Skip to content

Commit

Permalink
Added annotation 'sidecar.aws.signing-proxy/scheme' (#50)
Browse files Browse the repository at this point in the history 
* Added annotation 'sidecar.aws.signing-proxy/scheme'

* setting default scheme to HTTPS

* changing scheme to upstream-url-scheme

* Changing --scheme to --upstream-url-scheme

* changing variable name to upstreamUrlScheme

* updated tests
  • Loading branch information
@vijayansarathy
vijayansarathy authored Mar 30, 2023
1 parent fcfe49f commit 102b7fe
Show file tree
Hide file tree
Showing 2 changed files with 99 additions and 81 deletions.
62 changes: 36 additions & 26 deletions controller/webhook.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,32 +20,35 @@ import (
"encoding/json"
"fmt"
"io/ioutil"
"log"
"net/http"
"os"
"strconv"
"strings"

"k8s.io/api/admission/v1beta1"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/kubernetes"
corev1Types "k8s.io/client-go/kubernetes/typed/core/v1"
"log"
"net/http"
"os"
"strings"
"strconv"
)

const (
signingProxyWebhookAnnotationHostKey = "sidecar.aws.signing-proxy/host"
signingProxyWebhookAnnotationInjectKey = "sidecar.aws.signing-proxy/inject"
signingProxyWebhookAnnotationNameKey = "sidecar.aws.signing-proxy/name"
signingProxyWebhookAnnotationRegionKey = "sidecar.aws.signing-proxy/region"
signingProxyWebhookAnnotationRoleArnKey = "sidecar.aws.signing-proxy/role-arn"
signingProxyWebhookAnnotationStatusKey = "sidecar.aws.signing-proxy/status"
signingProxyWebhookAnnotationSchemeKey = "sidecar.aws.signing-proxy/upstream-url-scheme"
signingProxyWebhookAnnotationHostKey = "sidecar.aws.signing-proxy/host"
signingProxyWebhookAnnotationInjectKey = "sidecar.aws.signing-proxy/inject"
signingProxyWebhookAnnotationNameKey = "sidecar.aws.signing-proxy/name"
signingProxyWebhookAnnotationRegionKey = "sidecar.aws.signing-proxy/region"
signingProxyWebhookAnnotationRoleArnKey = "sidecar.aws.signing-proxy/role-arn"
signingProxyWebhookAnnotationStatusKey = "sidecar.aws.signing-proxy/status"
signingProxyWebhookAnnotationUnsignedPayloadKey = "sidecar.aws.signing-proxy/unsigned-payload"
signingProxyWebhookLabelHostKey = "sidecar-host"
signingProxyWebhookLabelNameKey = "sidecar-name"
signingProxyWebhookLabelRegionKey = "sidecar-region"
signingProxyWebhookLabelRoleArnKey = "sidecar-role-arn"
signingProxyWebhookLabelUnsignedPayloadKey = "sidecar-unsigned-payload"
signingProxyWebhookLabelSchemeKey = "sidecar-upstream-url-scheme"
signingProxyWebhookLabelHostKey = "sidecar-host"
signingProxyWebhookLabelNameKey = "sidecar-name"
signingProxyWebhookLabelRegionKey = "sidecar-region"
signingProxyWebhookLabelRoleArnKey = "sidecar-role-arn"
signingProxyWebhookLabelUnsignedPayloadKey = "sidecar-unsigned-payload"
)

var (
Expand Down Expand Up @@ -157,13 +160,13 @@ func (whsvr *WebhookServer) mutate(ctx context.Context, admissionReview *v1beta1

var patchOperations []PatchOperation

host, name, region, unsignedPayload := whsvr.getUpstreamEndpointParameters(nsLabels, &pod.ObjectMeta)
host, name, region, unsignedPayload, scheme := whsvr.getUpstreamEndpointParameters(nsLabels, &pod.ObjectMeta)

sidecarArgs := []string{"--name", name, "--region", region, "--host", host, "--port", ":8005"}
sidecarArgs := []string{"--name", name, "--region", region, "--host", host, "--port", ":8005", "--upstream-url-scheme", scheme}
s, _ := strconv.ParseBool(unsignedPayload)
if (s) {
sidecarArgs = []string{"--name", name, "--region", region, "--host", host, "--port", ":8005", "--unsigned-payload"}

if s {
sidecarArgs = []string{"--name", name, "--region", region, "--host", host, "--port", ":8005", "--unsigned-payload", "--upstream-url-scheme", scheme}
}

roleArn := whsvr.getRoleArn(nsLabels, &pod.ObjectMeta)
Expand Down Expand Up @@ -268,7 +271,7 @@ func (whsvr *WebhookServer) shouldMutate(nsLabels map[string]string, podMetadata
return annotationInject
}

func (whsvr *WebhookServer) getUpstreamEndpointParameters(nsLabels map[string]string, podMetadata *metav1.ObjectMeta) (string, string, string, string) {
func (whsvr *WebhookServer) getUpstreamEndpointParameters(nsLabels map[string]string, podMetadata *metav1.ObjectMeta) (string, string, string, string, string) {
annotations := podMetadata.GetAnnotations()

if annotations == nil {
Expand All @@ -285,13 +288,14 @@ func (whsvr *WebhookServer) getUpstreamEndpointParameters(nsLabels map[string]st
}

if labelInject {
return extractParameters(host, nsLabels[signingProxyWebhookLabelNameKey], nsLabels[signingProxyWebhookLabelRegionKey], nsLabels[signingProxyWebhookLabelUnsignedPayloadKey])
return extractParameters(host, nsLabels[signingProxyWebhookLabelNameKey], nsLabels[signingProxyWebhookLabelRegionKey], nsLabels[signingProxyWebhookLabelUnsignedPayloadKey], nsLabels[signingProxyWebhookLabelSchemeKey])
}

return extractParameters(host, annotations[signingProxyWebhookAnnotationNameKey], annotations[signingProxyWebhookAnnotationRegionKey], annotations[signingProxyWebhookAnnotationUnsignedPayloadKey])
return extractParameters(host, annotations[signingProxyWebhookAnnotationNameKey], annotations[signingProxyWebhookAnnotationRegionKey], annotations[signingProxyWebhookAnnotationUnsignedPayloadKey], annotations[signingProxyWebhookAnnotationSchemeKey])
}

func extractParameters(host string, name string, region string, unsignedPayload string) (string, string, string, string) {
func extractParameters(host string, name string, region string, unsignedPayload string, upstreamUrlScheme string) (string, string, string, string, string) {

if strings.TrimSpace(name) == "" {
name = host[:strings.IndexByte(host, '.')]
}
Expand All @@ -302,7 +306,13 @@ func extractParameters(host string, name string, region string, unsignedPayload
region = hostModified[:strings.IndexByte(hostModified, '.')]
}

return host, name, region, unsignedPayload
upstreamUrlScheme = strings.ToLower(upstreamUrlScheme)

if upstreamUrlScheme == "" || (upstreamUrlScheme != "http" && upstreamUrlScheme != "https") {
upstreamUrlScheme = "https"
}

return host, name, region, unsignedPayload, upstreamUrlScheme
}

func (whsvr *WebhookServer) getRoleArn(nsLabels map[string]string, podMetadata *metav1.ObjectMeta) string {
Expand Down
Loading

0 comments on commit 102b7fe

Please sign in to comment.