Add support for admission review v1beta1

internal/admission/controller/main.go

@@ -18,13 +18,16 @@ package controller
 
 import (
 	"fmt"
+	"net/http"
 
 	admissionv1 "k8s.io/api/admission/v1"
+	admissionv1beta1 "k8s.io/api/admission/v1beta1"
 	networking "k8s.io/api/networking/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
 	"k8s.io/klog/v2"
-
-	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 // Checker must return an error if the ingress provided as argument
@@ -56,62 +59,76 @@ var (
 // HandleAdmission populates the admission Response
 // with Allowed=false if the Object is an ingress that would prevent nginx to reload the configuration
 // with Allowed=true otherwise
-func (ia *IngressAdmission) HandleAdmission(ar *admissionv1.AdmissionReview) {
-	if ar.Request == nil {
-		ar.Response = &admissionv1.AdmissionResponse{
-			Allowed: false,
+func (ia *IngressAdmission) HandleAdmission(obj runtime.Object) (runtime.Object, error) {
+	outputVersion := admissionv1.SchemeGroupVersion
+
+	review, isV1 := obj.(*admissionv1.AdmissionReview)
+
+	status := &admissionv1.AdmissionResponse{}
+	status.UID = review.Request.UID
+
+	if !isV1 {
+		outputVersion = admissionv1beta1.SchemeGroupVersion
+		reviewv1beta1, isv1beta1 := obj.(*admissionv1beta1.AdmissionReview)
+		if !isv1beta1 {
+			return nil, fmt.Errorf("request is not of type apiextensions v1 or v1beta1")
 		}
 
-		return
+		review = &admissionv1.AdmissionReview{}
+		convertV1beta1AdmissionReviewToAdmissionAdmissionReview(reviewv1beta1, review)
 	}
 
-	if ar.Request.Resource != networkingV1Beta1Resource && ar.Request.Resource != networkingV1Resource {
-		err := fmt.Errorf("rejecting admission review because the request does not contains an Ingress resource but %s with name %s in namespace %s",
-			ar.Request.Resource.String(), ar.Request.Name, ar.Request.Namespace)
-		ar.Response = &admissionv1.AdmissionResponse{
-			UID:     ar.Request.UID,
-			Allowed: false,
-			Result:  &metav1.Status{Message: err.Error()},
-		}
-
-		return
+	if review.Request.Resource != networkingV1Beta1Resource && review.Request.Resource != networkingV1Resource {
+		return nil, fmt.Errorf("rejecting admission review because the request does not contains an Ingress resource but %s with name %s in namespace %s",
+			review.Request.Resource.String(), review.Request.Name, review.Request.Namespace)
 	}
 
 	ingress := networking.Ingress{}
-	deserializer := codecs.UniversalDeserializer()
-	if _, _, err := deserializer.Decode(ar.Request.Object.Raw, nil, &ingress); err != nil {
-		klog.ErrorS(err, "failed to decode ingress", "ingress", ar.Request.Name, "namespace", ar.Request.Namespace)
 
-		ar.Response = &admissionv1.AdmissionResponse{
-			UID:     ar.Request.UID,
-			Allowed: false,
-
-			Result: &metav1.Status{Message: err.Error()},
-			AuditAnnotations: map[string]string{
-				parser.GetAnnotationWithPrefix("error"): err.Error(),
-			},
+	codec := json.NewSerializerWithOptions(json.DefaultMetaFactory, scheme, scheme, json.SerializerOptions{
+		Pretty: true,
+	})
+	codec.Decode(review.Request.Object.Raw, nil, nil)
+	_, _, err := codec.Decode(review.Request.Object.Raw, nil, &ingress)
+	if err != nil {
+		klog.ErrorS(err, "failed to decode ingress")
+		status.Allowed = false
+		status.Result = &metav1.Status{
+			Status: metav1.StatusFailure, Code: http.StatusBadRequest, Reason: metav1.StatusReasonBadRequest,
+			Message: err.Error(),
 		}
 
-		return
+		review.Response = status
+		return convertResponse(review, outputVersion), nil
 	}
 
 	if err := ia.Checker.CheckIngress(&ingress); err != nil {
-		klog.ErrorS(err, "failed to generate configuration for ingress", "ingress", ar.Request.Name, "namespace", ar.Request.Namespace)
-		ar.Response = &admissionv1.AdmissionResponse{
-			UID:     ar.Request.UID,
-			Allowed: false,
-			Result:  &metav1.Status{Message: err.Error()},
-			AuditAnnotations: map[string]string{
-				parser.GetAnnotationWithPrefix("error"): err.Error(),
-			},
+		klog.ErrorS(err, "invalid ingress configuration", "ingress", review.Request.Name, "namespace", review.Request.Namespace)
+		status.Allowed = false
+		status.Result = &metav1.Status{
+			Status: metav1.StatusFailure, Code: http.StatusBadRequest, Reason: metav1.StatusReasonBadRequest,
+			Message: err.Error(),
 		}
 
-		return
+		review.Response = status
+		return convertResponse(review, outputVersion), nil
 	}
 
-	klog.InfoS("successfully validated configuration, accepting", "ingress", ar.Request.Name, "namespace", ar.Request.Namespace)
-	ar.Response = &admissionv1.AdmissionResponse{
-		UID:     ar.Request.UID,
-		Allowed: true,
-	}
+	klog.InfoS("successfully validated configuration, accepting", "ingress", review.Request.Name, "namespace", review.Request.Namespace)
+	status.Allowed = true
+	review.Response = status
+
+	return convertResponse(review, outputVersion), nil
+}
+
+func convertResponse(review *admissionv1.AdmissionReview, outputVersion schema.GroupVersion) runtime.Object {
+	// reply v1
+	if outputVersion.Version == admissionv1.SchemeGroupVersion.Version {
+		return review
+	}
+
+	// reply v1beta1
+	reviewv1beta1 := &admissionv1beta1.AdmissionReview{}
+	convertAdmissionAdmissionReviewToV1beta1AdmissionReview(review, reviewv1beta1)
+	return review
 }