k8s.io/apiserver@v0.31.1/pkg/util/webhook/webhook.go (about)

     1  /*
     2  Copyright 2016 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  // Package webhook implements a generic HTTP webhook plugin.
    18  package webhook
    19  
    20  import (
    21  	"context"
    22  	"fmt"
    23  	"time"
    24  
    25  	apierrors "k8s.io/apimachinery/pkg/api/errors"
    26  	"k8s.io/apimachinery/pkg/runtime"
    27  	"k8s.io/apimachinery/pkg/runtime/schema"
    28  	"k8s.io/apimachinery/pkg/runtime/serializer"
    29  	utilnet "k8s.io/apimachinery/pkg/util/net"
    30  	"k8s.io/apimachinery/pkg/util/wait"
    31  	"k8s.io/apiserver/pkg/util/x509metrics"
    32  	"k8s.io/client-go/rest"
    33  	"k8s.io/client-go/tools/clientcmd"
    34  )
    35  
    36  // defaultRequestTimeout is set for all webhook request. This is the absolute
    37  // timeout of the HTTP request, including reading the response body.
    38  const defaultRequestTimeout = 30 * time.Second
    39  
    40  // DefaultRetryBackoffWithInitialDelay returns the default backoff parameters for webhook retry from a given initial delay.
    41  // Handy for the client that provides a custom initial delay only.
    42  func DefaultRetryBackoffWithInitialDelay(initialBackoffDelay time.Duration) wait.Backoff {
    43  	return wait.Backoff{
    44  		Duration: initialBackoffDelay,
    45  		Factor:   1.5,
    46  		Jitter:   0.2,
    47  		Steps:    5,
    48  	}
    49  }
    50  
    51  // GenericWebhook defines a generic client for webhooks with commonly used capabilities,
    52  // such as retry requests.
    53  type GenericWebhook struct {
    54  	RestClient   *rest.RESTClient
    55  	RetryBackoff wait.Backoff
    56  	ShouldRetry  func(error) bool
    57  }
    58  
    59  // DefaultShouldRetry is a default implementation for the GenericWebhook ShouldRetry function property.
    60  // If the error reason is one of: networking (connection reset) or http (InternalServerError (500), GatewayTimeout (504), TooManyRequests (429)),
    61  // or apierrors.SuggestsClientDelay() returns true, then the function advises a retry.
    62  // Otherwise it returns false for an immediate fail.
    63  func DefaultShouldRetry(err error) bool {
    64  	// these errors indicate a transient error that should be retried.
    65  	if utilnet.IsConnectionReset(err) || utilnet.IsHTTP2ConnectionLost(err) || apierrors.IsInternalError(err) || apierrors.IsTimeout(err) || apierrors.IsTooManyRequests(err) {
    66  		return true
    67  	}
    68  	// if the error sends the Retry-After header, we respect it as an explicit confirmation we should retry.
    69  	if _, shouldRetry := apierrors.SuggestsClientDelay(err); shouldRetry {
    70  		return true
    71  	}
    72  	return false
    73  }
    74  
    75  // NewGenericWebhook creates a new GenericWebhook from the provided rest.Config.
    76  func NewGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, config *rest.Config, groupVersions []schema.GroupVersion, retryBackoff wait.Backoff) (*GenericWebhook, error) {
    77  	for _, groupVersion := range groupVersions {
    78  		if !scheme.IsVersionRegistered(groupVersion) {
    79  			return nil, fmt.Errorf("webhook plugin requires enabling extension resource: %s", groupVersion)
    80  		}
    81  	}
    82  
    83  	clientConfig := rest.CopyConfig(config)
    84  
    85  	codec := codecFactory.LegacyCodec(groupVersions...)
    86  	clientConfig.ContentConfig.NegotiatedSerializer = serializer.NegotiatedSerializerWrapper(runtime.SerializerInfo{Serializer: codec})
    87  
    88  	clientConfig.Wrap(x509metrics.NewDeprecatedCertificateRoundTripperWrapperConstructor(
    89  		x509MissingSANCounter,
    90  		x509InsecureSHA1Counter,
    91  	))
    92  
    93  	restClient, err := rest.UnversionedRESTClientFor(clientConfig)
    94  	if err != nil {
    95  		return nil, err
    96  	}
    97  
    98  	return &GenericWebhook{restClient, retryBackoff, DefaultShouldRetry}, nil
    99  }
   100  
   101  // WithExponentialBackoff will retry webhookFn() as specified by the given backoff parameters with exponentially
   102  // increasing backoff when it returns an error for which this GenericWebhook's ShouldRetry function returns true,
   103  // confirming it to be retriable. If no ShouldRetry has been defined for the webhook,
   104  // then the default one is used (DefaultShouldRetry).
   105  func (g *GenericWebhook) WithExponentialBackoff(ctx context.Context, webhookFn func() rest.Result) rest.Result {
   106  	var result rest.Result
   107  	shouldRetry := g.ShouldRetry
   108  	if shouldRetry == nil {
   109  		shouldRetry = DefaultShouldRetry
   110  	}
   111  	WithExponentialBackoff(ctx, g.RetryBackoff, func() error {
   112  		result = webhookFn()
   113  		return result.Error()
   114  	}, shouldRetry)
   115  	return result
   116  }
   117  
   118  // WithExponentialBackoff will retry webhookFn up to 5 times with exponentially increasing backoff when
   119  // it returns an error for which shouldRetry returns true, confirming it to be retriable.
   120  func WithExponentialBackoff(ctx context.Context, retryBackoff wait.Backoff, webhookFn func() error, shouldRetry func(error) bool) error {
   121  	// having a webhook error allows us to track the last actual webhook error for requests that
   122  	// are later cancelled or time out.
   123  	var webhookErr error
   124  	err := wait.ExponentialBackoffWithContext(ctx, retryBackoff, func(_ context.Context) (bool, error) {
   125  		webhookErr = webhookFn()
   126  		if shouldRetry(webhookErr) {
   127  			return false, nil
   128  		}
   129  		if webhookErr != nil {
   130  			return false, webhookErr
   131  		}
   132  		return true, nil
   133  	})
   134  
   135  	switch {
   136  	// we check for webhookErr first, if webhookErr is set it's the most important error to return.
   137  	case webhookErr != nil:
   138  		return webhookErr
   139  	case err != nil:
   140  		return fmt.Errorf("webhook call failed: %s", err.Error())
   141  	default:
   142  		return nil
   143  	}
   144  }
   145  
   146  func LoadKubeconfig(kubeConfigFile string, customDial utilnet.DialFunc) (*rest.Config, error) {
   147  	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
   148  	loadingRules.ExplicitPath = kubeConfigFile
   149  	loader := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{})
   150  
   151  	clientConfig, err := loader.ClientConfig()
   152  	if err != nil {
   153  		return nil, err
   154  	}
   155  
   156  	clientConfig.Dial = customDial
   157  
   158  	// Kubeconfigs can't set a timeout, this can only be set through a command line flag.
   159  	//
   160  	// https://github.com/kubernetes/client-go/blob/master/tools/clientcmd/overrides.go
   161  	//
   162  	// Set this to something reasonable so request to webhooks don't hang forever.
   163  	clientConfig.Timeout = defaultRequestTimeout
   164  
   165  	// Avoid client-side rate limiting talking to the webhook backend.
   166  	// Rate limiting should happen when deciding how many requests to serve.
   167  	clientConfig.QPS = -1
   168  
   169  	return clientConfig, nil
   170  }