Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add validation to avoid cross ns config and functions (#2627)

Browse Source
This commit is contained in:
neha_gupta
2022-11-17 20:43:07 +05:30
committed by GitHub
parent 4cbe6a7061
commit d559628f29
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apis/core/v1/function_webhook.go
+30
View File
@@ -17,6 +17,8 @@ limitations under the License.
package v1 package v1
import ( import (
"fmt"
"go.uber.org/zap" "go.uber.org/zap"
"k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime"
ctrl "sigs.k8s.io/controller-runtime" ctrl "sigs.k8s.io/controller-runtime"
@@ -50,6 +52,20 @@ var _ webhook.Validator = &Function{}
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
func (r *Function) ValidateCreate() error { func (r *Function) ValidateCreate() error {
functionlog.Debug("validate create", zap.String("name", r.Name)) functionlog.Debug("validate create", zap.String("name", r.Name))
for _, cnfMap := range r.Spec.ConfigMaps {
if cnfMap.Namespace != r.ObjectMeta.Namespace {
err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
return AggregateValidationErrors("Function", err)
}
}
for _, secret := range r.Spec.Secrets {
if secret.Namespace != r.ObjectMeta.Namespace {
err := fmt.Errorf("secret [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
return AggregateValidationErrors("Function", err)
}
}
err := r.Validate() err := r.Validate()
if err != nil { if err != nil {
return AggregateValidationErrors("Function", err) return AggregateValidationErrors("Function", err)
@@ -60,6 +76,20 @@ func (r *Function) ValidateCreate() error {
// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
func (r *Function) ValidateUpdate(old runtime.Object) error { func (r *Function) ValidateUpdate(old runtime.Object) error {
functionlog.Debug("validate update", zap.String("name", r.Name)) functionlog.Debug("validate update", zap.String("name", r.Name))
for _, cnfMap := range r.Spec.ConfigMaps {
if cnfMap.Namespace != r.ObjectMeta.Namespace {
err := fmt.Errorf("ConfigMap's [%s] and function's Namespace [%s] are different. ConfigMap needs to be present in the same namespace as function", cnfMap.Namespace, r.ObjectMeta.Namespace)
return AggregateValidationErrors("Function", err)
}
}
for _, secret := range r.Spec.Secrets {
if secret.Namespace != r.ObjectMeta.Namespace {
err := fmt.Errorf("secret [%s] and function's Namespace [%s] are different. Secret needs to be present in the same namespace as function", secret.Namespace, r.ObjectMeta.Namespace)
return AggregateValidationErrors("Function", err)
}
}
err := r.Validate() err := r.Validate()
if err != nil { if err != nil {
return AggregateValidationErrors("Function", err) return AggregateValidationErrors("Function", err)