-
Notifications
You must be signed in to change notification settings - Fork 927
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[feat] namespace deletion protection
Signed-off-by: Vacant2333 <vacant2333@gmail.com>
- Loading branch information
1 parent
5135e8f
commit 7902764
Showing
8 changed files
with
145 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| /* | ||
| Copyright 2023 The Karmada Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package resourcedeletionprotection | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| admissionv1 "k8s.io/api/admission/v1" | ||
| "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" | ||
| "k8s.io/klog/v2" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| ) | ||
|
|
||
| // ValidatingAdmission validates CronFederatedHPA object when creating/updating. | ||
| type ValidatingAdmission struct { | ||
| Decoder *admission.Decoder | ||
| } | ||
|
|
||
| // Check if our ValidatingAdmission implements necessary interface | ||
| var _ admission.Handler = &ValidatingAdmission{} | ||
|
|
||
| // If a user assigns the ResourceDeletionProtectionLabelKey label to a specific resource, | ||
| // and the value of this label is ResourceDeletionProtectionAlways, then deletion requests | ||
| // for this resource will be denied. | ||
| // In the current design, only the Value set to 'Always' will be protected, | ||
| // while other values (including 'Never') will not receive any protection. | ||
| // Additional options will be added here in the future. | ||
| const ( | ||
| ResourceDeletionProtectionLabelKey = "karmada.io/deletion-protected" | ||
| ResourceDeletionProtectionAlways = "Always" | ||
| ResourceDeletionProtectionNever = "Never" | ||
| ) | ||
|
|
||
| // Handle implements admission.Handler interface. | ||
| // It yields a response to an AdmissionRequest. | ||
| func (v *ValidatingAdmission) Handle(_ context.Context, req admission.Request) admission.Response { | ||
| if req.Operation == admissionv1.Delete { | ||
| // Parse the uncertain type resource object | ||
| obj := &unstructured.Unstructured{} | ||
| if err := v.Decoder.DecodeRaw(req.OldObject, obj); err != nil { | ||
| return admission.Errored(http.StatusBadRequest, err) | ||
| } | ||
|
|
||
| klog.V(2).Infof("Validating ResourceDeletionProtection for resource: Kind:%s Name:%s Namespace:%s", req.Kind.Kind, obj.GetName(), obj.GetNamespace()) | ||
|
|
||
| if value, ok := obj.GetLabels()[ResourceDeletionProtectionLabelKey]; ok { | ||
| // In normal, requests will be processed here. | ||
| // Only ResourceDeletionProtectionAlways value will be denied | ||
| if value == ResourceDeletionProtectionAlways { | ||
| return admission.Denied(fmt.Sprintf("Resource are protected, remove the label '%s' for delete the resource", ResourceDeletionProtectionLabelKey)) | ||
| } | ||
| return admission.Allowed("") | ||
| } else { | ||
| // The resource must have the label, the webhook configuration will filter resources based on this label | ||
| klog.Errorf("The resource should have label '%s'", ResourceDeletionProtectionLabelKey) | ||
| return admission.Allowed("") | ||
| } | ||
| } | ||
| // The Operation should be 'Delete' only, the webhook configuration will filter other operation types | ||
| klog.Errorf("The operation type should be 'Delete' in ResourceDeletionProtection webhook") | ||
| return admission.Allowed("") | ||
| } |