k8s.io/kubernetes@v1.31.0-alpha.0.0.20240520171757-56147500dadc/plugin/pkg/admission/disableservicelinks/admission.go (about)

     1  /*
     2  Copyright 2024 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package disableservicelinks
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  	"io"
    23  
    24  	"k8s.io/apimachinery/pkg/api/errors"
    25  	"k8s.io/apiserver/pkg/admission"
    26  	"k8s.io/kubernetes/pkg/apis/core"
    27  	"k8s.io/utils/ptr"
    28  )
    29  
    30  // PluginName indicates name of admission plugin.
    31  const PluginName = "DisableServiceLinks"
    32  
    33  // Register is called by the apiserver to register the plugin factory.
    34  func Register(plugins *admission.Plugins) {
    35  	plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
    36  		return newDisableServiceLinks(), nil
    37  	})
    38  }
    39  
    40  // newDisableServiceLinks creates a new instance of the DisableServiceLinks admission controller.
    41  func newDisableServiceLinks() *plugin {
    42  	return &plugin{
    43  		Handler: admission.NewHandler(admission.Create, admission.Update),
    44  	}
    45  }
    46  
    47  // Make sure we are implementing the interface.
    48  var _ admission.MutationInterface = &plugin{}
    49  
    50  type plugin struct {
    51  	*admission.Handler
    52  }
    53  
    54  // Admit updates the EnableServiceLinks of a pod and set it to false.
    55  func (p *plugin) Admit(ctx context.Context, attributes admission.Attributes, o admission.ObjectInterfaces) error {
    56  	op := attributes.GetOperation()
    57  
    58  	// noop admission.Update for future support
    59  	if op == admission.Update {
    60  		return nil
    61  	}
    62  
    63  	// Ignore all calls to subresources or resources other than pods.
    64  	if len(attributes.GetSubresource()) != 0 || attributes.GetResource().GroupResource() != core.Resource("pods") {
    65  		return nil
    66  	}
    67  
    68  	pod, ok := attributes.GetObject().(*core.Pod)
    69  	if !ok {
    70  		return errors.NewBadRequest(fmt.Sprintf("expected *core.Pod but got %T", attributes.GetObject()))
    71  	}
    72  
    73  	pod.Spec.EnableServiceLinks = ptr.To(false)
    74  
    75  	return nil
    76  }