karmada-io
/
karmada
mirror of https://github.com/karmada-io/karmada.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3397 from chaunceyjiang/path 

fix: validate predicate path for imageOverride.
This commit is contained in:
karmada-bot 2023-04-12 14:49:00 +08:00 committed by GitHub
parent 4669d59a9b 6f3afbdbf2
commit 7f9dd0fd37
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 47 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/openapi-spec/swagger.json
View File

@ -15473,7 +15473,7 @@
"default": "" "default": ""
}, },
"predicate": { "predicate": {
"description": "Predicate filters images before applying the rule.\n\nDefaults to nil, in that case, the system will automatically detect image fields if the resource type is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule:\n - Pod: spec/containers/\u003cN\u003e/image\n - ReplicaSet: spec/template/spec/containers/\u003cN\u003e/image\n - Deployment: spec/template/spec/containers/\u003cN\u003e/image\n - DaemonSet: spec/template/spec/containers/\u003cN\u003e/image\n - StatefulSet: spec/template/spec/containers/\u003cN\u003e/image\n - Job: spec/template/spec/containers/\u003cN\u003e/image\nIn addition, all images will be processed if the resource object has more than one container.\n\nIf not nil, only images matches the filters will be processed.", "description": "Predicate filters images before applying the rule.\n\nDefaults to nil, in that case, the system will automatically detect image fields if the resource type is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule:\n - Pod: /spec/containers/\u003cN\u003e/image\n - ReplicaSet: /spec/template/spec/containers/\u003cN\u003e/image\n - Deployment: /spec/template/spec/containers/\u003cN\u003e/image\n - DaemonSet: /spec/template/spec/containers/\u003cN\u003e/image\n - StatefulSet: /spec/template/spec/containers/\u003cN\u003e/image\n - Job: /spec/template/spec/containers/\u003cN\u003e/image\nIn addition, all images will be processed if the resource object has more than one container.\n\nIf not nil, only images matches the filters will be processed.",
"$ref": "#/definitions/com.github.karmada-io.karmada.pkg.apis.policy.v1alpha1.ImagePredicate" "$ref": "#/definitions/com.github.karmada-io.karmada.pkg.apis.policy.v1alpha1.ImagePredicate"
}, },
"value": { "value": {

29
charts/karmada/_crds/bases/policy.karmada.io_clusteroverridepolicies.yaml
View File

@ -176,14 +176,15 @@ spec:
system will automatically detect image fields if system will automatically detect image fields if
the resource type is Pod, ReplicaSet, Deployment, the resource type is Pod, ReplicaSet, Deployment,
StatefulSet, DaemonSet or Job by following rule: StatefulSet, DaemonSet or Job by following rule:
- Pod: spec/containers/<N>/image - ReplicaSet: spec/template/spec/containers/<N>/image - Pod: /spec/containers/<N>/image - ReplicaSet:
- Deployment: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - Deployment:
- DaemonSet: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - DaemonSet:
- StatefulSet: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - StatefulSet:
- Job: spec/template/spec/containers/<N>/image In /spec/template/spec/containers/<N>/image - Job:
addition, all images will be processed if the resource /spec/template/spec/containers/<N>/image In addition,
object has more than one container. \n If not nil, all images will be processed if the resource object
only images matches the filters will be processed." has more than one container. \n If not nil, only
images matches the filters will be processed."
properties: properties:
path: path:
description: Path indicates the path of target description: Path indicates the path of target
@ -500,12 +501,12 @@ spec:
rule. \n Defaults to nil, in that case, the system will rule. \n Defaults to nil, in that case, the system will
automatically detect image fields if the resource type automatically detect image fields if the resource type
is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet
or Job by following rule: - Pod: spec/containers/<N>/image or Job by following rule: - Pod: /spec/containers/<N>/image
- ReplicaSet: spec/template/spec/containers/<N>/image - ReplicaSet: /spec/template/spec/containers/<N>/image
- Deployment: spec/template/spec/containers/<N>/image - Deployment: /spec/template/spec/containers/<N>/image
- DaemonSet: spec/template/spec/containers/<N>/image - - DaemonSet: /spec/template/spec/containers/<N>/image
StatefulSet: spec/template/spec/containers/<N>/image - - StatefulSet: /spec/template/spec/containers/<N>/image
Job: spec/template/spec/containers/<N>/image In addition, - Job: /spec/template/spec/containers/<N>/image In addition,
all images will be processed if the resource object has all images will be processed if the resource object has
more than one container. \n If not nil, only images matches more than one container. \n If not nil, only images matches
the filters will be processed." the filters will be processed."

29
charts/karmada/_crds/bases/policy.karmada.io_overridepolicies.yaml
View File

@ -176,14 +176,15 @@ spec:
system will automatically detect image fields if system will automatically detect image fields if
the resource type is Pod, ReplicaSet, Deployment, the resource type is Pod, ReplicaSet, Deployment,
StatefulSet, DaemonSet or Job by following rule: StatefulSet, DaemonSet or Job by following rule:
- Pod: spec/containers/<N>/image - ReplicaSet: spec/template/spec/containers/<N>/image - Pod: /spec/containers/<N>/image - ReplicaSet:
- Deployment: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - Deployment:
- DaemonSet: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - DaemonSet:
- StatefulSet: spec/template/spec/containers/<N>/image /spec/template/spec/containers/<N>/image - StatefulSet:
- Job: spec/template/spec/containers/<N>/image In /spec/template/spec/containers/<N>/image - Job:
addition, all images will be processed if the resource /spec/template/spec/containers/<N>/image In addition,
object has more than one container. \n If not nil, all images will be processed if the resource object
only images matches the filters will be processed." has more than one container. \n If not nil, only
images matches the filters will be processed."
properties: properties:
path: path:
description: Path indicates the path of target description: Path indicates the path of target
@ -500,12 +501,12 @@ spec:
rule. \n Defaults to nil, in that case, the system will rule. \n Defaults to nil, in that case, the system will
automatically detect image fields if the resource type automatically detect image fields if the resource type
is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet
or Job by following rule: - Pod: spec/containers/<N>/image or Job by following rule: - Pod: /spec/containers/<N>/image
- ReplicaSet: spec/template/spec/containers/<N>/image - ReplicaSet: /spec/template/spec/containers/<N>/image
- Deployment: spec/template/spec/containers/<N>/image - Deployment: /spec/template/spec/containers/<N>/image
- DaemonSet: spec/template/spec/containers/<N>/image - - DaemonSet: /spec/template/spec/containers/<N>/image
StatefulSet: spec/template/spec/containers/<N>/image - - StatefulSet: /spec/template/spec/containers/<N>/image
Job: spec/template/spec/containers/<N>/image In addition, - Job: /spec/template/spec/containers/<N>/image In addition,
all images will be processed if the resource object has all images will be processed if the resource object has
more than one container. \n If not nil, only images matches more than one container. \n If not nil, only images matches
the filters will be processed." the filters will be processed."

12
pkg/apis/policy/v1alpha1/override_types.go
View File

@ -133,12 +133,12 @@ type ImageOverrider struct {
// //
// Defaults to nil, in that case, the system will automatically detect image fields if the resource type is // Defaults to nil, in that case, the system will automatically detect image fields if the resource type is
// Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule: // Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule:
// - Pod: spec/containers/<N>/image // - Pod: /spec/containers/<N>/image
// - ReplicaSet: spec/template/spec/containers/<N>/image // - ReplicaSet: /spec/template/spec/containers/<N>/image
// - Deployment: spec/template/spec/containers/<N>/image // - Deployment: /spec/template/spec/containers/<N>/image
// - DaemonSet: spec/template/spec/containers/<N>/image // - DaemonSet: /spec/template/spec/containers/<N>/image
// - StatefulSet: spec/template/spec/containers/<N>/image // - StatefulSet: /spec/template/spec/containers/<N>/image
// - Job: spec/template/spec/containers/<N>/image // - Job: /spec/template/spec/containers/<N>/image
// In addition, all images will be processed if the resource object has more than one container. // In addition, all images will be processed if the resource object has more than one container.
// //
// If not nil, only images matches the filters will be processed. // If not nil, only images matches the filters will be processed.

2
pkg/generated/openapi/zz_generated.openapi.go
View File

@ -2829,7 +2829,7 @@ func schema_pkg_apis_policy_v1alpha1_ImageOverrider(ref common.ReferenceCallback
Properties: map[string]spec.Schema{ Properties: map[string]spec.Schema{
"predicate": { "predicate": {
SchemaProps: spec.SchemaProps{ SchemaProps: spec.SchemaProps{
Description: "Predicate filters images before applying the rule.\n\nDefaults to nil, in that case, the system will automatically detect image fields if the resource type is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule:\n - Pod: spec/containers/<N>/image\n - ReplicaSet: spec/template/spec/containers/<N>/image\n - Deployment: spec/template/spec/containers/<N>/image\n - DaemonSet: spec/template/spec/containers/<N>/image\n - StatefulSet: spec/template/spec/containers/<N>/image\n - Job: spec/template/spec/containers/<N>/image\nIn addition, all images will be processed if the resource object has more than one container.\n\nIf not nil, only images matches the filters will be processed.", Description: "Predicate filters images before applying the rule.\n\nDefaults to nil, in that case, the system will automatically detect image fields if the resource type is Pod, ReplicaSet, Deployment, StatefulSet, DaemonSet or Job by following rule:\n - Pod: /spec/containers/<N>/image\n - ReplicaSet: /spec/template/spec/containers/<N>/image\n - Deployment: /spec/template/spec/containers/<N>/image\n - DaemonSet: /spec/template/spec/containers/<N>/image\n - StatefulSet: /spec/template/spec/containers/<N>/image\n - Job: /spec/template/spec/containers/<N>/image\nIn addition, all images will be processed if the resource object has more than one container.\n\nIf not nil, only images matches the filters will be processed.",
Ref: ref("github.com/karmada-io/karmada/pkg/apis/policy/v1alpha1.ImagePredicate"), Ref: ref("github.com/karmada-io/karmada/pkg/apis/policy/v1alpha1.ImagePredicate"),
}, },
}, },

9
pkg/util/validation/validation.go
View File

@ -2,6 +2,7 @@ package validation
import ( import (
"fmt" "fmt"
"strings"
corev1 "k8s.io/api/core/v1" corev1 "k8s.io/api/core/v1"
apivalidation "k8s.io/apimachinery/pkg/api/validation" apivalidation "k8s.io/apimachinery/pkg/api/validation"
@ -208,6 +209,14 @@ func ValidateOverrideRules(overrideRules []policyv1alpha1.RuleWithCluster, fldPa
allErrs = append(allErrs, metav1validation.ValidateLabels(label.Value, labelPath.Child("value"))...) allErrs = append(allErrs, metav1validation.ValidateLabels(label.Value, labelPath.Child("value"))...)
} }
// validates predicate path.
for imageIndex, image := range rule.Overriders.ImageOverrider {
imagePath := rulePath.Child("overriders").Child("imageOverrider").Index(imageIndex)
if image.Predicate != nil && !strings.HasPrefix(image.Predicate.Path, "/") {
allErrs = append(allErrs, field.Invalid(imagePath.Child("predicate").Child("path"), image.Predicate.Path, "path should be start with / character"))
}
}
// validates the targetCluster. // validates the targetCluster.
allErrs = append(allErrs, ValidateClusterAffinity(rule.TargetCluster, rulePath.Child("targetCluster"))...) allErrs = append(allErrs, ValidateClusterAffinity(rule.TargetCluster, rulePath.Child("targetCluster"))...)
} }