View Source K8sWebhoox.AdmissionControl.Handler (k8s_webhoox v0.2.0)
A Helper module for admission review request handling.
When use
d, it turns the using module into a
Pluggable
step which can be used with
K8sWebhoox.Plug
. The :webhook_type
option has to be set
to either :validating
or :mutating
when initializing the Pluggable
:
post "/k8s-webhooks/admission-review/validating",
to: K8sWebhoox.Plug,
init_opts: [
webhook_handler: {MyOperator.AdmissionControlHandler, webhook_type: :validating}
]
usage
Usage
defmodule MyOperator.AdmissionControlHandler do
use K8sWebhoox.AdmissionControl.Handler
alias K8sWebhoox.AdmissionControl.AdmissionReview
# Mutate someresources resource
mutate "example.com/v1/someresources", conn do
AdmissionReview.deny(conn)
end
# Validate the sacle subresource of a pod
validate "v1/pods", "scale", conn do
conn
end
end
Link to this section Summary
Functions
Defines a handler for mutating webhook requests. The resource
this
handler mutates is defined in the form "group/version/plural" (plural being
the plural form of the resource, e.g. "deployments"). The subresource
is
optional. If given, the handler is only called for mutation of the given
subresource
. The parameter conn_var
defines the variable name of the
%K8sWebhoox.Conn{}
token inside your handler.
Defines a handler for validating webhook requests. The resource
this
handler validates is defined in the form "group/version/plural" (plural being
the plural form of the resource, e.g. "deployments"). The subresource
is
optional. If given, the handler is only called for validation of the given
subresource
. The parameter conn_var
defines the variable name of the
%K8sWebhoox.Conn{}
token inside your handler.
Link to this section Functions
@spec mutate(Macro.input(), Macro.input(), Macro.input(), keyword(Macro.input())) :: Macro.output()
Defines a handler for mutating webhook requests. The resource
this
handler mutates is defined in the form "group/version/plural" (plural being
the plural form of the resource, e.g. "deployments"). The subresource
is
optional. If given, the handler is only called for mutation of the given
subresource
. The parameter conn_var
defines the variable name of the
%K8sWebhoox.Conn{}
token inside your handler.
example
Example
mutate "example.com/v1/myresources", conn do
# your mutations
conn
end
Validating the scale
subresource:
mutate "v1/pod", "scale", conn do
# your mutations
conn
end
@spec validate(Macro.input(), Macro.input(), Macro.input(), keyword(Macro.input())) :: Macro.output()
Defines a handler for validating webhook requests. The resource
this
handler validates is defined in the form "group/version/plural" (plural being
the plural form of the resource, e.g. "deployments"). The subresource
is
optional. If given, the handler is only called for validation of the given
subresource
. The parameter conn_var
defines the variable name of the
%K8sWebhoox.Conn{}
token inside your handler.
example
Example
validate "example.com/v1/myresources", conn do
# your validations
conn
end
Validating the "scale" subresource:
validate "example.com/v1/myresources", "scale", conn do
# your validations
conn
end
You can use the K8sWebhoox.AdmissionControl.AdmissionReview
helper module to
validate the request:
validate "v1/pod", "scale", conn do
# the "some_label" is immutable
K8sWebhoox.AdmissionControl.AdmissionReview.check_immutable(
conn,
["metadata", "labels", "some_lable"]
)
end