feat: add managed resource webhook #1152
Conversation
pkg/webhook/managedresource/managedresource_validating_webhook_test.go
Outdated
Show resolved
Hide resolved
pkg/webhook/managedresource/managedresource_validating_webhook.go
Outdated
Show resolved
Hide resolved
|
The UT gate is failing because of this test https://github.com/Azure/fleet/blob/main/pkg/webhook/webhook_test.go#L28 https://github.com/Azure/fleet/actions/runs/16003096328/job/45142931406?pr=1152 PTAL |
pkg/webhook/managedresource/managedresource_validating_webhook_test.go
Outdated
Show resolved
Hide resolved
|
We should also add E2Es here https://github.com/Azure/fleet/blob/main/test/e2e/webhook_test.go |
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
2 times, most recently
from
de8bc2a to
35cc8f0
Compare
nwnt
changed the title
Signed-off-by: Nont <[email protected]>
Signed-off-by: Nont <[email protected]>
Signed-off-by: Nont <[email protected]>
Signed-off-by: Nont <[email protected]>
Signed-off-by: Nont <[email protected]>
Signed-off-by: Nont <[email protected]>
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
4475ea8 to
660c99d
Compare
|
You may want to look into ValidatingAdmissionPolicy - webhooks are a huge lift (and, if they are blocking, an uptime risk for the api server). VAP is extremely lightweight. |
@stevekuznetsov thanks for the input. We'll go ahead with this approach for now and will be validating if it can be simplified further with the way you suggest. |
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
7952439 to
334f248
Compare
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
334f248 to
9103561
Compare
Signed-off-by: Nont <[email protected]>
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
9103561 to
c35147c
Compare
| if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&raw, &obj, nil); err != nil { | ||
| return nil, nil, err | ||
| } | ||
| o, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| u := unstructured.Unstructured{Object: o} |
There was a problem hiding this comment.
We achieve the same using https://github.com/Azure/fleet/blob/main/pkg/webhook/clusterresourceplacement/v1alpha1_clusterresourceplacement_validating_webhook.go#L41. But this can be handled in a follow up PR
There was a problem hiding this comment.
I think using a converter doesn't improve much here. It's probably even simpler to not have a decoder just to convert from raw to runtime.Object.
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
2b17a21 to
044e29c
Compare
Signed-off-by: Nont <[email protected]>
nwnt
force-pushed
the
nwnt/add-managed-resource-webhook
branch
from
044e29c to
d39c3b3
Compare
4 participants
Description of your changes
Fixes :
Enable the fleet dataplane to deny any create/update/delete operations on ARM managed resources. At the moment, CRP, Namespace, ResourceQuota, and NetworkPolicy can be managed resources.
I have:
make reviewableto ensure this PR is ready for review.How has this code been tested
make local-unit-testran successfullySpecial notes for your reviewer