Skip to content

Commit a82d55e

Browse files
ronethingbackport-bot[bot]
ronething
authored and
backport-bot[bot]
committed
feat: add secret/service resource checker for webhook (#2583)
Signed-off-by: Ashing Zheng <[email protected]> (cherry picked from commit ec819175cff42354a55525efc9cd28f1a9e52c18)
1 parent 6b98bdb commit a82d55e

22 files changed

+1513
-52
lines changed

‎config/webhook/manifests.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,46 @@ webhooks:
124124
resources:
125125
- gatewayproxies
126126
sideEffects: None
127+
- admissionReviewVersions:
128+
- v1
129+
clientConfig:
130+
service:
131+
name: webhook-service
132+
namespace: system
133+
path: /validate-gateway-networking-k8s-io-v1-grpcroute
134+
failurePolicy: Fail
135+
name: vgrpcroute-v1.kb.io
136+
rules:
137+
- apiGroups:
138+
- gateway.networking.k8s.io
139+
apiVersions:
140+
- v1
141+
operations:
142+
- CREATE
143+
- UPDATE
144+
resources:
145+
- grpcroutes
146+
sideEffects: None
147+
- admissionReviewVersions:
148+
- v1
149+
clientConfig:
150+
service:
151+
name: webhook-service
152+
namespace: system
153+
path: /validate-gateway-networking-k8s-io-v1-httproute
154+
failurePolicy: Fail
155+
name: vhttproute-v1.kb.io
156+
rules:
157+
- apiGroups:
158+
- gateway.networking.k8s.io
159+
apiVersions:
160+
- v1
161+
operations:
162+
- CREATE
163+
- UPDATE
164+
resources:
165+
- httproutes
166+
sideEffects: None
127167
- admissionReviewVersions:
128168
- v1
129169
clientConfig:
@@ -164,3 +204,23 @@ webhooks:
164204
resources:
165205
- ingressclasses
166206
sideEffects: None
207+
- admissionReviewVersions:
208+
- v1
209+
clientConfig:
210+
service:
211+
name: webhook-service
212+
namespace: system
213+
path: /validate-gateway-networking-k8s-io-v1alpha2-tcproute
214+
failurePolicy: Fail
215+
name: vtcproute-v1alpha2.kb.io
216+
rules:
217+
- apiGroups:
218+
- gateway.networking.k8s.io
219+
apiVersions:
220+
- v1alpha2
221+
operations:
222+
- CREATE
223+
- UPDATE
224+
resources:
225+
- tcproutes
226+
sideEffects: None

‎internal/controller/grpcroute_controller.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,6 @@ func (r *GRPCRouteReconciler) listGRPCRoutesForBackendTrafficPolicy(ctx context.
297297
r.Log.Error(fmt.Errorf("unexpected object type"), "failed to convert object to BackendTrafficPolicy")
298298
return nil
299299
}
300-
301300
grpcRouteList := []gatewayv1.GRPCRoute{}
302301
for _, targetRef := range policy.Spec.TargetRefs {
303302
service := &corev1.Service{}

‎internal/manager/webhooks.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ func setupWebhooks(_ context.Context, mgr manager.Manager) error {
3838
if err := webhookv1.SetupGatewayProxyWebhookWithManager(mgr); err != nil {
3939
return err
4040
}
41+
if err := webhookv1.SetupHTTPRouteWebhookWithManager(mgr); err != nil {
42+
return err
43+
}
44+
if err := webhookv1.SetupGRPCRouteWebhookWithManager(mgr); err != nil {
45+
return err
46+
}
47+
if err := webhookv1.SetupTCPRouteWebhookWithManager(mgr); err != nil {
48+
return err
49+
}
4150
if err := webhookv1.SetupApisixConsumerWebhookWithManager(mgr); err != nil {
4251
return err
4352
}

‎internal/webhook/v1/apisixconsumer_webhook.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
3030

3131
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
32+
"github.com/apache/apisix-ingress-controller/internal/controller"
3233
"github.com/apache/apisix-ingress-controller/internal/webhook/v1/reference"
3334
)
3435

@@ -64,6 +65,10 @@ func (v *ApisixConsumerCustomValidator) ValidateCreate(ctx context.Context, obj
6465
}
6566
apisixConsumerLog.Info("Validation for ApisixConsumer upon creation", "name", consumer.GetName(), "namespace", consumer.GetNamespace())
6667

68+
if !controller.MatchesIngressClass(v.Client, apisixConsumerLog, consumer) {
69+
return nil, nil
70+
}
71+
6772
return v.collectWarnings(ctx, consumer), nil
6873
}
6974

@@ -73,6 +78,9 @@ func (v *ApisixConsumerCustomValidator) ValidateUpdate(ctx context.Context, oldO
7378
return nil, fmt.Errorf("expected an ApisixConsumer object for the newObj but got %T", newObj)
7479
}
7580
apisixConsumerLog.Info("Validation for ApisixConsumer upon update", "name", consumer.GetName(), "namespace", consumer.GetNamespace())
81+
if !controller.MatchesIngressClass(v.Client, apisixConsumerLog, consumer) {
82+
return nil, nil
83+
}
7684

7785
return v.collectWarnings(ctx, consumer), nil
7886
}

‎internal/webhook/v1/apisixconsumer_webhook_test.go‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,25 +21,39 @@ import (
2121

2222
"github.com/stretchr/testify/require"
2323
corev1 "k8s.io/api/core/v1"
24+
networkingv1 "k8s.io/api/networking/v1"
2425
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
2728
"sigs.k8s.io/controller-runtime/pkg/client/fake"
2829

2930
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
31+
"github.com/apache/apisix-ingress-controller/internal/controller/config"
3032
)
3133

3234
func buildApisixConsumerValidator(t *testing.T, objects ...runtime.Object) *ApisixConsumerCustomValidator {
3335
t.Helper()
3436

3537
scheme := runtime.NewScheme()
3638
require.NoError(t, clientgoscheme.AddToScheme(scheme))
39+
require.NoError(t, networkingv1.AddToScheme(scheme))
3740
require.NoError(t, apisixv2.AddToScheme(scheme))
3841

39-
builder := fake.NewClientBuilder().WithScheme(scheme)
40-
if len(objects) > 0 {
41-
builder = builder.WithRuntimeObjects(objects...)
42+
managed := []runtime.Object{
43+
&networkingv1.IngressClass{
44+
ObjectMeta: metav1.ObjectMeta{
45+
Name: "apisix",
46+
Annotations: map[string]string{
47+
"ingressclass.kubernetes.io/is-default-class": "true",
48+
},
49+
},
50+
Spec: networkingv1.IngressClassSpec{
51+
Controller: config.ControllerConfig.ControllerName,
52+
},
53+
},
4254
}
55+
allObjects := append(managed, objects...)
56+
builder := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(allObjects...)
4357

4458
return NewApisixConsumerCustomValidator(builder.Build())
4559
}
@@ -51,6 +65,7 @@ func TestApisixConsumerValidator_MissingBasicAuthSecret(t *testing.T) {
5165
Namespace: "default",
5266
},
5367
Spec: apisixv2.ApisixConsumerSpec{
68+
IngressClassName: "apisix",
5469
AuthParameter: apisixv2.ApisixConsumerAuthParameter{
5570
BasicAuth: &apisixv2.ApisixConsumerBasicAuth{
5671
SecretRef: &corev1.LocalObjectReference{Name: "basic-auth"},
@@ -74,6 +89,7 @@ func TestApisixConsumerValidator_MultipleSecretWarnings(t *testing.T) {
7489
Namespace: "default",
7590
},
7691
Spec: apisixv2.ApisixConsumerSpec{
92+
IngressClassName: "apisix",
7793
AuthParameter: apisixv2.ApisixConsumerAuthParameter{
7894
BasicAuth: &apisixv2.ApisixConsumerBasicAuth{
7995
SecretRef: &corev1.LocalObjectReference{Name: "basic-auth"},
@@ -113,6 +129,7 @@ func TestApisixConsumerValidator_NoWarningsWhenSecretsExist(t *testing.T) {
113129
Namespace: "default",
114130
},
115131
Spec: apisixv2.ApisixConsumerSpec{
132+
IngressClassName: "apisix",
116133
AuthParameter: apisixv2.ApisixConsumerAuthParameter{
117134
KeyAuth: &apisixv2.ApisixConsumerKeyAuth{
118135
SecretRef: &corev1.LocalObjectReference{Name: "key-auth"},

‎internal/webhook/v1/apisixroute_webhook.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
2929

3030
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
31+
"github.com/apache/apisix-ingress-controller/internal/controller"
3132
"github.com/apache/apisix-ingress-controller/internal/webhook/v1/reference"
3233
)
3334

@@ -62,6 +63,9 @@ func (v *ApisixRouteCustomValidator) ValidateCreate(ctx context.Context, obj run
6263
return nil, fmt.Errorf("expected an ApisixRoute object but got %T", obj)
6364
}
6465
apisixRouteLog.Info("Validation for ApisixRoute upon creation", "name", route.GetName(), "namespace", route.GetNamespace())
66+
if !controller.MatchesIngressClass(v.Client, apisixRouteLog, route) {
67+
return nil, nil
68+
}
6569

6670
return v.collectWarnings(ctx, route), nil
6771
}
@@ -72,6 +76,9 @@ func (v *ApisixRouteCustomValidator) ValidateUpdate(ctx context.Context, oldObj,
7276
return nil, fmt.Errorf("expected an ApisixRoute object for the newObj but got %T", newObj)
7377
}
7478
apisixRouteLog.Info("Validation for ApisixRoute upon update", "name", route.GetName(), "namespace", route.GetNamespace())
79+
if !controller.MatchesIngressClass(v.Client, apisixRouteLog, route) {
80+
return nil, nil
81+
}
7582

7683
return v.collectWarnings(ctx, route), nil
7784
}

‎internal/webhook/v1/apisixroute_webhook_test.go‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,25 +21,39 @@ import (
2121

2222
"github.com/stretchr/testify/require"
2323
corev1 "k8s.io/api/core/v1"
24+
networkingv1 "k8s.io/api/networking/v1"
2425
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
2728
"sigs.k8s.io/controller-runtime/pkg/client/fake"
2829

2930
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
31+
"github.com/apache/apisix-ingress-controller/internal/controller/config"
3032
)
3133

3234
func buildApisixRouteValidator(t *testing.T, objects ...runtime.Object) *ApisixRouteCustomValidator {
3335
t.Helper()
3436

3537
scheme := runtime.NewScheme()
3638
require.NoError(t, clientgoscheme.AddToScheme(scheme))
39+
require.NoError(t, networkingv1.AddToScheme(scheme))
3740
require.NoError(t, apisixv2.AddToScheme(scheme))
3841

39-
builder := fake.NewClientBuilder().WithScheme(scheme)
40-
if len(objects) > 0 {
41-
builder = builder.WithRuntimeObjects(objects...)
42+
managed := []runtime.Object{
43+
&networkingv1.IngressClass{
44+
ObjectMeta: metav1.ObjectMeta{
45+
Name: "apisix",
46+
Annotations: map[string]string{
47+
"ingressclass.kubernetes.io/is-default-class": "true",
48+
},
49+
},
50+
Spec: networkingv1.IngressClassSpec{
51+
Controller: config.ControllerConfig.ControllerName,
52+
},
53+
},
4254
}
55+
allObjects := append(managed, objects...)
56+
builder := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(allObjects...)
4357

4458
return NewApisixRouteCustomValidator(builder.Build())
4559
}
@@ -51,6 +65,7 @@ func TestApisixRouteValidator_MissingHTTPService(t *testing.T) {
5165
Namespace: "default",
5266
},
5367
Spec: apisixv2.ApisixRouteSpec{
68+
IngressClassName: "apisix",
5469
HTTP: []apisixv2.ApisixRouteHTTP{{
5570
Name: "rule",
5671
Backends: []apisixv2.ApisixRouteHTTPBackend{{
@@ -75,6 +90,7 @@ func TestApisixRouteValidator_MissingPluginSecret(t *testing.T) {
7590
Namespace: "default",
7691
},
7792
Spec: apisixv2.ApisixRouteSpec{
93+
IngressClassName: "apisix",
7894
HTTP: []apisixv2.ApisixRouteHTTP{{
7995
Name: "rule",
8096
Backends: []apisixv2.ApisixRouteHTTPBackend{{
@@ -106,6 +122,7 @@ func TestApisixRouteValidator_MissingStreamService(t *testing.T) {
106122
Namespace: "default",
107123
},
108124
Spec: apisixv2.ApisixRouteSpec{
125+
IngressClassName: "apisix",
109126
Stream: []apisixv2.ApisixRouteStream{{
110127
Name: "stream",
111128
Protocol: "TCP",
@@ -131,6 +148,7 @@ func TestApisixRouteValidator_NoWarnings(t *testing.T) {
131148
Namespace: "default",
132149
},
133150
Spec: apisixv2.ApisixRouteSpec{
151+
IngressClassName: "apisix",
134152
HTTP: []apisixv2.ApisixRouteHTTP{{
135153
Name: "rule",
136154
Backends: []apisixv2.ApisixRouteHTTPBackend{{

‎internal/webhook/v1/apisixtls_webhook.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
2929

3030
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
31+
"github.com/apache/apisix-ingress-controller/internal/controller"
3132
"github.com/apache/apisix-ingress-controller/internal/webhook/v1/reference"
3233
)
3334

@@ -62,6 +63,9 @@ func (v *ApisixTlsCustomValidator) ValidateCreate(ctx context.Context, obj runti
6263
return nil, fmt.Errorf("expected an ApisixTls object but got %T", obj)
6364
}
6465
apisixTlsLog.Info("Validation for ApisixTls upon creation", "name", tls.GetName(), "namespace", tls.GetNamespace())
66+
if !controller.MatchesIngressClass(v.Client, apisixTlsLog, tls) {
67+
return nil, nil
68+
}
6569

6670
return v.collectWarnings(ctx, tls), nil
6771
}
@@ -72,6 +76,9 @@ func (v *ApisixTlsCustomValidator) ValidateUpdate(ctx context.Context, oldObj, n
7276
return nil, fmt.Errorf("expected an ApisixTls object for the newObj but got %T", newObj)
7377
}
7478
apisixTlsLog.Info("Validation for ApisixTls upon update", "name", tls.GetName(), "namespace", tls.GetNamespace())
79+
if !controller.MatchesIngressClass(v.Client, apisixTlsLog, tls) {
80+
return nil, nil
81+
}
7582

7683
return v.collectWarnings(ctx, tls), nil
7784
}

‎internal/webhook/v1/apisixtls_webhook_test.go‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,25 +21,39 @@ import (
2121

2222
"github.com/stretchr/testify/require"
2323
corev1 "k8s.io/api/core/v1"
24+
networkingv1 "k8s.io/api/networking/v1"
2425
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
2728
"sigs.k8s.io/controller-runtime/pkg/client/fake"
2829

2930
apisixv2 "github.com/apache/apisix-ingress-controller/api/v2"
31+
"github.com/apache/apisix-ingress-controller/internal/controller/config"
3032
)
3133

3234
func buildApisixTlsValidator(t *testing.T, objects ...runtime.Object) *ApisixTlsCustomValidator {
3335
t.Helper()
3436

3537
scheme := runtime.NewScheme()
3638
require.NoError(t, clientgoscheme.AddToScheme(scheme))
39+
require.NoError(t, networkingv1.AddToScheme(scheme))
3740
require.NoError(t, apisixv2.AddToScheme(scheme))
3841

39-
builder := fake.NewClientBuilder().WithScheme(scheme)
40-
if len(objects) > 0 {
41-
builder = builder.WithRuntimeObjects(objects...)
42+
managed := []runtime.Object{
43+
&networkingv1.IngressClass{
44+
ObjectMeta: metav1.ObjectMeta{
45+
Name: "apisix",
46+
Annotations: map[string]string{
47+
"ingressclass.kubernetes.io/is-default-class": "true",
48+
},
49+
},
50+
Spec: networkingv1.IngressClassSpec{
51+
Controller: config.ControllerConfig.ControllerName,
52+
},
53+
},
4254
}
55+
allObjects := append(managed, objects...)
56+
builder := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(allObjects...)
4357

4458
return NewApisixTlsCustomValidator(builder.Build())
4559
}
@@ -51,7 +65,8 @@ func newApisixTls() *apisixv2.ApisixTls {
5165
Namespace: "default",
5266
},
5367
Spec: apisixv2.ApisixTlsSpec{
54-
Hosts: []apisixv2.HostType{"example.com"},
68+
IngressClassName: "apisix",
69+
Hosts: []apisixv2.HostType{"example.com"},
5570
Secret: apisixv2.ApisixSecret{
5671
Name: "server-cert",
5772
Namespace: "default",

0 commit comments

Comments
 (0)