k8s.io/apiserver@v0.31.1/pkg/util/webhook/webhook.go (about) 1 /* 2 Copyright 2016 The Kubernetes Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 // Package webhook implements a generic HTTP webhook plugin. 18 package webhook 19 20 import ( 21 "context" 22 "fmt" 23 "time" 24 25 apierrors "k8s.io/apimachinery/pkg/api/errors" 26 "k8s.io/apimachinery/pkg/runtime" 27 "k8s.io/apimachinery/pkg/runtime/schema" 28 "k8s.io/apimachinery/pkg/runtime/serializer" 29 utilnet "k8s.io/apimachinery/pkg/util/net" 30 "k8s.io/apimachinery/pkg/util/wait" 31 "k8s.io/apiserver/pkg/util/x509metrics" 32 "k8s.io/client-go/rest" 33 "k8s.io/client-go/tools/clientcmd" 34 ) 35 36 // defaultRequestTimeout is set for all webhook request. This is the absolute 37 // timeout of the HTTP request, including reading the response body. 38 const defaultRequestTimeout = 30 * time.Second 39 40 // DefaultRetryBackoffWithInitialDelay returns the default backoff parameters for webhook retry from a given initial delay. 41 // Handy for the client that provides a custom initial delay only. 42 func DefaultRetryBackoffWithInitialDelay(initialBackoffDelay time.Duration) wait.Backoff { 43 return wait.Backoff{ 44 Duration: initialBackoffDelay, 45 Factor: 1.5, 46 Jitter: 0.2, 47 Steps: 5, 48 } 49 } 50 51 // GenericWebhook defines a generic client for webhooks with commonly used capabilities, 52 // such as retry requests. 53 type GenericWebhook struct { 54 RestClient *rest.RESTClient 55 RetryBackoff wait.Backoff 56 ShouldRetry func(error) bool 57 } 58 59 // DefaultShouldRetry is a default implementation for the GenericWebhook ShouldRetry function property. 60 // If the error reason is one of: networking (connection reset) or http (InternalServerError (500), GatewayTimeout (504), TooManyRequests (429)), 61 // or apierrors.SuggestsClientDelay() returns true, then the function advises a retry. 62 // Otherwise it returns false for an immediate fail. 63 func DefaultShouldRetry(err error) bool { 64 // these errors indicate a transient error that should be retried. 65 if utilnet.IsConnectionReset(err) || utilnet.IsHTTP2ConnectionLost(err) || apierrors.IsInternalError(err) || apierrors.IsTimeout(err) || apierrors.IsTooManyRequests(err) { 66 return true 67 } 68 // if the error sends the Retry-After header, we respect it as an explicit confirmation we should retry. 69 if _, shouldRetry := apierrors.SuggestsClientDelay(err); shouldRetry { 70 return true 71 } 72 return false 73 } 74 75 // NewGenericWebhook creates a new GenericWebhook from the provided rest.Config. 76 func NewGenericWebhook(scheme *runtime.Scheme, codecFactory serializer.CodecFactory, config *rest.Config, groupVersions []schema.GroupVersion, retryBackoff wait.Backoff) (*GenericWebhook, error) { 77 for _, groupVersion := range groupVersions { 78 if !scheme.IsVersionRegistered(groupVersion) { 79 return nil, fmt.Errorf("webhook plugin requires enabling extension resource: %s", groupVersion) 80 } 81 } 82 83 clientConfig := rest.CopyConfig(config) 84 85 codec := codecFactory.LegacyCodec(groupVersions...) 86 clientConfig.ContentConfig.NegotiatedSerializer = serializer.NegotiatedSerializerWrapper(runtime.SerializerInfo{Serializer: codec}) 87 88 clientConfig.Wrap(x509metrics.NewDeprecatedCertificateRoundTripperWrapperConstructor( 89 x509MissingSANCounter, 90 x509InsecureSHA1Counter, 91 )) 92 93 restClient, err := rest.UnversionedRESTClientFor(clientConfig) 94 if err != nil { 95 return nil, err 96 } 97 98 return &GenericWebhook{restClient, retryBackoff, DefaultShouldRetry}, nil 99 } 100 101 // WithExponentialBackoff will retry webhookFn() as specified by the given backoff parameters with exponentially 102 // increasing backoff when it returns an error for which this GenericWebhook's ShouldRetry function returns true, 103 // confirming it to be retriable. If no ShouldRetry has been defined for the webhook, 104 // then the default one is used (DefaultShouldRetry). 105 func (g *GenericWebhook) WithExponentialBackoff(ctx context.Context, webhookFn func() rest.Result) rest.Result { 106 var result rest.Result 107 shouldRetry := g.ShouldRetry 108 if shouldRetry == nil { 109 shouldRetry = DefaultShouldRetry 110 } 111 WithExponentialBackoff(ctx, g.RetryBackoff, func() error { 112 result = webhookFn() 113 return result.Error() 114 }, shouldRetry) 115 return result 116 } 117 118 // WithExponentialBackoff will retry webhookFn up to 5 times with exponentially increasing backoff when 119 // it returns an error for which shouldRetry returns true, confirming it to be retriable. 120 func WithExponentialBackoff(ctx context.Context, retryBackoff wait.Backoff, webhookFn func() error, shouldRetry func(error) bool) error { 121 // having a webhook error allows us to track the last actual webhook error for requests that 122 // are later cancelled or time out. 123 var webhookErr error 124 err := wait.ExponentialBackoffWithContext(ctx, retryBackoff, func(_ context.Context) (bool, error) { 125 webhookErr = webhookFn() 126 if shouldRetry(webhookErr) { 127 return false, nil 128 } 129 if webhookErr != nil { 130 return false, webhookErr 131 } 132 return true, nil 133 }) 134 135 switch { 136 // we check for webhookErr first, if webhookErr is set it's the most important error to return. 137 case webhookErr != nil: 138 return webhookErr 139 case err != nil: 140 return fmt.Errorf("webhook call failed: %s", err.Error()) 141 default: 142 return nil 143 } 144 } 145 146 func LoadKubeconfig(kubeConfigFile string, customDial utilnet.DialFunc) (*rest.Config, error) { 147 loadingRules := clientcmd.NewDefaultClientConfigLoadingRules() 148 loadingRules.ExplicitPath = kubeConfigFile 149 loader := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, &clientcmd.ConfigOverrides{}) 150 151 clientConfig, err := loader.ClientConfig() 152 if err != nil { 153 return nil, err 154 } 155 156 clientConfig.Dial = customDial 157 158 // Kubeconfigs can't set a timeout, this can only be set through a command line flag. 159 // 160 // https://github.com/kubernetes/client-go/blob/master/tools/clientcmd/overrides.go 161 // 162 // Set this to something reasonable so request to webhooks don't hang forever. 163 clientConfig.Timeout = defaultRequestTimeout 164 165 // Avoid client-side rate limiting talking to the webhook backend. 166 // Rate limiting should happen when deciding how many requests to serve. 167 clientConfig.QPS = -1 168 169 return clientConfig, nil 170 }