View Source K8sWebhoox.AdmissionControl.Handler (k8s_webhoox v0.1.1)

A Helper module for admission review request handling.

When used, it turns the using module into a Pluggable step which can be used with K8sWebhoox.Plug. The :webhook_type option has to be set to either :validating or :mutating when initializing the Pluggable:

post "/k8s-webhooks/admission-review/validating",
  to: K8sWebhoox.Plug,
  init_opts: [
    webhook_handler: {MyOperator.AdmissionControlHandler, webhook_type: :validating}
  ]

usage

Usage

defmodule MyOperator.AdmissionControlHandler do
  use K8sWebhoox.AdmissionControl.Handler

  alias K8sWebhoox.AdmissionControl.AdmissionReview

  # Mutate someresources resource
  mutate "example.com/v1/someresources", conn do
    AdmissionReview.deny(conn)
  end

  # Validate the sacle subresource of a pod
  validate "v1/pods", "scale", conn do
    conn
  end
end

Link to this section Summary

Functions

Defines a handler for mutating webhook requests. The resource this handler mutates is defined in the form "group/version/plural" (plural being the plural form of the resource, e.g. "deployments"). The subresource is optional. If given, the handler is only called for mutation of the given subresource. The parameter conn_var defines the variable name of the %K8sWebhoox.Conn{} token inside your handler.

Defines a handler for validating webhook requests. The resource this handler validates is defined in the form "group/version/plural" (plural being the plural form of the resource, e.g. "deployments"). The subresource is optional. If given, the handler is only called for validation of the given subresource. The parameter conn_var defines the variable name of the %K8sWebhoox.Conn{} token inside your handler.

Link to this section Functions

Link to this macro

mutate(resource, subresource \\ nil, conn_var, list)

View Source (macro)

Defines a handler for mutating webhook requests. The resource this handler mutates is defined in the form "group/version/plural" (plural being the plural form of the resource, e.g. "deployments"). The subresource is optional. If given, the handler is only called for mutation of the given subresource. The parameter conn_var defines the variable name of the %K8sWebhoox.Conn{} token inside your handler.

example

Example

mutate "example.com/v1/myresources", conn do
  # your mutations
  conn
end

Validating the scale subresource:

mutate "v1/pod", "scale", conn do
  # your mutations
  conn
end
Link to this macro

validate(resource, subresource \\ nil, conn_var, list)

View Source (macro)

Defines a handler for validating webhook requests. The resource this handler validates is defined in the form "group/version/plural" (plural being the plural form of the resource, e.g. "deployments"). The subresource is optional. If given, the handler is only called for validation of the given subresource. The parameter conn_var defines the variable name of the %K8sWebhoox.Conn{} token inside your handler.

example

Example

validate "example.com/v1/myresources", conn do
  # your validations
  conn
end

Validating the "scale" subresource:

validate "example.com/v1/myresources", "scale", conn do
  # your validations
  conn
end

You can use the K8sWebhoox.AdmissionControl.AdmissionReview helper module to validate the request:

validate "v1/pod", "scale", conn do
  # the "some_label" is immutable
  K8sWebhoox.AdmissionControl.AdmissionReview.check_immutable(
    conn,
    ["metadata", "labels", "some_lable"]
  )
end