webhook

Documentation

Index

• Constants
• type AdmissionAllowHandler
  • func (AdmissionAllowHandler) Handle(_ context.Context, _ admission.Request) admission.Response
• type AuditFactRecorder
• type AuditHandler
  • func NewAuditHandler(config AuditHandlerConfig) (*AuditHandler, error)
  • func (h *AuditHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
• type AuditHandlerConfig
• type CommandAuthorRecorder
• type ValidateOperatorTypesHandler
  • func (h *ValidateOperatorTypesHandler) Handle(ctx context.Context, req admission.Request) admission.Response

Constants

const DefaultAuditMaxRequestBodyBytes = int64(10 * 1024 * 1024)

DefaultAuditMaxRequestBodyBytes limits incoming audit payload size.

const (
	// ValidateAllPath is the broad observe-all validating admission endpoint. It
	// matches every resource and always allows — a test-only capture/observation
	// surface today (the e2e SUT wires it; the Helm chart does not), kept as the
	// stable extension point for a future cluster-wide policy. Per-our-type handling
	// (authorship, config validation) lives on ValidateOperatorTypesPath instead.
	ValidateAllPath = "/validate-all"
)

const ValidateOperatorTypesPath = "/validate-operator-types"

ValidateOperatorTypesPath is the validating admission endpoint scoped to our own operator CRDs. Today its one job is command authorship — capturing the submitter of a command kind (a CommitRequest) into Redis and always allowing — but it is the intended home for per-our-type admission generally (e.g. config validation of WatchRule / GitProvider / GitTarget later), which would be added as additional webhook-config entries with their own rules and failurePolicy. Distinct from the broad observe-all ValidateAllPath.

Types

type AdmissionAllowHandler

type AdmissionAllowHandler struct{}

AdmissionAllowHandler is a validating admission handler that always allows requests.

func (AdmissionAllowHandler) Handle

func (AdmissionAllowHandler) Handle(_ context.Context, _ admission.Request) admission.Response

Handle returns an allow response for every admission request.

type AuditFactRecorder

type AuditFactRecorder interface {
	RecordFact(ctx context.Context, auditRoute string, event auditv1.Event) error
}

AuditFactRecorder stores the minimal author-attribution fact for one accepted, mutating audit event under the AUDIT ROUTE it arrived on, so a fact from one cluster never joins a watch event from another. It is the only thing the audit webhook does now: watch carries the object body, so audit is a pure attribution lookup table. A nil recorder means configured-author mode — the handler is not wired at all.

type AuditHandler

type AuditHandler struct {
	// contains filtered or unexported fields
}

AuditHandler receives kube-apiserver audit events on /audit-webhook and records the author-attribution fact for each Git-relevant mutation. It never writes object state — that comes from WATCH — so it decodes, applies the intrinsic accept gate (stage, verb, success, dry-run, unchanged-RV, subresource), and records the fact.

func NewAuditHandler

func NewAuditHandler(config AuditHandlerConfig) (*AuditHandler, error)

NewAuditHandler creates a new audit handler with the given configuration.

func (*AuditHandler) ServeHTTP

func (h *AuditHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP implements http.Handler for audit event processing.

type AuditHandlerConfig

type AuditHandlerConfig struct {
	// MaxRequestBodyBytes is the maximum accepted HTTP request body size.
	MaxRequestBodyBytes int64
	// FactRecorder persists the attribution fact for each accepted, mutating event.
	// A write failure returns an audit-request error so the API server retries
	// delivery; mirrored-resource author attribution depends on these facts.
	FactRecorder AuditFactRecorder
	// AuditRouteAnnotationKey enables the bare /audit-webhook endpoint for a SHARED audit stream
	// that carries several logical clusters: the AUDIT ROUTE is read PER EVENT from this
	// audit-event annotation, so one batch may fan out to several routes. Empty (the default) means
	// the bare endpoint is NOT enabled and every producer must post to a named
	// /audit-webhook/<audit-route>.
	AuditRouteAnnotationKey string
}

AuditHandlerConfig contains configuration for the audit handler.

type CommandAuthorRecorder

type CommandAuthorRecorder interface {
	RecordCommandAuthor(ctx context.Context, uid types.UID, author queue.CommandAuthor) error
}

CommandAuthorRecorder records the authenticated submitter of one command object. *queue.CommandAuthorStore satisfies it; the interface keeps the handler unit-testable without a live Redis.

type ValidateOperatorTypesHandler

type ValidateOperatorTypesHandler struct {
	Store CommandAuthorRecorder
}

ValidateOperatorTypesHandler is the admission handler for our operator CRDs. Today it does one thing: for a command kind (a CommitRequest) it captures the authenticated submitter into the CommandAuthorStore and always allows — pure observation with a single side effect (a Redis upsert), never a rejection, so a user's command never depends on it succeeding (a missed capture leaves the request without a claimed actor; see docs/spec/commitrequest-admission-authorship.md). It dispatches on the resource (isCommandKind today), so a future config-validation branch for non-command kinds slots in alongside without disturbing this one.

func (*ValidateOperatorTypesHandler) Handle

func (h *ValidateOperatorTypesHandler) Handle(ctx context.Context, req admission.Request) admission.Response

Handle records {uid → author} for an admitted command CREATE before the object persists (the authorship invariant, §2), then allows. Every early return still allows: a non-command kind, a dry-run, a missing uid, or an unauthenticated request simply records nothing and leaves the request without a claimed actor downstream.