k8s.io/apiserver@v0.31.1/pkg/endpoints/handlers/fieldmanager/admission.go (about)

     1  /*
     2  Copyright 2021 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package fieldmanager
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  
    23  	"k8s.io/apimachinery/pkg/api/meta"
    24  	"k8s.io/apimachinery/pkg/util/managedfields"
    25  	"k8s.io/apiserver/pkg/admission"
    26  	"k8s.io/apiserver/pkg/warning"
    27  )
    28  
    29  // InvalidManagedFieldsAfterMutatingAdmissionWarningFormat is the warning that a client receives
    30  // when a create/update/patch request results in invalid managedFields after going through the admission chain.
    31  const InvalidManagedFieldsAfterMutatingAdmissionWarningFormat = ".metadata.managedFields was in an invalid state after admission; this could be caused by an outdated mutating admission controller; please fix your requests: %v"
    32  
    33  // NewManagedFieldsValidatingAdmissionController validates the managedFields after calling
    34  // the provided admission and resets them to their original state if they got changed to an invalid value
    35  func NewManagedFieldsValidatingAdmissionController(wrap admission.Interface) admission.Interface {
    36  	if wrap == nil {
    37  		return nil
    38  	}
    39  	return &managedFieldsValidatingAdmissionController{wrap: wrap}
    40  }
    41  
    42  type managedFieldsValidatingAdmissionController struct {
    43  	wrap admission.Interface
    44  }
    45  
    46  var _ admission.Interface = &managedFieldsValidatingAdmissionController{}
    47  var _ admission.MutationInterface = &managedFieldsValidatingAdmissionController{}
    48  var _ admission.ValidationInterface = &managedFieldsValidatingAdmissionController{}
    49  
    50  // Handles calls the wrapped admission.Interface if applicable
    51  func (admit *managedFieldsValidatingAdmissionController) Handles(operation admission.Operation) bool {
    52  	return admit.wrap.Handles(operation)
    53  }
    54  
    55  // Admit calls the wrapped admission.Interface if applicable and resets the managedFields to their state before admission if they
    56  // got modified in an invalid way
    57  func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
    58  	mutationInterface, isMutationInterface := admit.wrap.(admission.MutationInterface)
    59  	if !isMutationInterface {
    60  		return nil
    61  	}
    62  	objectMeta, err := meta.Accessor(a.GetObject())
    63  	if err != nil {
    64  		// the object we are dealing with doesn't have object metadata defined
    65  		// in that case we don't have to keep track of the managedField
    66  		// just call the wrapped admission
    67  		return mutationInterface.Admit(ctx, a, o)
    68  	}
    69  	managedFieldsBeforeAdmission := objectMeta.GetManagedFields()
    70  	if err := mutationInterface.Admit(ctx, a, o); err != nil {
    71  		return err
    72  	}
    73  	managedFieldsAfterAdmission := objectMeta.GetManagedFields()
    74  	if err := managedfields.ValidateManagedFields(managedFieldsAfterAdmission); err != nil {
    75  		objectMeta.SetManagedFields(managedFieldsBeforeAdmission)
    76  		warning.AddWarning(ctx, "",
    77  			fmt.Sprintf(InvalidManagedFieldsAfterMutatingAdmissionWarningFormat,
    78  				err.Error()),
    79  		)
    80  	}
    81  	return nil
    82  }
    83  
    84  // Validate calls the wrapped admission.Interface if aplicable
    85  func (admit *managedFieldsValidatingAdmissionController) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
    86  	if validationInterface, isValidationInterface := admit.wrap.(admission.ValidationInterface); isValidationInterface {
    87  		return validationInterface.Validate(ctx, a, o)
    88  	}
    89  	return nil
    90  }