webhooks

Documentation

Index

• func HandleValidation(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ...) (bool, string)
• type ArrayFlags
  • func (i *ArrayFlags) Set(value string) error
  • func (i *ArrayFlags) String() string
• type AuditHandler
  • func NewValidateAuditHandler(pCache policycache.Interface, eventGen event.Interface, ...) AuditHandler
• type WebhookServer
  • func NewWebhookServer(kyvernoClient *kyvernoclient.Clientset, client *client.Client, ...) (*WebhookServer, error)
  • func (ws *WebhookServer) HandleGenerate(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ...)
  • func (ws *WebhookServer) HandleMutation(request *v1beta1.AdmissionRequest, resource unstructured.Unstructured, ...) []byte
  • func (ws *WebhookServer) ResourceMutation(request *v1beta1.AdmissionRequest) *v1beta1.AdmissionResponse
  • func (ws *WebhookServer) RunAsync(stopCh <-chan struct{})
  • func (ws *WebhookServer) Stop(ctx context.Context)

Functions

func HandleValidation

func HandleValidation(
	request *v1beta1.AdmissionRequest,
	policies []*kyverno.ClusterPolicy,
	patchedResource []byte,
	ctx *context.Context,
	userRequestInfo kyverno.RequestInfo,
	statusListener policystatus.Listener,
	eventGen event.Interface,
	pvGenerator policyviolation.GeneratorInterface,
	log logr.Logger,
	dynamicConfig config.Interface) (bool, string)

HandleValidation handles validating webhook admission request If there are no errors in validating rule we apply generation rules patchedResource is the (resource + patches) after applying mutation rules

Types

type ArrayFlags

type ArrayFlags []string

ArrayFlags to store filterkinds

func (*ArrayFlags) Set

func (i *ArrayFlags) Set(value string) error

Set setter for array flags

func (*ArrayFlags) String

func (i *ArrayFlags) String() string

type AuditHandler

type AuditHandler interface {
	Add(request *v1beta1.AdmissionRequest)
	Run(workers int, stopCh <-chan struct{})
}

Handler applies validate audit policies to the admission request the handler adds the request to the work queue and returns immediately the request is processed in background, with the exact same logic when process the admission request in the webhook

func NewValidateAuditHandler

func NewValidateAuditHandler(pCache policycache.Interface,
	eventGen event.Interface,
	statusListener policystatus.Listener,
	pvGenerator policyviolation.GeneratorInterface,
	rbInformer rbacinformer.RoleBindingInformer,
	crbInformer rbacinformer.ClusterRoleBindingInformer,
	log logr.Logger,
	dynamicConfig config.Interface) AuditHandler

NewValidateAuditHandler returns a new instance of audit policy handler

type WebhookServer

type WebhookServer struct {
	// contains filtered or unexported fields
}

WebhookServer contains configured TLS server with MutationWebhook.

func NewWebhookServer

func NewWebhookServer(
	kyvernoClient *kyvernoclient.Clientset,
	client *client.Client,
	tlsPair *tlsutils.TlsPemPair,
	pInformer kyvernoinformer.ClusterPolicyInformer,
	rbInformer rbacinformer.RoleBindingInformer,
	crbInformer rbacinformer.ClusterRoleBindingInformer,
	rInformer rbacinformer.RoleInformer,
	crInformer rbacinformer.ClusterRoleInformer,
	eventGen event.Interface,
	pCache policycache.Interface,
	webhookRegistrationClient *webhookconfig.WebhookRegistrationClient,
	statusSync policystatus.Listener,
	configHandler config.Interface,
	pvGenerator policyviolation.GeneratorInterface,
	grGenerator *generate.Generator,
	resourceWebhookWatcher *webhookconfig.ResourceWebhookRegister,
	auditHandler AuditHandler,
	supportMutateValidate bool,
	cleanUp chan<- struct{},
	log logr.Logger,
	openAPIController *openapi.Controller,
) (*WebhookServer, error)

NewWebhookServer creates new instance of WebhookServer accordingly to given configuration Policy Controller and Kubernetes Client should be initialized in configuration

func (*WebhookServer) HandleGenerate

func (ws *WebhookServer) HandleGenerate(request *v1beta1.AdmissionRequest, policies []*kyverno.ClusterPolicy, ctx *context.Context, userRequestInfo kyverno.RequestInfo, dynamicConfig config.Interface)

HandleGenerate handles admission-requests for policies with generate rules

func (*WebhookServer) HandleMutation

func (ws *WebhookServer) HandleMutation(
	request *v1beta1.AdmissionRequest,
	resource unstructured.Unstructured,
	policies []*kyverno.ClusterPolicy,
	ctx *context.Context,
	userRequestInfo kyverno.RequestInfo) []byte

HandleMutation handles mutating webhook admission request return value: generated patches

func (*WebhookServer) ResourceMutation

func (ws *WebhookServer) ResourceMutation(request *v1beta1.AdmissionRequest) *v1beta1.AdmissionResponse

func (*WebhookServer) RunAsync

func (ws *WebhookServer) RunAsync(stopCh <-chan struct{})

RunAsync TLS server in separate thread and returns control immediately

func (*WebhookServer) Stop

func (ws *WebhookServer) Stop(ctx context.Context)

Stop TLS server and returns control after the server is shut down