From 82995a3e669b892eba533c16cb2a82fcdb05596d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20B=C3=A4hler?= Date: Mon, 27 May 2024 10:33:46 +0200 Subject: [PATCH] fix(controller): change managed network policy label check (#1062) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(controller): change managed network policy label check Signed-off-by: Oliver Bähler * fix(controller): change managed network policy label check Signed-off-by: Oliver Bähler --------- Signed-off-by: Oliver Bähler --- pkg/webhook/networkpolicy/validating.go | 63 +++++++++++-------------- 1 file changed, 27 insertions(+), 36 deletions(-) diff --git a/pkg/webhook/networkpolicy/validating.go b/pkg/webhook/networkpolicy/validating.go index 7504304e..14eba4e2 100644 --- a/pkg/webhook/networkpolicy/validating.go +++ b/pkg/webhook/networkpolicy/validating.go @@ -6,14 +6,12 @@ package networkpolicy import ( "context" - corev1 "k8s.io/api/core/v1" networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/types" "k8s.io/client-go/tools/record" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" - capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2" capsuleutils "github.com/projectcapsule/capsule/pkg/utils" capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook" "github.com/projectcapsule/capsule/pkg/webhook/utils" @@ -31,39 +29,14 @@ func (r *handler) OnCreate(client.Client, admission.Decoder, record.EventRecorde } } -func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (*capsulev1beta2.Tenant, error) { - var err error - - np := &networkingv1.NetworkPolicy{} - if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil { - return nil, err - } - - tnt := &capsulev1beta2.Tenant{} - - l, _ := capsuleutils.GetTypeLabel(&capsulev1beta2.Tenant{}) - if v, ok := np.GetLabels()[l]; ok { - if err = client.Get(ctx, types.NamespacedName{Name: v}, tnt); err != nil { - return nil, err - } - - return tnt, nil - } - - return nil, nil //nolint:nilnil -} - -//nolint:dupl -func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { - tnt, err := r.generic(ctx, req, client, decoder) + allowed, err := r.handle(ctx, req, client, decoder) if err != nil { return utils.ErroredResponse(err) } - if tnt != nil { - recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyDeletion", "NetworkPolicy %s/%s cannot be deleted", req.Namespace, req.Name) - + if !allowed { response := admission.Denied("Capsule Network Policies cannot be deleted: please, reach out to the system administrators") return &response @@ -73,17 +46,14 @@ func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, reco } } -//nolint:dupl -func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { - tnt, err := r.generic(ctx, req, client, decoder) + allowed, err := r.handle(ctx, req, client, decoder) if err != nil { return utils.ErroredResponse(err) } - if tnt != nil { - recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyUpdate", "NetworkPolicy %s/%s cannot be updated", req.Namespace, req.Name) - + if !allowed { response := admission.Denied("Capsule Network Policies cannot be updated: please, reach out to the system administrators") return &response @@ -92,3 +62,24 @@ func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, reco return nil } } + +func (r *handler) handle(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (allowed bool, err error) { + allowed = true + + np := &networkingv1.NetworkPolicy{} + if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil { + return false, err + } + + objectLabel, err := capsuleutils.GetTypeLabel(&networkingv1.NetworkPolicy{}) + if err != nil { + return + } + + labels := np.GetLabels() + if _, ok := labels[objectLabel]; ok { + allowed = false + } + + return +}