From d559628f295d09279883f6ea7e522aa38add02d4 Mon Sep 17 00:00:00 2001 From: neha_gupta Date: Thu, 17 Nov 2022 20:43:07 +0530 Subject: [PATCH] add validation to avoid cross ns config and functions (#2627) --- pkg/apis/core/v1/function_webhook.go | 30 ++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/pkg/apis/core/v1/function_webhook.go b/pkg/apis/core/v1/function_webhook.go index 13266840..b86c0d1f 100644 --- a/pkg/apis/core/v1/function_webhook.go +++ b/pkg/apis/core/v1/function_webhook.go @@ -17,6 +17,8 @@ limitations under the License. package v1 import ( + "fmt" + "go.uber.org/zap" "k8s.io/apimachinery/pkg/runtime" ctrl "sigs.k8s.io/controller-runtime" @@ -50,6 +52,20 @@ var _ webhook.Validator = &Function{} // ValidateCreate implements webhook.Validator so a webhook will be registered for the type func (r *Function) ValidateCreate() error { functionlog.Debug("validate create", zap.String("name", r.Name)) + + for _, cnfMap := range r.Spec.ConfigMaps { + if cnfMap.Namespace != r.ObjectMeta.Namespace { + err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace) + return AggregateValidationErrors("Function", err) + } + } + for _, secret := range r.Spec.Secrets { + if secret.Namespace != r.ObjectMeta.Namespace { + err := fmt.Errorf("secret [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace) + return AggregateValidationErrors("Function", err) + } + } + err := r.Validate() if err != nil { return AggregateValidationErrors("Function", err) @@ -60,6 +76,20 @@ func (r *Function) ValidateCreate() error { // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type func (r *Function) ValidateUpdate(old runtime.Object) error { functionlog.Debug("validate update", zap.String("name", r.Name)) + + for _, cnfMap := range r.Spec.ConfigMaps { + if cnfMap.Namespace != r.ObjectMeta.Namespace { + err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace) + return AggregateValidationErrors("Function", err) + } + } + for _, secret := range r.Spec.Secrets { + if secret.Namespace != r.ObjectMeta.Namespace { + err := fmt.Errorf("secret [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace) + return AggregateValidationErrors("Function", err) + } + } + err := r.Validate() if err != nil { return AggregateValidationErrors("Function", err)