Remove client from attributes, remove admission control interface, fix-up error codes
This commit is contained in:
@@ -1,69 +0,0 @@
|
||||
/*
|
||||
Copyright 2014 Google Inc. All rights reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package admission
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
apierrors "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/client"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/runtime"
|
||||
)
|
||||
|
||||
// stubAdmissionController is capable of either always admitting or always denying incoming requests
|
||||
type stubAdmissionController struct {
|
||||
admit bool
|
||||
}
|
||||
|
||||
func (ac *stubAdmissionController) AdmissionControl(operation, kind, namespace string, object runtime.Object) (err error) {
|
||||
if !ac.admit {
|
||||
err = apierrors.NewConflict(kind, "name", errors.New("No changes allowed"))
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
func NewAlwaysAdmitController() AdmissionControl {
|
||||
return &stubAdmissionController{
|
||||
admit: true,
|
||||
}
|
||||
}
|
||||
|
||||
func NewAlwaysDenyController() AdmissionControl {
|
||||
return &stubAdmissionController{
|
||||
admit: false,
|
||||
}
|
||||
}
|
||||
|
||||
type admissionController struct {
|
||||
client client.Interface
|
||||
admissionHandler Interface
|
||||
}
|
||||
|
||||
func NewAdmissionControl(client client.Interface, pluginNames []string, configFilePath string) AdmissionControl {
|
||||
return NewAdmissionControlForHandler(client, newInterface(pluginNames, configFilePath))
|
||||
}
|
||||
|
||||
func NewAdmissionControlForHandler(client client.Interface, handler Interface) AdmissionControl {
|
||||
return &admissionController{
|
||||
client: client,
|
||||
admissionHandler: handler,
|
||||
}
|
||||
}
|
||||
|
||||
func (ac *admissionController) AdmissionControl(operation, kind, namespace string, object runtime.Object) (err error) {
|
||||
return ac.admissionHandler.Admit(NewAttributesRecord(ac.client, object, namespace, kind, operation))
|
||||
}
|
@@ -17,21 +17,18 @@ limitations under the License.
|
||||
package admission
|
||||
|
||||
import (
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/client"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/runtime"
|
||||
)
|
||||
|
||||
type attributesRecord struct {
|
||||
client client.Interface
|
||||
namespace string
|
||||
kind string
|
||||
operation string
|
||||
object runtime.Object
|
||||
}
|
||||
|
||||
func NewAttributesRecord(client client.Interface, object runtime.Object, namespace, kind, operation string) Attributes {
|
||||
func NewAttributesRecord(object runtime.Object, namespace, kind, operation string) Attributes {
|
||||
return &attributesRecord{
|
||||
client: client,
|
||||
namespace: namespace,
|
||||
kind: kind,
|
||||
operation: operation,
|
||||
@@ -39,10 +36,6 @@ func NewAttributesRecord(client client.Interface, object runtime.Object, namespa
|
||||
}
|
||||
}
|
||||
|
||||
func (record *attributesRecord) GetClient() client.Interface {
|
||||
return record.client
|
||||
}
|
||||
|
||||
func (record *attributesRecord) GetNamespace() string {
|
||||
return record.namespace
|
||||
}
|
||||
|
@@ -16,16 +16,18 @@ limitations under the License.
|
||||
|
||||
package admission
|
||||
|
||||
import ()
|
||||
import (
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/client"
|
||||
)
|
||||
|
||||
// chainAdmissionHandler is an instance of admission.Interface that performs admission control using a chain of admission handlers
|
||||
type chainAdmissionHandler []Interface
|
||||
|
||||
// New returns an admission.Interface that will enforce admission control decisions
|
||||
func newInterface(pluginNames []string, configFilePath string) Interface {
|
||||
func NewFromPlugins(client client.Interface, pluginNames []string, configFilePath string) Interface {
|
||||
plugins := []Interface{}
|
||||
for _, pluginName := range pluginNames {
|
||||
plugin := InitPlugin(pluginName, configFilePath)
|
||||
plugin := InitPlugin(pluginName, client, configFilePath)
|
||||
if plugin != nil {
|
||||
plugins = append(plugins, plugin)
|
||||
}
|
||||
|
@@ -17,14 +17,12 @@ limitations under the License.
|
||||
package admission
|
||||
|
||||
import (
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/client"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/runtime"
|
||||
)
|
||||
|
||||
// Attributes is an interface used by AdmissionController to get information about a request
|
||||
// that is used to make an admission decision.
|
||||
type Attributes interface {
|
||||
GetClient() client.Interface
|
||||
GetNamespace() string
|
||||
GetKind() string
|
||||
GetOperation() string
|
||||
@@ -36,8 +34,3 @@ type Interface interface {
|
||||
// Admit makes an admission decision based on the request attributes
|
||||
Admit(a Attributes) (err error)
|
||||
}
|
||||
|
||||
// AdmissionControl is responsible for performing Admission control decisions
|
||||
type AdmissionControl interface {
|
||||
AdmissionControl(operation, kind, namespace string, object runtime.Object) (err error)
|
||||
}
|
||||
|
@@ -21,6 +21,7 @@ import (
|
||||
"os"
|
||||
"sync"
|
||||
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/client"
|
||||
"github.com/golang/glog"
|
||||
)
|
||||
|
||||
@@ -28,7 +29,7 @@ import (
|
||||
// The config parameter provides an io.Reader handler to the factory in
|
||||
// order to load specific configurations. If no configuration is provided
|
||||
// the parameter is nil.
|
||||
type Factory func(config io.Reader) (Interface, error)
|
||||
type Factory func(client client.Interface, config io.Reader) (Interface, error)
|
||||
|
||||
// All registered admission options.
|
||||
var pluginsMutex sync.Mutex
|
||||
@@ -62,19 +63,19 @@ func RegisterPlugin(name string, plugin Factory) {
|
||||
// the name is not known. The error return is only used if the named provider
|
||||
// was known but failed to initialize. The config parameter specifies the
|
||||
// io.Reader handler of the configuration file for the cloud provider, or nil
|
||||
// for no configuation.
|
||||
func GetPlugin(name string, config io.Reader) (Interface, error) {
|
||||
// for no configuration.
|
||||
func GetPlugin(name string, client client.Interface, config io.Reader) (Interface, error) {
|
||||
pluginsMutex.Lock()
|
||||
defer pluginsMutex.Unlock()
|
||||
f, found := plugins[name]
|
||||
if !found {
|
||||
return nil, nil
|
||||
}
|
||||
return f(config)
|
||||
return f(client, config)
|
||||
}
|
||||
|
||||
// InitPlugin creates an instance of the named interface
|
||||
func InitPlugin(name string, configFilePath string) Interface {
|
||||
func InitPlugin(name string, client client.Interface, configFilePath string) Interface {
|
||||
var config *os.File
|
||||
|
||||
if name == "" {
|
||||
@@ -94,7 +95,7 @@ func InitPlugin(name string, configFilePath string) Interface {
|
||||
defer config.Close()
|
||||
}
|
||||
|
||||
plugin, err := GetPlugin(name, config)
|
||||
plugin, err := GetPlugin(name, client, config)
|
||||
if err != nil {
|
||||
glog.Fatalf("Couldn't init admission plugin %q: %v", name, err)
|
||||
}
|
||||
|
Reference in New Issue
Block a user