Skip to content

Commit 823403f

Browse files
zijiren233zijiren233
committed
feat: check user request service account
1 parent 0dc0838 commit 823403f

File tree

9 files changed

+2116
-2390
lines changed

9 files changed

+2116
-2390
lines changed

‎webhooks/admission/api/v1/pod_validator_test.go‎

Lines changed: 0 additions & 626 deletions
This file was deleted.

‎webhooks/admission/api/v1/pod_webhook.go‎

Lines changed: 0 additions & 406 deletions
This file was deleted.

‎webhooks/admission/api/v1/pod_webhook_test.go‎

Lines changed: 0 additions & 1346 deletions
This file was deleted.

‎webhooks/admission/api/v1/workload_webhook.go‎

Lines changed: 631 additions & 0 deletions
Large diffs are not rendered by default.

‎webhooks/admission/api/v1/workload_webhook_test.go‎

Lines changed: 1148 additions & 0 deletions
Large diffs are not rendered by default.

‎webhooks/admission/cmd/main.go‎

Lines changed: 45 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"strings"
2323

2424
v1 "github.com/labring/sealos/webhook/admission/api/v1"
25+
appsv1 "k8s.io/api/apps/v1"
2526
corev1 "k8s.io/api/core/v1"
2627
"k8s.io/apimachinery/pkg/runtime"
2728
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -181,17 +182,52 @@ func main() {
181182
os.Exit(1)
182183
}
183184

185+
// Create workload mutator and validator
186+
workloadMutatorValidator := v1.NewWorkloadMutatorWithThresholds(
187+
defaultOversellRatio,
188+
databaseOversellRatio,
189+
skipCPUThreshold,
190+
skipMemoryThreshold,
191+
)
192+
193+
// Register Deployment webhook
194+
err = builder.WebhookManagedBy(mgr).
195+
For(&appsv1.Deployment{}).
196+
WithDefaulter(workloadMutatorValidator).
197+
WithValidator(workloadMutatorValidator).
198+
Complete()
199+
if err != nil {
200+
setupLog.Error(err, "unable to create deployment webhook")
201+
os.Exit(1)
202+
}
203+
204+
// Register StatefulSet webhook
205+
err = builder.WebhookManagedBy(mgr).
206+
For(&appsv1.StatefulSet{}).
207+
WithDefaulter(workloadMutatorValidator).
208+
WithValidator(workloadMutatorValidator).
209+
Complete()
210+
if err != nil {
211+
setupLog.Error(err, "unable to create statefulset webhook")
212+
os.Exit(1)
213+
}
214+
215+
// Register ReplicaSet webhook
216+
err = builder.WebhookManagedBy(mgr).
217+
For(&appsv1.ReplicaSet{}).
218+
WithDefaulter(workloadMutatorValidator).
219+
WithValidator(workloadMutatorValidator).
220+
Complete()
221+
if err != nil {
222+
setupLog.Error(err, "unable to create replicaset webhook")
223+
os.Exit(1)
224+
}
225+
226+
// Register Pod webhook (only for pods created directly by users)
184227
err = builder.WebhookManagedBy(mgr).
185228
For(&corev1.Pod{}).
186-
WithDefaulter(
187-
v1.NewPodMutatorWithThresholds(
188-
defaultOversellRatio,
189-
databaseOversellRatio,
190-
skipCPUThreshold,
191-
skipMemoryThreshold,
192-
),
193-
).
194-
WithValidator(&v1.PodValidator{}).
229+
WithDefaulter(workloadMutatorValidator).
230+
WithValidator(workloadMutatorValidator).
195231
Complete()
196232
if err != nil {
197233
setupLog.Error(err, "unable to create pod webhook")

‎webhooks/admission/config/webhook/manifests.yaml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,78 @@ webhooks:
6666
resources:
6767
- namespaces
6868
sideEffects: None
69+
- admissionReviewVersions:
70+
- v1
71+
clientConfig:
72+
service:
73+
name: webhook-service
74+
namespace: system
75+
path: /mutate-apps-v1-deployment
76+
failurePolicy: Ignore
77+
name: mdeployment.sealos.io
78+
namespaceSelector:
79+
matchExpressions:
80+
- key: user.sealos.io/owner
81+
operator: Exists
82+
rules:
83+
- apiGroups:
84+
- apps
85+
apiVersions:
86+
- v1
87+
operations:
88+
- CREATE
89+
- UPDATE
90+
resources:
91+
- deployments
92+
sideEffects: None
93+
- admissionReviewVersions:
94+
- v1
95+
clientConfig:
96+
service:
97+
name: webhook-service
98+
namespace: system
99+
path: /mutate-apps-v1-statefulset
100+
failurePolicy: Ignore
101+
name: mstatefulset.sealos.io
102+
namespaceSelector:
103+
matchExpressions:
104+
- key: user.sealos.io/owner
105+
operator: Exists
106+
rules:
107+
- apiGroups:
108+
- apps
109+
apiVersions:
110+
- v1
111+
operations:
112+
- CREATE
113+
- UPDATE
114+
resources:
115+
- statefulsets
116+
sideEffects: None
117+
- admissionReviewVersions:
118+
- v1
119+
clientConfig:
120+
service:
121+
name: webhook-service
122+
namespace: system
123+
path: /mutate-apps-v1-replicaset
124+
failurePolicy: Ignore
125+
name: mreplicaset.sealos.io
126+
namespaceSelector:
127+
matchExpressions:
128+
- key: user.sealos.io/owner
129+
operator: Exists
130+
rules:
131+
- apiGroups:
132+
- apps
133+
apiVersions:
134+
- v1
135+
operations:
136+
- CREATE
137+
- UPDATE
138+
resources:
139+
- replicasets
140+
sideEffects: None
69141
- admissionReviewVersions:
70142
- v1
71143
clientConfig:
@@ -146,6 +218,78 @@ webhooks:
146218
resources:
147219
- namespaces
148220
sideEffects: None
221+
- admissionReviewVersions:
222+
- v1
223+
clientConfig:
224+
service:
225+
name: webhook-service
226+
namespace: system
227+
path: /validate-apps-v1-deployment
228+
failurePolicy: Ignore
229+
name: vdeployment.sealos.io
230+
namespaceSelector:
231+
matchExpressions:
232+
- key: user.sealos.io/owner
233+
operator: Exists
234+
rules:
235+
- apiGroups:
236+
- apps
237+
apiVersions:
238+
- v1
239+
operations:
240+
- CREATE
241+
- UPDATE
242+
resources:
243+
- deployments
244+
sideEffects: None
245+
- admissionReviewVersions:
246+
- v1
247+
clientConfig:
248+
service:
249+
name: webhook-service
250+
namespace: system
251+
path: /validate-apps-v1-statefulset
252+
failurePolicy: Ignore
253+
name: vstatefulset.sealos.io
254+
namespaceSelector:
255+
matchExpressions:
256+
- key: user.sealos.io/owner
257+
operator: Exists
258+
rules:
259+
- apiGroups:
260+
- apps
261+
apiVersions:
262+
- v1
263+
operations:
264+
- CREATE
265+
- UPDATE
266+
resources:
267+
- statefulsets
268+
sideEffects: None
269+
- admissionReviewVersions:
270+
- v1
271+
clientConfig:
272+
service:
273+
name: webhook-service
274+
namespace: system
275+
path: /validate-apps-v1-replicaset
276+
failurePolicy: Ignore
277+
name: vreplicaset.sealos.io
278+
namespaceSelector:
279+
matchExpressions:
280+
- key: user.sealos.io/owner
281+
operator: Exists
282+
rules:
283+
- apiGroups:
284+
- apps
285+
apiVersions:
286+
- v1
287+
operations:
288+
- CREATE
289+
- UPDATE
290+
resources:
291+
- replicasets
292+
sideEffects: None
149293
- admissionReviewVersions:
150294
- v1
151295
clientConfig:

‎webhooks/admission/deploy/Kubefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ ENV icpKey=""
2020
ENV namespaceWebhookEnabled="true"
2121
ENV namespaceWebhookFailurePolicy="Fail"
2222

23-
ENV podWebhookEnabled="true"
23+
# Workload webhook settings (applies to Deployment, StatefulSet, ReplicaSet, and Pod)
24+
ENV workloadWebhookEnabled="true"
2425
ENV defaultOversellRatio="10"
2526
ENV databaseOversellRatio="5"
2627
ENV skipCPUThreshold="100m"

‎webhooks/admission/deploy/manifests/deploy.yaml.tmpl‎

Lines changed: 146 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,79 @@ webhooks:
489489
- namespaces
490490
sideEffects: None
491491
{{ end }}
492-
{{ if .podWebhookEnabled }}
492+
{{ if .workloadWebhookEnabled }}
493+
- admissionReviewVersions:
494+
- v1
495+
clientConfig:
496+
service:
497+
name: admission-webhook-service
498+
namespace: sealos-system
499+
path: /mutate-apps-v1-deployment
500+
failurePolicy: Ignore
501+
name: mdeployment.sealos.io
502+
namespaceSelector:
503+
matchExpressions:
504+
- key: user.sealos.io/owner
505+
operator: Exists
506+
rules:
507+
- apiGroups:
508+
- apps
509+
apiVersions:
510+
- v1
511+
operations:
512+
- CREATE
513+
- UPDATE
514+
resources:
515+
- deployments
516+
sideEffects: None
517+
- admissionReviewVersions:
518+
- v1
519+
clientConfig:
520+
service:
521+
name: admission-webhook-service
522+
namespace: sealos-system
523+
path: /mutate-apps-v1-statefulset
524+
failurePolicy: Ignore
525+
name: mstatefulset.sealos.io
526+
namespaceSelector:
527+
matchExpressions:
528+
- key: user.sealos.io/owner
529+
operator: Exists
530+
rules:
531+
- apiGroups:
532+
- apps
533+
apiVersions:
534+
- v1
535+
operations:
536+
- CREATE
537+
- UPDATE
538+
resources:
539+
- statefulsets
540+
sideEffects: None
541+
- admissionReviewVersions:
542+
- v1
543+
clientConfig:
544+
service:
545+
name: admission-webhook-service
546+
namespace: sealos-system
547+
path: /mutate-apps-v1-replicaset
548+
failurePolicy: Ignore
549+
name: mreplicaset.sealos.io
550+
namespaceSelector:
551+
matchExpressions:
552+
- key: user.sealos.io/owner
553+
operator: Exists
554+
rules:
555+
- apiGroups:
556+
- apps
557+
apiVersions:
558+
- v1
559+
operations:
560+
- CREATE
561+
- UPDATE
562+
resources:
563+
- replicasets
564+
sideEffects: None
493565
- admissionReviewVersions:
494566
- v1
495567
clientConfig:
@@ -585,7 +657,79 @@ webhooks:
585657
- namespaces
586658
sideEffects: None
587659
{{ end }}
588-
{{ if .podWebhookEnabled }}
660+
{{ if .workloadWebhookEnabled }}
661+
- admissionReviewVersions:
662+
- v1
663+
clientConfig:
664+
service:
665+
name: admission-webhook-service
666+
namespace: sealos-system
667+
path: /validate-apps-v1-deployment
668+
failurePolicy: Ignore
669+
name: vdeployment.sealos.io
670+
namespaceSelector:
671+
matchExpressions:
672+
- key: user.sealos.io/owner
673+
operator: Exists
674+
rules:
675+
- apiGroups:
676+
- apps
677+
apiVersions:
678+
- v1
679+
operations:
680+
- CREATE
681+
- UPDATE
682+
resources:
683+
- deployments
684+
sideEffects: None
685+
- admissionReviewVersions:
686+
- v1
687+
clientConfig:
688+
service:
689+
name: admission-webhook-service
690+
namespace: sealos-system
691+
path: /validate-apps-v1-statefulset
692+
failurePolicy: Ignore
693+
name: vstatefulset.sealos.io
694+
namespaceSelector:
695+
matchExpressions:
696+
- key: user.sealos.io/owner
697+
operator: Exists
698+
rules:
699+
- apiGroups:
700+
- apps
701+
apiVersions:
702+
- v1
703+
operations:
704+
- CREATE
705+
- UPDATE
706+
resources:
707+
- statefulsets
708+
sideEffects: None
709+
- admissionReviewVersions:
710+
- v1
711+
clientConfig:
712+
service:
713+
name: admission-webhook-service
714+
namespace: sealos-system
715+
path: /validate-apps-v1-replicaset
716+
failurePolicy: Ignore
717+
name: vreplicaset.sealos.io
718+
namespaceSelector:
719+
matchExpressions:
720+
- key: user.sealos.io/owner
721+
operator: Exists
722+
rules:
723+
- apiGroups:
724+
- apps
725+
apiVersions:
726+
- v1
727+
operations:
728+
- CREATE
729+
- UPDATE
730+
resources:
731+
- replicasets
732+
sideEffects: None
589733
- admissionReviewVersions:
590734
- v1
591735
clientConfig:

0 commit comments

Comments
 (0)