Add operation checking to admission control handlers

Adds a new method to the handler interface that returns true only if the
admission control handler handles that operation.

pkg/admission/attributes.go

@@ -25,12 +25,12 @@ type attributesRecord struct {
 	kind      string
 	namespace string
 	resource  string
-	operation string
+	operation Operation
 	object    runtime.Object
 	userInfo  user.Info
 }
 
-func NewAttributesRecord(object runtime.Object, kind, namespace, resource, operation string, userInfo user.Info) Attributes {
+func NewAttributesRecord(object runtime.Object, kind, namespace, resource string, operation Operation, userInfo user.Info) Attributes {
 	return &attributesRecord{
 		kind:      kind,
 		namespace: namespace,
@@ -53,7 +53,7 @@ func (record *attributesRecord) GetResource() string {
 	return record.resource
 }
 
-func (record *attributesRecord) GetOperation() string {
+func (record *attributesRecord) GetOperation() Operation {
 	return record.operation
 }
 

pkg/admission/chain.go

@@ -36,9 +36,17 @@ func NewFromPlugins(client client.Interface, pluginNames []string, configFilePat
 	return chainAdmissionHandler(plugins)
 }
 
+// NewChainHandler creates a new chain handler from an array of handlers. Used for testing.
+func NewChainHandler(handlers ...Interface) Interface {
+	return chainAdmissionHandler(handlers)
+}
+
 // Admit performs an admission control check using a chain of handlers, and returns immediately on first error
 func (admissionHandler chainAdmissionHandler) Admit(a Attributes) error {
 	for _, handler := range admissionHandler {
+		if !handler.Handles(a.GetOperation()) {
+			continue
+		}
 		err := handler.Admit(a)
 		if err != nil {
 			return err
@@ -46,3 +54,13 @@ func (admissionHandler chainAdmissionHandler) Admit(a Attributes) error {
 	}
 	return nil
 }
+
+// Handles will return true if any of the handlers handles the given operation
+func (admissionHandler chainAdmissionHandler) Handles(operation Operation) bool {
+	for _, handler := range admissionHandler {
+		if handler.Handles(operation) {
+			return true
+		}
+	}
+	return false
+}

pkg/admission/chain_test.go

@@ -0,0 +1,152 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"fmt"
+	"testing"
+)
+
+type FakeHandler struct {
+	*Handler
+	name        string
+	admit       bool
+	admitCalled bool
+}
+
+func (h *FakeHandler) Admit(a Attributes) (err error) {
+	h.admitCalled = true
+	if h.admit {
+		return nil
+	}
+	return fmt.Errorf("Don't admit")
+}
+
+func makeHandler(name string, admit bool, ops ...Operation) Interface {
+	return &FakeHandler{
+		name:    name,
+		admit:   admit,
+		Handler: NewHandler(ops...),
+	}
+}
+
+func TestAdmit(t *testing.T) {
+	tests := []struct {
+		name      string
+		operation Operation
+		chain     chainAdmissionHandler
+		accept    bool
+		calls     map[string]bool
+	}{
+		{
+			name:      "all accept",
+			operation: Create,
+			chain: []Interface{
+				makeHandler("a", true, Update, Delete, Create),
+				makeHandler("b", true, Delete, Create),
+				makeHandler("c", true, Create),
+			},
+			calls:  map[string]bool{"a": true, "b": true, "c": true},
+			accept: true,
+		},
+		{
+			name:      "ignore handler",
+			operation: Create,
+			chain: []Interface{
+				makeHandler("a", true, Update, Delete, Create),
+				makeHandler("b", false, Delete),
+				makeHandler("c", true, Create),
+			},
+			calls:  map[string]bool{"a": true, "c": true},
+			accept: true,
+		},
+		{
+			name:      "ignore all",
+			operation: Connect,
+			chain: []Interface{
+				makeHandler("a", true, Update, Delete, Create),
+				makeHandler("b", false, Delete),
+				makeHandler("c", true, Create),
+			},
+			calls:  map[string]bool{},
+			accept: true,
+		},
+		{
+			name:      "reject one",
+			operation: Delete,
+			chain: []Interface{
+				makeHandler("a", true, Update, Delete, Create),
+				makeHandler("b", false, Delete),
+				makeHandler("c", true, Create),
+			},
+			calls:  map[string]bool{"a": true, "b": true},
+			accept: false,
+		},
+	}
+	for _, test := range tests {
+		err := test.chain.Admit(NewAttributesRecord(nil, "", "", "", test.operation, nil))
+		accepted := (err == nil)
+		if accepted != test.accept {
+			t.Errorf("%s: unexpected result of admit call: %v\n", test.name, accepted)
+		}
+		for _, h := range test.chain {
+			fake := h.(*FakeHandler)
+			_, shouldBeCalled := test.calls[fake.name]
+			if shouldBeCalled != fake.admitCalled {
+				t.Errorf("%s: handler %s not called as expected: %v", test.name, fake.name, fake.admitCalled)
+				continue
+			}
+		}
+	}
+}
+
+func TestHandles(t *testing.T) {
+	chain := chainAdmissionHandler{
+		makeHandler("a", true, Update, Delete, Create),
+		makeHandler("b", true, Delete, Create),
+		makeHandler("c", true, Create),
+	}
+
+	tests := []struct {
+		name      string
+		operation Operation
+		chain     chainAdmissionHandler
+		expected  bool
+	}{
+		{
+			name:      "all handle",
+			operation: Create,
+			expected:  true,
+		},
+		{
+			name:      "none handle",
+			operation: Connect,
+			expected:  false,
+		},
+		{
+			name:      "some handle",
+			operation: Delete,
+			expected:  true,
+		},
+	}
+	for _, test := range tests {
+		handles := chain.Handles(test.operation)
+		if handles != test.expected {
+			t.Errorf("Unexpected handles result. Expected: %v. Actual: %v", test.expected, handles)
+		}
+	}
+}

pkg/admission/handler.go

@@ -0,0 +1,44 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"
+)
+
+// Handler is a base for admission control handlers that
+// support a predefined set of operations
+type Handler struct {
+	operations util.StringSet
+}
+
+// Handles returns true for methods that this handler supports
+func (h *Handler) Handles(operation Operation) bool {
+	return h.operations.Has(string(operation))
+}
+
+// NewHandler creates a new base handler that handles the passed
+// in operations
+func NewHandler(ops ...Operation) *Handler {
+	operations := util.NewStringSet()
+	for _, op := range ops {
+		operations.Insert(string(op))
+	}
+	return &Handler{
+		operations: operations,
+	}
+}

pkg/admission/interfaces.go

@@ -26,7 +26,7 @@ import (
 type Attributes interface {
 	GetNamespace() string
 	GetResource() string
-	GetOperation() string
+	GetOperation() Operation
 	GetObject() runtime.Object
 	GetKind() string
 	GetUserInfo() user.Info
@@ -36,4 +36,19 @@ type Attributes interface {
 type Interface interface {
 	// Admit makes an admission decision based on the request attributes
 	Admit(a Attributes) (err error)
+
+	// Handles returns true if this admission controller can handle the given operation
+	// where operation can be one of CREATE, UPDATE, DELETE, or CONNECT
+	Handles(operation Operation) bool
 }
+
+// Operation is the type of resource operation being checked for admission control
+type Operation string
+
+// Operation constants
+const (
+	Create  Operation = "CREATE"
+	Update  Operation = "UPDATE"
+	Delete  Operation = "DELETE"
+	Connect Operation = "CONNECT"
+)