195 lines
8.7 KiB
Go
195 lines
8.7 KiB
Go
/*
|
|
Copyright 2021 The Karmada Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package app
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"flag"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"github.com/spf13/cobra"
|
|
cliflag "k8s.io/component-base/cli/flag"
|
|
"k8s.io/component-base/term"
|
|
"k8s.io/klog/v2"
|
|
controllerruntime "sigs.k8s.io/controller-runtime"
|
|
"sigs.k8s.io/controller-runtime/pkg/healthz"
|
|
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
|
|
"sigs.k8s.io/controller-runtime/pkg/webhook"
|
|
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
|
|
"sigs.k8s.io/controller-runtime/pkg/webhook/conversion"
|
|
|
|
"github.com/karmada-io/karmada/cmd/webhook/app/options"
|
|
"github.com/karmada-io/karmada/pkg/sharedcli"
|
|
"github.com/karmada-io/karmada/pkg/sharedcli/klogflag"
|
|
"github.com/karmada-io/karmada/pkg/sharedcli/profileflag"
|
|
"github.com/karmada-io/karmada/pkg/util/gclient"
|
|
"github.com/karmada-io/karmada/pkg/util/names"
|
|
"github.com/karmada-io/karmada/pkg/version"
|
|
"github.com/karmada-io/karmada/pkg/version/sharedcommand"
|
|
"github.com/karmada-io/karmada/pkg/webhook/clusteroverridepolicy"
|
|
"github.com/karmada-io/karmada/pkg/webhook/clusterpropagationpolicy"
|
|
"github.com/karmada-io/karmada/pkg/webhook/clusterresourcebinding"
|
|
"github.com/karmada-io/karmada/pkg/webhook/configuration"
|
|
"github.com/karmada-io/karmada/pkg/webhook/cronfederatedhpa"
|
|
"github.com/karmada-io/karmada/pkg/webhook/federatedhpa"
|
|
"github.com/karmada-io/karmada/pkg/webhook/federatedresourcequota"
|
|
"github.com/karmada-io/karmada/pkg/webhook/multiclusteringress"
|
|
"github.com/karmada-io/karmada/pkg/webhook/multiclusterservice"
|
|
"github.com/karmada-io/karmada/pkg/webhook/overridepolicy"
|
|
"github.com/karmada-io/karmada/pkg/webhook/propagationpolicy"
|
|
"github.com/karmada-io/karmada/pkg/webhook/resourcebinding"
|
|
"github.com/karmada-io/karmada/pkg/webhook/resourcedeletionprotection"
|
|
"github.com/karmada-io/karmada/pkg/webhook/resourceinterpretercustomization"
|
|
"github.com/karmada-io/karmada/pkg/webhook/work"
|
|
)
|
|
|
|
// NewWebhookCommand creates a *cobra.Command object with default parameters
|
|
func NewWebhookCommand(ctx context.Context) *cobra.Command {
|
|
opts := options.NewOptions()
|
|
|
|
cmd := &cobra.Command{
|
|
Use: names.KarmadaWebhookComponentName,
|
|
Long: `The karmada-webhook starts a webhook server and manages policies about how to mutate and validate
|
|
Karmada resources including 'PropagationPolicy', 'OverridePolicy' and so on.`,
|
|
RunE: func(_ *cobra.Command, _ []string) error {
|
|
// validate options
|
|
if errs := opts.Validate(); len(errs) != 0 {
|
|
return errs.ToAggregate()
|
|
}
|
|
if err := Run(ctx, opts); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
},
|
|
Args: func(cmd *cobra.Command, args []string) error {
|
|
for _, arg := range args {
|
|
if len(arg) > 0 {
|
|
return fmt.Errorf("%q does not take any arguments, got %q", cmd.CommandPath(), args)
|
|
}
|
|
}
|
|
return nil
|
|
},
|
|
}
|
|
|
|
fss := cliflag.NamedFlagSets{}
|
|
|
|
genericFlagSet := fss.FlagSet("generic")
|
|
genericFlagSet.AddGoFlagSet(flag.CommandLine)
|
|
opts.AddFlags(genericFlagSet)
|
|
|
|
// Set klog flags
|
|
logsFlagSet := fss.FlagSet("logs")
|
|
klogflag.Add(logsFlagSet)
|
|
|
|
cmd.AddCommand(sharedcommand.NewCmdVersion(names.KarmadaWebhookComponentName))
|
|
cmd.Flags().AddFlagSet(genericFlagSet)
|
|
cmd.Flags().AddFlagSet(logsFlagSet)
|
|
|
|
cols, _, _ := term.TerminalSize(cmd.OutOrStdout())
|
|
sharedcli.SetUsageAndHelpFunc(cmd, fss, cols)
|
|
return cmd
|
|
}
|
|
|
|
// Run runs the webhook server with options. This should never exit.
|
|
func Run(ctx context.Context, opts *options.Options) error {
|
|
klog.Infof("karmada-webhook version: %s", version.Get())
|
|
|
|
profileflag.ListenAndServe(opts.ProfileOpts)
|
|
|
|
config, err := controllerruntime.GetConfig()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
config.QPS, config.Burst = opts.KubeAPIQPS, opts.KubeAPIBurst
|
|
|
|
hookManager, err := controllerruntime.NewManager(config, controllerruntime.Options{
|
|
Logger: klog.Background(),
|
|
Scheme: gclient.NewSchema(),
|
|
WebhookServer: webhook.NewServer(webhook.Options{
|
|
Host: opts.BindAddress,
|
|
Port: opts.SecurePort,
|
|
CertDir: opts.CertDir,
|
|
CertName: opts.CertName,
|
|
KeyName: opts.KeyName,
|
|
TLSOpts: []func(*tls.Config){
|
|
func(config *tls.Config) {
|
|
// Just transform the valid options as opts.TLSMinVersion
|
|
// can only accept "1.0", "1.1", "1.2", "1.3" and has default
|
|
// value,
|
|
switch opts.TLSMinVersion {
|
|
case "1.0":
|
|
config.MinVersion = tls.VersionTLS10
|
|
case "1.1":
|
|
config.MinVersion = tls.VersionTLS11
|
|
case "1.2":
|
|
config.MinVersion = tls.VersionTLS12
|
|
case "1.3":
|
|
config.MinVersion = tls.VersionTLS13
|
|
}
|
|
},
|
|
},
|
|
}),
|
|
LeaderElection: false,
|
|
Metrics: metricsserver.Options{BindAddress: opts.MetricsBindAddress},
|
|
HealthProbeBindAddress: opts.HealthProbeBindAddress,
|
|
})
|
|
if err != nil {
|
|
klog.Errorf("Failed to build webhook server: %v", err)
|
|
return err
|
|
}
|
|
|
|
decoder := admission.NewDecoder(hookManager.GetScheme())
|
|
|
|
klog.Info("Registering webhooks to the webhook server")
|
|
hookServer := hookManager.GetWebhookServer()
|
|
hookServer.Register("/mutate-propagationpolicy", &webhook.Admission{Handler: propagationpolicy.NewMutatingHandler(
|
|
opts.DefaultNotReadyTolerationSeconds, opts.DefaultUnreachableTolerationSeconds, decoder)})
|
|
hookServer.Register("/validate-propagationpolicy", &webhook.Admission{Handler: &propagationpolicy.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-clusterpropagationpolicy", &webhook.Admission{Handler: clusterpropagationpolicy.NewMutatingHandler(
|
|
opts.DefaultNotReadyTolerationSeconds, opts.DefaultUnreachableTolerationSeconds, decoder)})
|
|
hookServer.Register("/validate-clusterpropagationpolicy", &webhook.Admission{Handler: &clusterpropagationpolicy.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-overridepolicy", &webhook.Admission{Handler: &overridepolicy.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-overridepolicy", &webhook.Admission{Handler: &overridepolicy.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-clusteroverridepolicy", &webhook.Admission{Handler: &clusteroverridepolicy.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-work", &webhook.Admission{Handler: &work.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/convert", conversion.NewWebhookHandler(hookManager.GetScheme()))
|
|
hookServer.Register("/validate-resourceinterpreterwebhookconfiguration", &webhook.Admission{Handler: &configuration.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-federatedresourcequota", &webhook.Admission{Handler: &federatedresourcequota.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-federatedhpa", &webhook.Admission{Handler: &federatedhpa.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-cronfederatedhpa", &webhook.Admission{Handler: &cronfederatedhpa.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-resourceinterpretercustomization", &webhook.Admission{Handler: &resourceinterpretercustomization.ValidatingAdmission{Client: hookManager.GetClient(), Decoder: decoder}})
|
|
hookServer.Register("/validate-multiclusteringress", &webhook.Admission{Handler: &multiclusteringress.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-multiclusterservice", &webhook.Admission{Handler: &multiclusterservice.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-multiclusterservice", &webhook.Admission{Handler: &multiclusterservice.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-federatedhpa", &webhook.Admission{Handler: &federatedhpa.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/validate-resourcedeletionprotection", &webhook.Admission{Handler: &resourcedeletionprotection.ValidatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-resourcebinding", &webhook.Admission{Handler: &resourcebinding.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.Register("/mutate-clusterresourcebinding", &webhook.Admission{Handler: &clusterresourcebinding.MutatingAdmission{Decoder: decoder}})
|
|
hookServer.WebhookMux().Handle("/readyz/", http.StripPrefix("/readyz/", &healthz.Handler{}))
|
|
|
|
// blocks until the context is done.
|
|
if err := hookManager.Start(ctx); err != nil {
|
|
klog.Errorf("webhook server exits unexpectedly: %v", err)
|
|
return err
|
|
}
|
|
|
|
// never reach here
|
|
return nil
|
|
}
|