admission

Documentation

Index

• Constants
• func MakeTLSServer(ctx context.Context, config *ServerConfig, handler http.Handler, ...) (*http.Server, error)
• type KongHTTPValidator
  • func NewKongHTTPValidator(consumerSvc kong.AbstractConsumerService, pluginSvc kong.AbstractPluginService, ...) KongHTTPValidator
  • func (validator KongHTTPValidator) ValidateClusterPlugin(ctx context.Context, k8sPlugin kongv1.KongClusterPlugin) (bool, string, error)
  • func (validator KongHTTPValidator) ValidateConsumer(ctx context.Context, consumer kongv1.KongConsumer) (bool, string, error)
  • func (validator KongHTTPValidator) ValidateCredential(ctx context.Context, secret corev1.Secret) (bool, string, error)
  • func (validator KongHTTPValidator) ValidateGateway(ctx context.Context, gateway gatewayv1alpha2.Gateway) (bool, string, error)
  • func (validator KongHTTPValidator) ValidateHTTPRoute(ctx context.Context, httproute gatewayv1alpha2.HTTPRoute) (bool, string, error)
  • func (validator KongHTTPValidator) ValidatePlugin(ctx context.Context, k8sPlugin kongv1.KongPlugin) (bool, string, error)
• type KongValidator
• type RequestHandler
  • func (a RequestHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
• type ServerConfig

Constants

const (
	ErrTextConsumerCredentialSecretNotFound   = "consumer referenced non-existent credentials secret"
	ErrTextConsumerCredentialValidationFailed = "consumer credential failed validation"
	ErrTextConsumerExists                     = "consumer already exists"
	ErrTextConsumerUnretrievable              = "failed to fetch consumer from kong"
	ErrTextConsumerUsernameEmpty              = "username cannot be empty"
	ErrTextFailedToRetrieveSecret             = "could not retrieve secrets from the kubernets API" //nolint:gosec
	ErrTextPluginConfigInvalid                = "could not parse plugin configuration"
	ErrTextPluginConfigValidationFailed       = "unable to validate plugin schema"
	ErrTextPluginConfigViolatesSchema         = "plugin failed schema validation: %s"
	ErrTextPluginNameEmpty                    = "plugin name cannot be empty"
	ErrTextPluginSecretConfigUnretrievable    = "could not load secret plugin configuration"
	ErrTextPluginUsesBothConfigTypes          = "plugin cannot use both Config and ConfigFrom"
)

const (
	ErrTextCantRetrieveGatewayClass    = "gatewayclass for this gateway could not be retrieved"
	ErrTextInvalidGatewayConfiguration = "gateway metadata and/or spec are invalid"
)

const (
	DefaultAdmissionWebhookCertPath = "/admission-webhook/tls.crt"
	DefaultAdmissionWebhookKeyPath  = "/admission-webhook/tls.key"
)

Functions

func MakeTLSServer

func MakeTLSServer(ctx context.Context, config *ServerConfig, handler http.Handler,
	log logrus.FieldLogger) (*http.Server, error)

Types

type KongHTTPValidator

type KongHTTPValidator struct {
	ConsumerSvc   kong.AbstractConsumerService
	PluginSvc     kong.AbstractPluginService
	Logger        logrus.FieldLogger
	SecretGetter  kongstate.SecretGetter
	ManagerClient client.Client
	// contains filtered or unexported fields
}

KongHTTPValidator implements KongValidator interface to validate Kong entities using the Admin API of Kong.

func NewKongHTTPValidator

func NewKongHTTPValidator(
	consumerSvc kong.AbstractConsumerService,
	pluginSvc kong.AbstractPluginService,
	logger logrus.FieldLogger,
	managerClient client.Client,
	ingressClass string,
) KongHTTPValidator

NewKongHTTPValidator provides a new KongHTTPValidator object provided a controller-runtime client which will be used to retrieve reference objects such as consumer credentials secrets. If you do not pass a cached client here, the performance of this validator can get very poor at high scales.

func (KongHTTPValidator) ValidateClusterPlugin

func (validator KongHTTPValidator) ValidateClusterPlugin(
	ctx context.Context,
	k8sPlugin kongv1.KongClusterPlugin,
) (bool, string, error)

ValidateClusterPlugin transfers relevant fields from a KongClusterPlugin into a KongPlugin and then returns the result of ValidatePlugin for the derived KongPlugin

func (KongHTTPValidator) ValidateConsumer

func (validator KongHTTPValidator) ValidateConsumer(
	ctx context.Context,
	consumer kongv1.KongConsumer,
) (bool, string, error)

ValidateConsumer checks if consumer has a Username and a consumer with the same username doesn't exist in Kong. If an error occurs during validation, it is returned as the last argument. The first boolean communicates if the consumer is valid or not and string holds a message if the entity is not valid.

func (KongHTTPValidator) ValidateCredential

func (validator KongHTTPValidator) ValidateCredential(
	ctx context.Context,
	secret corev1.Secret,
) (bool, string, error)

ValidateCredential checks if the secret contains a credential meant to be installed in Kong. If so, then it verifies if all the required fields are present in it or not. If valid, it returns true with an empty string, else it returns false with the error messsage. If an error happens during validation, error is returned.

func (KongHTTPValidator) ValidateGateway

func (validator KongHTTPValidator) ValidateGateway(
	ctx context.Context, gateway gatewayv1alpha2.Gateway,
) (bool, string, error)

func (KongHTTPValidator) ValidateHTTPRoute

func (validator KongHTTPValidator) ValidateHTTPRoute(
	ctx context.Context, httproute gatewayv1alpha2.HTTPRoute,
) (bool, string, error)

func (KongHTTPValidator) ValidatePlugin

func (validator KongHTTPValidator) ValidatePlugin(
	ctx context.Context,
	k8sPlugin kongv1.KongPlugin,
) (bool, string, error)

ValidatePlugin checks if k8sPlugin is valid. It does so by performing an HTTP request to Kong's Admin API entity validation endpoints. If an error occurs during validation, it is returned as the last argument. The first boolean communicates if k8sPluign is valid or not and string holds a message if the entity is not valid.

type KongValidator

type KongValidator interface {
	ValidateConsumer(ctx context.Context, consumer kongv1.KongConsumer) (bool, string, error)
	ValidatePlugin(ctx context.Context, plugin kongv1.KongPlugin) (bool, string, error)
	ValidateClusterPlugin(ctx context.Context, plugin kongv1.KongClusterPlugin) (bool, string, error)
	ValidateCredential(ctx context.Context, secret corev1.Secret) (bool, string, error)
	ValidateGateway(ctx context.Context, gateway gatewayv1alpha2.Gateway) (bool, string, error)
	ValidateHTTPRoute(ctx context.Context, httproute gatewayv1alpha2.HTTPRoute) (bool, string, error)
}

KongValidator validates Kong entities.

type RequestHandler

type RequestHandler struct {
	// Validator validates the entities that the k8s API-server asks
	// it the server to validate.
	Validator KongValidator

	Logger logrus.FieldLogger
}

RequestHandler is an HTTP server that can validate Kong Ingress Controllers' Custom Resources using Kubernetes Admission Webhooks.

func (RequestHandler) ServeHTTP

func (a RequestHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP parses AdmissionReview requests and responds back with the validation result of the entity.

type ServerConfig

type ServerConfig struct {
	ListenAddr string

	CertPath string
	Cert     string

	KeyPath string
	Key     string
}