namespace }}.svc:443/validate-multiclusterservice
caBundle: {{ .CaBundle }}
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
`
)
14 changes: 14 additions & 0 deletions pkg/karmadactl/cmdinit/karmada/webhook_configuration.go
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,20 @@ webhooks:
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
- name: multiclusterservice.karmada.io
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["networking.karmada.io"]
apiVersions: ["*"]
resources: ["multiclusterservices"]
scope: "Namespaced"
clientConfig:
url: https://karmada-webhook.%[1]s.svc:443/validate-multiclusterservice
caBundle: %[2]s
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: [ "v1" ]
timeoutSeconds: 3
`, systemNamespace, caBundle)
}

Expand Down
1 change: 1 addition & 0 deletions pkg/util/lifted/doc.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

52 changes: 52 additions & 0 deletions pkg/util/lifted/validatingmcs.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
/*
Copyright 2017 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// This code is directly lifted from the Kubernetes codebase.
// For reference:
// https://github.com/kubernetes/kubernetes/blob/release-1.27/pkg/apis/core/validation/validation.go

package lifted

import (
corev1 "k8s.io/api/core/v1"
validation "k8s.io/apimachinery/pkg/util/validation"
"k8s.io/apimachinery/pkg/util/validation/field"
netutils "k8s.io/utils/net"
)

// +lifted:source=https://github.com/kubernetes/kubernetes/blob/release-1.27/pkg/apis/core/validation/validation.go#L6826-L6846

// ValidateLoadBalancerStatus validates required fields on a LoadBalancerStatus
func ValidateLoadBalancerStatus(status *corev1.LoadBalancerStatus, fldPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{}
for i, ingress := range status.Ingress {
idxPath := fldPath.Child("ingress").Index(i)
if len(ingress.IP) > 0 {
if isIP := (netutils.ParseIPSloppy(ingress.IP) != nil); !isIP {
allErrs = append(allErrs, field.Invalid(idxPath.Child("ip"), ingress.IP, "must be a valid IP address"))
}
}
if len(ingress.Hostname) > 0 {
for _, msg := range validation.IsDNS1123Subdomain(ingress.Hostname) {
allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, msg))
}
if isIP := (netutils.ParseIPSloppy(ingress.Hostname) != nil); isIP {
allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, "must be a DNS name, not an IP address"))
}
}
}
return allErrs
}
Loading

0 comments on commit a072609

Please sign in to comment.