2 Copyright 2018 The Kubernetes Authors.
4 Licensed under the Apache License, Version 2.0 (the "License");
5 you may not use this file except in compliance with the License.
6 You may obtain a copy of the License at
8 http://www.apache.org/licenses/LICENSE-2.0
10 Unless required by applicable law or agreed to in writing, software
11 distributed under the License is distributed on an "AS IS" BASIS,
12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 See the License for the specific language governing permissions and
14 limitations under the License.
18 Package admission provides implementation for admission webhook and methods to implement admission webhook handlers.
20 The following snippet is an example implementation of mutating handler.
27 func (m *Mutator) mutatePodsFn(ctx context.Context, pod *corev1.Pod) error {
28 // your logic to mutate the passed-in pod.
31 func (m *Mutator) Handle(ctx context.Context, req types.Request) types.Response {
33 err := m.decoder.Decode(req, pod)
35 return admission.ErrorResponse(http.StatusBadRequest, err)
37 // Do deepcopy before actually mutate the object.
38 copy := pod.DeepCopy()
39 err = m.mutatePodsFn(ctx, copy)
41 return admission.ErrorResponse(http.StatusInternalServerError, err)
43 return admission.PatchResponse(pod, copy)
46 // InjectClient is called by the Manager and provides a client.Client to the Mutator instance.
47 func (m *Mutator) InjectClient(c client.Client) error {
52 // InjectDecoder is called by the Manager and provides a types.Decoder to the Mutator instance.
53 func (m *Mutator) InjectDecoder(d types.Decoder) error {
58 The following snippet is an example implementation of validating handler.
65 func (v *Validator) validatePodsFn(ctx context.Context, pod *corev1.Pod) (bool, string, error) {
66 // your business logic
69 func (v *Validator) Handle(ctx context.Context, req types.Request) types.Response {
71 err := h.decoder.Decode(req, pod)
73 return admission.ErrorResponse(http.StatusBadRequest, err)
76 allowed, reason, err := h.validatePodsFn(ctx, pod)
78 return admission.ErrorResponse(http.StatusInternalServerError, err)
80 return admission.ValidationResponse(allowed, reason)
83 // InjectClient is called by the Manager and provides a client.Client to the Validator instance.
84 func (v *Validator) InjectClient(c client.Client) error {
89 // InjectDecoder is called by the Manager and provides a types.Decoder to the Validator instance.
90 func (v *Validator) InjectDecoder(d types.Decoder) error {
98 logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
101 var log = logf.KBLog.WithName("admission")