linkerd2/controller/webhook/server.go

154 lines
3.9 KiB
Go

package webhook
import (
"context"
"crypto/tls"
"encoding/json"
"fmt"
"io/ioutil"
"net/http"
"github.com/linkerd/linkerd2/controller/k8s"
pkgTls "github.com/linkerd/linkerd2/pkg/tls"
log "github.com/sirupsen/logrus"
admissionv1beta1 "k8s.io/api/admission/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"sigs.k8s.io/yaml"
)
type handlerFunc func(*k8s.API, *admissionv1beta1.AdmissionRequest) (*admissionv1beta1.AdmissionResponse, error)
// Server describes the https server implementing the webhook
type Server struct {
*http.Server
api *k8s.API
handler handlerFunc
controllerNamespace string
}
// NewServer returns a new instance of Server
func NewServer(api *k8s.API, addr, name, controllerNamespace string, rootCA *pkgTls.CA, handler handlerFunc) (*Server, error) {
c, err := tlsConfig(rootCA, name, controllerNamespace)
if err != nil {
return nil, err
}
server := &http.Server{
Addr: addr,
TLSConfig: c,
}
s := &Server{server, api, handler, controllerNamespace}
s.Handler = http.HandlerFunc(s.serve)
return s, nil
}
// Start starts the https server
func (s *Server) Start() {
log.Infof("listening at %s", s.Server.Addr)
if err := s.ListenAndServeTLS("", ""); err != nil {
if err == http.ErrServerClosed {
return
}
log.Fatal(err)
}
}
func (s *Server) serve(res http.ResponseWriter, req *http.Request) {
var (
data []byte
err error
)
if req.Body != nil {
data, err = ioutil.ReadAll(req.Body)
if err != nil {
http.Error(res, err.Error(), http.StatusInternalServerError)
return
}
}
if len(data) == 0 {
log.Warn("received empty payload")
return
}
response := s.processReq(data)
responseJSON, err := json.Marshal(response)
if err != nil {
http.Error(res, err.Error(), http.StatusInternalServerError)
return
}
if _, err := res.Write(responseJSON); err != nil {
http.Error(res, err.Error(), http.StatusInternalServerError)
return
}
}
func (s *Server) processReq(data []byte) *admissionv1beta1.AdmissionReview {
admissionReview, err := decode(data)
if err != nil {
log.Errorf("failed to decode data. Reason: %s", err)
admissionReview.Response = &admissionv1beta1.AdmissionResponse{
UID: admissionReview.Request.UID,
Allowed: false,
Result: &metav1.Status{
Message: err.Error(),
},
}
return admissionReview
}
log.Infof("received admission review request %s", admissionReview.Request.UID)
log.Debugf("admission request: %+v", admissionReview.Request)
admissionResponse, err := s.handler(s.api, admissionReview.Request)
if err != nil {
log.Error("failed to inject sidecar. Reason: ", err)
admissionReview.Response = &admissionv1beta1.AdmissionResponse{
UID: admissionReview.Request.UID,
Allowed: false,
Result: &metav1.Status{
Message: err.Error(),
},
}
return admissionReview
}
admissionReview.Response = admissionResponse
return admissionReview
}
// Shutdown initiates a graceful shutdown of the underlying HTTP server.
func (s *Server) Shutdown(ctx context.Context) error {
return s.Server.Shutdown(ctx)
}
func tlsConfig(rootCA *pkgTls.CA, name, controllerNamespace string) (*tls.Config, error) {
// must use the service short name in this TLS identity as the k8s api server
// looks for the webhook at <svc_name>.<namespace>.svc, without the cluster
// domain.
dnsName := fmt.Sprintf("%s.%s.svc", name, controllerNamespace)
cred, err := rootCA.GenerateEndEntityCred(dnsName)
if err != nil {
return nil, err
}
certPEM := cred.EncodePEM()
keyPEM := cred.EncodePrivateKeyPEM()
cert, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM))
if err != nil {
return nil, err
}
return &tls.Config{
Certificates: []tls.Certificate{cert},
}, nil
}
func decode(data []byte) (*admissionv1beta1.AdmissionReview, error) {
var admissionReview admissionv1beta1.AdmissionReview
err := yaml.Unmarshal(data, &admissionReview)
return &admissionReview, err
}