Implement a validation webhook
In case some ingress have a syntax error in the snippet configuration, the freshly generated configuration will not be reloaded to prevent tearing down existing rules. Although, once inserted, this configuration is preventing from any other valid configuration to be inserted as it remains in the ingresses of the cluster. To solve this problem, implement an optional validation webhook that simulates the addition of the ingress to be added together with the rest of ingresses. In case the generated configuration is not validated by nginx, deny the insertion of the ingress. In case certificates are mounted using kubernetes secrets, when those changes, keys are automatically updated in the container volume, and the controller reloads it using the filewatcher. Related changes: - Update vendors - Extract useful functions to check configuration with an additional ingress - Update documentation for validating webhook - Add validating webhook examples - Add a metric for each syntax check success and errors - Add more certificate generation examples
This commit is contained in:
Thibault Jamet
parent
7283a01b9f
commit
1cd17cd12c
30 changed files with 3314 additions and 131 deletions
93
internal/admission/controller/main.go
Normal file
93
internal/admission/controller/main.go
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"github.com/google/uuid"
|
||||
"k8s.io/api/admission/v1beta1"
|
||||
extensions "k8s.io/api/extensions/v1beta1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
|
||||
"k8s.io/klog"
|
||||
)
|
||||
|
||||
// Checker must return an error if the ingress provided as argument
|
||||
// contains invalid instructions
|
||||
type Checker interface {
|
||||
CheckIngress(ing *extensions.Ingress) error
|
||||
}
|
||||
|
||||
// IngressAdmission implements the AdmissionController interface
|
||||
// to handle Admission Reviews and deny requests that are not validated
|
||||
type IngressAdmission struct {
|
||||
Checker Checker
|
||||
}
|
||||
|
||||
// HandleAdmission populates the admission Response
|
||||
// with Allowed=false if the Object is an ingress that would prevent nginx to reload the configuration
|
||||
// with Allowed=true otherwise
|
||||
func (ia *IngressAdmission) HandleAdmission(ar *v1beta1.AdmissionReview) error {
|
||||
if ar.Request == nil {
|
||||
klog.Infof("rejecting nil request")
|
||||
ar.Response = &v1beta1.AdmissionResponse{
|
||||
UID: types.UID(uuid.New().String()),
|
||||
Allowed: false,
|
||||
}
|
||||
return nil
|
||||
}
|
||||
klog.V(3).Infof("handling ingress admission webhook request for {%s} %s in namespace %s", ar.Request.Resource.String(), ar.Request.Name, ar.Request.Namespace)
|
||||
|
||||
ingressResource := v1.GroupVersionResource{Group: extensions.SchemeGroupVersion.Group, Version: extensions.SchemeGroupVersion.Version, Resource: "ingresses"}
|
||||
|
||||
if ar.Request.Resource == ingressResource {
|
||||
ar.Response = &v1beta1.AdmissionResponse{
|
||||
UID: types.UID(uuid.New().String()),
|
||||
Allowed: false,
|
||||
}
|
||||
ingress := extensions.Ingress{}
|
||||
deserializer := codecs.UniversalDeserializer()
|
||||
if _, _, err := deserializer.Decode(ar.Request.Object.Raw, nil, &ingress); err != nil {
|
||||
ar.Response.Result = &v1.Status{Message: err.Error()}
|
||||
ar.Response.AuditAnnotations = map[string]string{
|
||||
parser.GetAnnotationWithPrefix("error"): err.Error(),
|
||||
}
|
||||
klog.Errorf("failed to decode ingress %s in namespace %s: %s, refusing it", ar.Request.Name, ar.Request.Namespace, err.Error())
|
||||
return err
|
||||
}
|
||||
|
||||
err := ia.Checker.CheckIngress(&ingress)
|
||||
if err != nil {
|
||||
ar.Response.Result = &v1.Status{Message: err.Error()}
|
||||
ar.Response.AuditAnnotations = map[string]string{
|
||||
parser.GetAnnotationWithPrefix("error"): err.Error(),
|
||||
}
|
||||
klog.Errorf("failed to generate configuration for ingress %s in namespace %s: %s, refusing it", ar.Request.Name, ar.Request.Namespace, err.Error())
|
||||
return err
|
||||
}
|
||||
ar.Response.Allowed = true
|
||||
klog.Infof("successfully validated configuration, accepting ingress %s in namespace %s", ar.Request.Name, ar.Request.Namespace)
|
||||
return nil
|
||||
}
|
||||
|
||||
klog.Infof("accepting non ingress %s in namespace %s %s", ar.Request.Name, ar.Request.Namespace, ar.Request.Resource.String())
|
||||
ar.Response = &v1beta1.AdmissionResponse{
|
||||
UID: types.UID(uuid.New().String()),
|
||||
Allowed: true,
|
||||
}
|
||||
return nil
|
||||
}
|
||||
109
internal/admission/controller/main_test.go
Normal file
109
internal/admission/controller/main_test.go
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"k8s.io/api/admission/v1beta1"
|
||||
extensions "k8s.io/api/extensions/v1beta1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/util/json"
|
||||
)
|
||||
|
||||
const testIngressName = "testIngressName"
|
||||
|
||||
type failTestChecker struct {
|
||||
t *testing.T
|
||||
}
|
||||
|
||||
func (ftc failTestChecker) CheckIngress(ing *extensions.Ingress) error {
|
||||
ftc.t.Error("checker should not be called")
|
||||
return nil
|
||||
}
|
||||
|
||||
type testChecker struct {
|
||||
t *testing.T
|
||||
err error
|
||||
}
|
||||
|
||||
func (tc testChecker) CheckIngress(ing *extensions.Ingress) error {
|
||||
if ing.ObjectMeta.Name != testIngressName {
|
||||
tc.t.Errorf("CheckIngress should be called with %v ingress, but got %v", testIngressName, ing.ObjectMeta.Name)
|
||||
}
|
||||
return tc.err
|
||||
}
|
||||
|
||||
func TestHandleAdmission(t *testing.T) {
|
||||
adm := &IngressAdmission{
|
||||
Checker: failTestChecker{t: t},
|
||||
}
|
||||
review := &v1beta1.AdmissionReview{
|
||||
Request: &v1beta1.AdmissionRequest{
|
||||
Resource: v1.GroupVersionResource{Group: "", Version: "v1", Resource: "pod"},
|
||||
},
|
||||
}
|
||||
err := adm.HandleAdmission(review)
|
||||
if !review.Response.Allowed {
|
||||
t.Errorf("with a non ingress resource, the check should pass")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("with a non ingress resource, no error should be returned")
|
||||
}
|
||||
|
||||
review.Request.Resource = v1.GroupVersionResource{Group: extensions.SchemeGroupVersion.Group, Version: extensions.SchemeGroupVersion.Version, Resource: "ingresses"}
|
||||
review.Request.Object.Raw = []byte{0xff}
|
||||
|
||||
err = adm.HandleAdmission(review)
|
||||
if review.Response.Allowed {
|
||||
t.Errorf("when the request object is not decodable, the request should not be allowed")
|
||||
}
|
||||
if err == nil {
|
||||
t.Errorf("when the request object is not decodable, an error should be returned")
|
||||
}
|
||||
|
||||
raw, err := json.Marshal(extensions.Ingress{ObjectMeta: v1.ObjectMeta{Name: testIngressName}})
|
||||
if err != nil {
|
||||
t.Errorf("failed to prepare test ingress data: %v", err.Error())
|
||||
}
|
||||
review.Request.Object.Raw = raw
|
||||
|
||||
adm.Checker = testChecker{
|
||||
t: t,
|
||||
err: fmt.Errorf("this is a test error"),
|
||||
}
|
||||
err = adm.HandleAdmission(review)
|
||||
if review.Response.Allowed {
|
||||
t.Errorf("when the checker returns an error, the request should not be allowed")
|
||||
}
|
||||
if err == nil {
|
||||
t.Errorf("when the checker returns an error, an error should be returned")
|
||||
}
|
||||
|
||||
adm.Checker = testChecker{
|
||||
t: t,
|
||||
err: nil,
|
||||
}
|
||||
err = adm.HandleAdmission(review)
|
||||
if !review.Response.Allowed {
|
||||
t.Errorf("when the checker returns no error, the request should be allowed")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("when the checker returns no error, no error should be returned")
|
||||
}
|
||||
}
|
||||
89
internal/admission/controller/server.go
Normal file
89
internal/admission/controller/server.go
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
|
||||
"k8s.io/api/admission/v1beta1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/serializer"
|
||||
"k8s.io/apimachinery/pkg/util/json"
|
||||
"k8s.io/klog"
|
||||
)
|
||||
|
||||
var (
|
||||
scheme = runtime.NewScheme()
|
||||
codecs = serializer.NewCodecFactory(scheme)
|
||||
)
|
||||
|
||||
// AdmissionController checks if an object
|
||||
// is allowed in the cluster
|
||||
type AdmissionController interface {
|
||||
HandleAdmission(*v1beta1.AdmissionReview) error
|
||||
}
|
||||
|
||||
// AdmissionControllerServer implements an HTTP server
|
||||
// for kubernetes validating webhook
|
||||
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook
|
||||
type AdmissionControllerServer struct {
|
||||
AdmissionController AdmissionController
|
||||
Decoder runtime.Decoder
|
||||
}
|
||||
|
||||
// NewAdmissionControllerServer instanciates an admission controller server with
|
||||
// a default codec
|
||||
func NewAdmissionControllerServer(ac AdmissionController) *AdmissionControllerServer {
|
||||
return &AdmissionControllerServer{
|
||||
AdmissionController: ac,
|
||||
Decoder: codecs.UniversalDeserializer(),
|
||||
}
|
||||
}
|
||||
|
||||
// ServeHTTP implements http.Server method
|
||||
func (acs *AdmissionControllerServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
klog.Infof("handling admission controller request %s", r.URL.String())
|
||||
|
||||
review, err := parseAdmissionReview(acs.Decoder, r.Body)
|
||||
if err != nil {
|
||||
klog.Error("Can't decode request", err)
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
acs.AdmissionController.HandleAdmission(review)
|
||||
if err := writeAdmissionReview(w, review); err != nil {
|
||||
klog.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func parseAdmissionReview(decoder runtime.Decoder, r io.Reader) (*v1beta1.AdmissionReview, error) {
|
||||
review := &v1beta1.AdmissionReview{}
|
||||
data, err := ioutil.ReadAll(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
_, _, err = decoder.Decode(data, nil, review)
|
||||
return review, err
|
||||
}
|
||||
|
||||
func writeAdmissionReview(w io.Writer, ar *v1beta1.AdmissionReview) error {
|
||||
e := json.NewEncoder(w)
|
||||
return e.Encode(ar)
|
||||
}
|
||||
97
internal/admission/controller/server_test.go
Normal file
97
internal/admission/controller/server_test.go
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"k8s.io/api/admission/v1beta1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
type testAdmissionHandler struct{}
|
||||
|
||||
func (testAdmissionHandler) HandleAdmission(ar *v1beta1.AdmissionReview) error {
|
||||
ar.Response = &v1beta1.AdmissionResponse{
|
||||
UID: types.UID(uuid.New().String()),
|
||||
Allowed: true,
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type errorReader struct{}
|
||||
|
||||
func (errorReader) Read(p []byte) (n int, err error) {
|
||||
return 0, fmt.Errorf("this is a test error")
|
||||
}
|
||||
|
||||
type errorWriter struct{}
|
||||
|
||||
func (errorWriter) Write(p []byte) (n int, err error) {
|
||||
return 0, fmt.Errorf("this is a test error")
|
||||
}
|
||||
|
||||
func (errorWriter) Header() http.Header {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (errorWriter) WriteHeader(statusCode int) {}
|
||||
|
||||
func TestServer(t *testing.T) {
|
||||
w := httptest.NewRecorder()
|
||||
b := bytes.NewBuffer(nil)
|
||||
writeAdmissionReview(b, &v1beta1.AdmissionReview{})
|
||||
|
||||
// Happy path
|
||||
r := httptest.NewRequest("GET", "http://test.ns.svc", b)
|
||||
NewAdmissionControllerServer(testAdmissionHandler{}).ServeHTTP(w, r)
|
||||
ar, err := parseAdmissionReview(codecs.UniversalDeserializer(), w.Body)
|
||||
if w.Code != http.StatusOK {
|
||||
t.Errorf("when the admission review allows the request, the http status should be OK")
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("failed to parse admission response when the admission controller returns a value")
|
||||
}
|
||||
if !ar.Response.Allowed {
|
||||
t.Errorf("when the admission review allows the request, the parsed body returns not allowed")
|
||||
}
|
||||
|
||||
// Ensure the code does not panic when failing to handle the request
|
||||
NewAdmissionControllerServer(testAdmissionHandler{}).ServeHTTP(errorWriter{}, r)
|
||||
|
||||
w = httptest.NewRecorder()
|
||||
NewAdmissionControllerServer(testAdmissionHandler{}).ServeHTTP(w, httptest.NewRequest("GET", "http://test.ns.svc", strings.NewReader("invalid-json")))
|
||||
if w.Code != http.StatusBadRequest {
|
||||
t.Errorf("when the server fails to read the request, the replied status should be bad request")
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseAdmissionReview(t *testing.T) {
|
||||
ar, err := parseAdmissionReview(codecs.UniversalDeserializer(), errorReader{})
|
||||
if ar != nil {
|
||||
t.Errorf("when reading from request fails, no AdmissionRewiew should be returned")
|
||||
}
|
||||
if err == nil {
|
||||
t.Errorf("when reading from request fails, an error should be returned")
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue