Skip to content

Commit 6c0dde2

Browse files
britaniarbritaniar
authored
feat: add validator functions for eviction to use in webhook (#61)
1 parent 3221bd1 commit 6c0dde2

File tree

4 files changed

+367
-0
lines changed

4 files changed

+367
-0
lines changed

‎pkg/utils/common.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,12 @@ var (
171171
Kind: placementv1beta1.ClusterResourcePlacementKind,
172172
}
173173

174+
ClusterResourcePlacementEvictionMetaGVK = metav1.GroupVersionKind{
175+
Group: placementv1beta1.GroupVersion.Group,
176+
Version: placementv1beta1.GroupVersion.Version,
177+
Kind: placementv1beta1.ClusterResourcePlacementEvictionKind,
178+
}
179+
174180
ConfigMapGVK = schema.GroupVersionKind{
175181
Group: corev1.GroupName,
176182
Version: corev1.SchemeGroupVersion.Version,

‎pkg/utils/validator/clusterresourceplacementeviction.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/*
2+
Copyright 2025 The KubeFleet Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package validator provides utils to validate ClusterResourcePlacementEviction resources.
18+
package validator
19+
20+
import (
21+
"fmt"
22+
23+
"k8s.io/apimachinery/pkg/util/errors"
24+
25+
fleetv1beta1 "github.com/kubefleet-dev/kubefleet/apis/placement/v1beta1"
26+
)
27+
28+
// ValidateClusterResourcePlacementForEviction validates cluster resource placement fields for eviction and returns error.
29+
func ValidateClusterResourcePlacementForEviction(crp fleetv1beta1.ClusterResourcePlacement) error {
30+
allErr := make([]error, 0)
31+
32+
// Check Cluster Resource Placement is not deleting
33+
if crp.DeletionTimestamp != nil {
34+
allErr = append(allErr, fmt.Errorf("cluster resource placement %s is being deleted", crp.Name))
35+
return errors.NewAggregate(allErr)
36+
}
37+
// Check Cluster Resource Placement Policy
38+
if crp.Spec.Policy != nil {
39+
if crp.Spec.Policy.PlacementType == fleetv1beta1.PickFixedPlacementType {
40+
allErr = append(allErr, fmt.Errorf("cluster resource placement policy type %s is not supported", crp.Spec.Policy.PlacementType))
41+
}
42+
}
43+
44+
return errors.NewAggregate(allErr)
45+
}

‎pkg/webhook/clusterresourceplacementeviction/clusterresourceplacementeviction_validating_webhook.go‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/*
2+
Copyright 2025 The KubeFleet Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package clusterresourceplacementeviction provides a validating webhook for the clusterresourceplacementeviction custom resource in the KubeFleet API group.
18+
package clusterresourceplacementeviction
19+
20+
import (
21+
"context"
22+
"fmt"
23+
"net/http"
24+
25+
k8serrors "k8s.io/apimachinery/pkg/api/errors"
26+
"k8s.io/apimachinery/pkg/types"
27+
"k8s.io/klog/v2"
28+
"sigs.k8s.io/controller-runtime/pkg/client"
29+
"sigs.k8s.io/controller-runtime/pkg/manager"
30+
"sigs.k8s.io/controller-runtime/pkg/webhook"
31+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
32+
33+
fleetv1beta1 "github.com/kubefleet-dev/kubefleet/apis/placement/v1beta1"
34+
"github.com/kubefleet-dev/kubefleet/pkg/utils"
35+
"github.com/kubefleet-dev/kubefleet/pkg/utils/condition"
36+
"github.com/kubefleet-dev/kubefleet/pkg/utils/validator"
37+
)
38+
39+
var (
40+
// ValidationPath is the webhook service path which admission requests are routed to for validating clusterresourceplacementeviction resources.
41+
ValidationPath = fmt.Sprintf(utils.ValidationPathFmt, fleetv1beta1.GroupVersion.Group, fleetv1beta1.GroupVersion.Version, "clusterresourceplacementeviction")
42+
)
43+
44+
type clusterResourcePlacementEvictionValidator struct {
45+
client client.Client
46+
decoder webhook.AdmissionDecoder
47+
}
48+
49+
// Add registers the webhook for K8s bulit-in object types.
50+
func Add(mgr manager.Manager) error {
51+
hookServer := mgr.GetWebhookServer()
52+
hookServer.Register(ValidationPath, &webhook.Admission{Handler: &clusterResourcePlacementEvictionValidator{mgr.GetClient(), admission.NewDecoder(mgr.GetScheme())}})
53+
return nil
54+
}
55+
56+
// Handle clusterResourcePlacementEvictionValidator checks to see if resource override is valid.
57+
func (v *clusterResourcePlacementEvictionValidator) Handle(ctx context.Context, req admission.Request) admission.Response {
58+
var crpe fleetv1beta1.ClusterResourcePlacementEviction
59+
klog.V(2).InfoS("Validating webhook handling cluster resource placement eviction", "operation", req.Operation, "clusterResourcePlacementEviction", req.Name)
60+
if err := v.decoder.Decode(req, &crpe); err != nil {
61+
klog.ErrorS(err, "Failed to decode cluster resource placement eviction object for validating fields", "userName", req.UserInfo.Username, "groups", req.UserInfo.Groups, "clusterResourcePlacementEviction", req.Name)
62+
return admission.Errored(http.StatusBadRequest, err)
63+
}
64+
65+
// Get the ClusterResourcePlacement object
66+
var crp fleetv1beta1.ClusterResourcePlacement
67+
if err := v.client.Get(ctx, types.NamespacedName{Name: crpe.Spec.PlacementName}, &crp); err != nil {
68+
if k8serrors.IsNotFound(err) {
69+
klog.V(2).InfoS(condition.EvictionInvalidMissingCRPMessage, "clusterResourcePlacementEviction", crpe.Name, "clusterResourcePlacement", crpe.Spec.PlacementName)
70+
return admission.Denied(err.Error())
71+
}
72+
return admission.Errored(http.StatusBadRequest, fmt.Errorf("failed to get clusterResourcePlacement %s for clusterResourcePlacementEviction %s: %w", crpe.Spec.PlacementName, crpe.Name, err))
73+
}
74+
75+
if err := validator.ValidateClusterResourcePlacementForEviction(crp); err != nil {
76+
klog.V(2).ErrorS(err, "ClusterResourcePlacement has invalid fields, request is denied", "operation", req.Operation, "clusterResourcePlacementEviction", crpe.Name)
77+
return admission.Denied(err.Error())
78+
}
79+
80+
klog.V(2).InfoS("ClusterResourcePlacementEviction has valid fields", "clusterResourcePlacementEviction", crpe.Name)
81+
return admission.Allowed("clusterResourcePlacementEviction has valid fields")
82+
}

‎pkg/webhook/clusterresourceplacementeviction/clusterresourceplacementeviction_validating_webhook_test.go‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
/*
2+
Copyright 2025 The KubeFleet Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package clusterresourceplacementeviction
18+
19+
import (
20+
"context"
21+
"encoding/json"
22+
"testing"
23+
"time"
24+
25+
"github.com/google/go-cmp/cmp"
26+
"github.com/stretchr/testify/assert"
27+
admissionv1 "k8s.io/api/admission/v1"
28+
authenticationv1 "k8s.io/api/authentication/v1"
29+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
30+
"k8s.io/apimachinery/pkg/runtime"
31+
"sigs.k8s.io/controller-runtime/pkg/client"
32+
"sigs.k8s.io/controller-runtime/pkg/client/fake"
33+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
34+
35+
placementv1beta1 "github.com/kubefleet-dev/kubefleet/apis/placement/v1beta1"
36+
"github.com/kubefleet-dev/kubefleet/pkg/utils"
37+
)
38+
39+
func TestHandle(t *testing.T) {
40+
validCRPEObject := &placementv1beta1.ClusterResourcePlacementEviction{
41+
ObjectMeta: metav1.ObjectMeta{
42+
Name: "test-crpe",
43+
},
44+
Spec: placementv1beta1.PlacementEvictionSpec{
45+
PlacementName: "test-crp",
46+
},
47+
}
48+
invalidCRPEObjectInvalidPlacementName := &placementv1beta1.ClusterResourcePlacementEviction{
49+
ObjectMeta: metav1.ObjectMeta{
50+
Name: "test-crpe",
51+
},
52+
Spec: placementv1beta1.PlacementEvictionSpec{
53+
PlacementName: "does-not-exist",
54+
},
55+
}
56+
invalidCRPEObjectCRPDeleting := &placementv1beta1.ClusterResourcePlacementEviction{
57+
ObjectMeta: metav1.ObjectMeta{
58+
Name: "test-crpe",
59+
},
60+
Spec: placementv1beta1.PlacementEvictionSpec{
61+
PlacementName: "crp-deleting",
62+
},
63+
}
64+
invalidCRPEObjectInvalidPlacementType := &placementv1beta1.ClusterResourcePlacementEviction{
65+
ObjectMeta: metav1.ObjectMeta{
66+
Name: "test-crpe",
67+
},
68+
Spec: placementv1beta1.PlacementEvictionSpec{
69+
PlacementName: "crp-pickfixed",
70+
},
71+
}
72+
73+
validCRPEObjectBytes, err := json.Marshal(validCRPEObject)
74+
assert.Nil(t, err)
75+
invalidCRPEObjectInvalidPlacementNameBytes, err := json.Marshal(invalidCRPEObjectInvalidPlacementName)
76+
assert.Nil(t, err)
77+
invalidCRPEObjectCRPDeletingBytes, err := json.Marshal(invalidCRPEObjectCRPDeleting)
78+
assert.Nil(t, err)
79+
invalidCRPEObjectInvalidPlacementTypeBytes, err := json.Marshal(invalidCRPEObjectInvalidPlacementType)
80+
assert.Nil(t, err)
81+
82+
validCRP := &placementv1beta1.ClusterResourcePlacement{
83+
ObjectMeta: metav1.ObjectMeta{
84+
Name: "test-crp",
85+
},
86+
Spec: placementv1beta1.ClusterResourcePlacementSpec{
87+
ResourceSelectors: []placementv1beta1.ClusterResourceSelector{},
88+
Policy: &placementv1beta1.PlacementPolicy{
89+
PlacementType: placementv1beta1.PickAllPlacementType,
90+
},
91+
},
92+
}
93+
invalidCRPDeleting := &placementv1beta1.ClusterResourcePlacement{
94+
ObjectMeta: metav1.ObjectMeta{
95+
Name: "crp-deleting",
96+
DeletionTimestamp: &metav1.Time{
97+
Time: time.Now().Add(10 * time.Minute),
98+
},
99+
Finalizers: []string{placementv1beta1.ClusterResourcePlacementCleanupFinalizer},
100+
},
101+
Spec: placementv1beta1.ClusterResourcePlacementSpec{
102+
ResourceSelectors: []placementv1beta1.ClusterResourceSelector{},
103+
Policy: &placementv1beta1.PlacementPolicy{
104+
PlacementType: placementv1beta1.PickAllPlacementType,
105+
},
106+
},
107+
}
108+
invalidCRPPickFixed := &placementv1beta1.ClusterResourcePlacement{
109+
ObjectMeta: metav1.ObjectMeta{
110+
Name: "crp-pickfixed",
111+
},
112+
Spec: placementv1beta1.ClusterResourcePlacementSpec{
113+
ResourceSelectors: []placementv1beta1.ClusterResourceSelector{},
114+
Policy: &placementv1beta1.PlacementPolicy{
115+
PlacementType: placementv1beta1.PickFixedPlacementType,
116+
ClusterNames: []string{"cluster1", "cluster2"},
117+
},
118+
},
119+
}
120+
121+
objects := []client.Object{validCRP, invalidCRPDeleting, invalidCRPPickFixed}
122+
scheme := runtime.NewScheme()
123+
err = placementv1beta1.AddToScheme(scheme)
124+
assert.Nil(t, err)
125+
decoder := admission.NewDecoder(scheme)
126+
assert.Nil(t, err)
127+
fakeClient := fake.NewClientBuilder().
128+
WithScheme(scheme).
129+
WithObjects(objects...).
130+
Build()
131+
132+
testCases := map[string]struct {
133+
req admission.Request
134+
resourceValidator clusterResourcePlacementEvictionValidator
135+
wantResponse admission.Response
136+
}{
137+
"allow CRPE create": {
138+
req: admission.Request{
139+
AdmissionRequest: admissionv1.AdmissionRequest{
140+
Name: "test-crpe",
141+
Object: runtime.RawExtension{
142+
Raw: validCRPEObjectBytes,
143+
Object: validCRPEObject,
144+
},
145+
UserInfo: authenticationv1.UserInfo{
146+
Username: "test-user",
147+
Groups: []string{"system:masters"},
148+
},
149+
RequestKind: &utils.ClusterResourcePlacementEvictionMetaGVK,
150+
Operation: admissionv1.Create,
151+
},
152+
},
153+
resourceValidator: clusterResourcePlacementEvictionValidator{
154+
decoder: decoder,
155+
client: fakeClient,
156+
},
157+
wantResponse: admission.Allowed("clusterResourcePlacementEviction has valid fields"),
158+
},
159+
"deny CRPE create - invalid CRPE object": {
160+
req: admission.Request{
161+
AdmissionRequest: admissionv1.AdmissionRequest{
162+
Name: "test-crpe",
163+
Object: runtime.RawExtension{
164+
Raw: invalidCRPEObjectInvalidPlacementNameBytes,
165+
Object: invalidCRPEObjectInvalidPlacementName,
166+
},
167+
UserInfo: authenticationv1.UserInfo{
168+
Username: "test-user",
169+
Groups: []string{"system:masters"},
170+
},
171+
RequestKind: &utils.ClusterResourcePlacementMetaGVK,
172+
Operation: admissionv1.Create,
173+
},
174+
},
175+
resourceValidator: clusterResourcePlacementEvictionValidator{
176+
decoder: decoder,
177+
client: fakeClient,
178+
},
179+
wantResponse: admission.Denied("clusterresourceplacements.placement.kubernetes-fleet.io \"does-not-exist\" not found"),
180+
},
181+
"deny CRPE create - CRP is deleting": {
182+
req: admission.Request{
183+
AdmissionRequest: admissionv1.AdmissionRequest{
184+
Name: "test-crpe",
185+
Object: runtime.RawExtension{
186+
Raw: invalidCRPEObjectCRPDeletingBytes,
187+
Object: invalidCRPEObjectCRPDeleting,
188+
},
189+
UserInfo: authenticationv1.UserInfo{
190+
Username: "test-user",
191+
Groups: []string{"system:masters"},
192+
},
193+
RequestKind: &utils.ClusterResourcePlacementEvictionMetaGVK,
194+
Operation: admissionv1.Create,
195+
},
196+
},
197+
resourceValidator: clusterResourcePlacementEvictionValidator{
198+
decoder: decoder,
199+
client: fakeClient,
200+
},
201+
wantResponse: admission.Denied("cluster resource placement crp-deleting is being deleted"),
202+
},
203+
"deny CRPE create - CRP with PickFixed placement type": {
204+
req: admission.Request{
205+
AdmissionRequest: admissionv1.AdmissionRequest{
206+
Name: "test-crpe",
207+
Object: runtime.RawExtension{
208+
Raw: invalidCRPEObjectInvalidPlacementTypeBytes,
209+
Object: invalidCRPEObjectInvalidPlacementType,
210+
},
211+
UserInfo: authenticationv1.UserInfo{
212+
Username: "test-user",
213+
Groups: []string{"system:masters"},
214+
},
215+
RequestKind: &utils.ClusterResourcePlacementEvictionMetaGVK,
216+
Operation: admissionv1.Create,
217+
},
218+
},
219+
resourceValidator: clusterResourcePlacementEvictionValidator{
220+
decoder: decoder,
221+
client: fakeClient,
222+
},
223+
wantResponse: admission.Denied("cluster resource placement policy type PickFixed is not supported"),
224+
},
225+
}
226+
for testName, testCase := range testCases {
227+
t.Run(testName, func(t *testing.T) {
228+
gotResult := testCase.resourceValidator.Handle(context.Background(), testCase.req)
229+
if diff := cmp.Diff(testCase.wantResponse, gotResult); diff != "" {
230+
t.Errorf("ClusterResourcePlacementEvictionValidator Handle() mismatch (-want +got):\n%s", diff)
231+
}
232+
})
233+
}
234+
}

0 commit comments

Comments
 (0)