mutating_webhook.go

/*
Copyright © 2020 Trendyol Tech

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package k8s

import (
	"context"
	"crypto/x509"
	"encoding/pem"
	"github.com/Trendyol/kubectl-view-webhook/pkg/printer"
	"k8s.io/api/admissionregistration/v1beta1"
	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	typedV1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
	typedCoreV1 "k8s.io/client-go/kubernetes/typed/core/v1"
	"log"
	"time"
)

type WebHookClient struct {
	wClient typedV1beta1.MutatingWebhookConfigurationInterface
	vClient typedV1beta1.ValidatingWebhookConfigurationInterface
	nClient typedCoreV1.NamespaceInterface
	context context.Context
}

// NewWebHookClient constructs a new WebHookClient with the specified output
// of *kubernetes.Clientset
func NewWebHookClient(client *kubernetes.Clientset) *WebHookClient {
	return &WebHookClient{
		wClient: client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations(),
		vClient: client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations(),
		nClient: client.CoreV1().Namespaces(),
		context: context.Background(),
	}
}

type Resource struct {
	Name       string
	Operations []string
}

// Run
func (w *WebHookClient) Run(args []string) (*printer.PrintModel, error) {
	var items []printer.PrintItem

	if len(args) == 1 {
		mutatingWebhookConfigurationList, _ := w.wClient.List(w.context, metaV1.ListOptions{})

		validatingWebhookConfigurationList, _ := w.vClient.List(w.context, metaV1.ListOptions{})

		for _, mwc := range mutatingWebhookConfigurationList.Items {
			w.fillMutatingWebhookConfigurations(mwc, &items)
		}
		for _, mwc := range validatingWebhookConfigurationList.Items {
			w.fillValidatingWebhookConfigurations(mwc, &items)
		}
	} else {
		mutatingWebhookConfiguration, _ := w.wClient.Get(w.context, args[1], metaV1.GetOptions{})

		validatingWebhookConfiguration, _ := w.vClient.Get(w.context, args[1], metaV1.GetOptions{})

		w.fillMutatingWebhookConfigurations(*mutatingWebhookConfiguration, &items)
		w.fillValidatingWebhookConfigurations(*validatingWebhookConfiguration, &items)
	}

	return &printer.PrintModel{
		Items: items,
	}, nil
}

func (w *WebHookClient) fillMutatingWebhookConfigurations(mwc v1beta1.MutatingWebhookConfiguration, items *[]printer.PrintItem) {
	item := printer.PrintItem{
		Kind: "Mutating",
		Name: mwc.Name, //TODO: typeMeta nil
	}

	for _, webhook := range mwc.Webhooks {
		var activeNamespaces []string
		w.fillActiveNamespacesForMutating(webhook, &activeNamespaces)

		webhookItem := printer.PrintWebhookItem{
			Name: webhook.Name,
		}

		if webhook.ClientConfig.Service != nil {
			webhookItem.ServiceName = webhook.ClientConfig.Service.Name
			webhookItem.ServiceNamespace = webhook.ClientConfig.Service.Namespace
			webhookItem.ServicePath = webhook.ClientConfig.Service.Path
			webhookItem.ServicePort = webhook.ClientConfig.Service.Port
		}

		item.Webhook = webhookItem
		resources := w.fillRulesForMutating(webhook)

		item.ResourceModels = resources
		item.ValidUntil = retrieveValidDateCount(webhook.ClientConfig.CABundle)
		item.ActiveNamespaces = activeNamespaces
		*items = append(*items, item)
	}
}
func (w *WebHookClient) fillValidatingWebhookConfigurations(mwc v1beta1.ValidatingWebhookConfiguration, items *[]printer.PrintItem) {
	item := printer.PrintItem{
		Kind: "Validating",
		Name: mwc.Name, //TODO: typeMeta nil
	}

	for _, webhook := range mwc.Webhooks {
		var activeNamespaces []string
		w.fillActiveNamespacesForValidating(webhook, &activeNamespaces)

		webhookItem := printer.PrintWebhookItem{
			Name: webhook.Name,
		}

		if webhook.ClientConfig.Service != nil {
			webhookItem.ServiceName = webhook.ClientConfig.Service.Name
			webhookItem.ServiceNamespace = webhook.ClientConfig.Service.Namespace
			webhookItem.ServicePath = webhook.ClientConfig.Service.Path
			webhookItem.ServicePort = webhook.ClientConfig.Service.Port
		}

		resources := w.fillRulesForValidating(webhook)

		item.ResourceModels = resources
		item.ValidUntil = retrieveValidDateCount(webhook.ClientConfig.CABundle)
		item.ActiveNamespaces = activeNamespaces
		*items = append(*items, item)
	}
}
func (w *WebHookClient) fillRulesForMutating(webhook v1beta1.MutatingWebhook) []printer.ResourceModel {
	var resources []printer.ResourceModel

	for _, rule := range webhook.Rules {
		var ops, rs []string

		for _, op := range rule.Operations {
			ops = append(ops, string(op))
		}

		rs = append(rs, rule.Resources...)

		resources = append(resources, printer.ResourceModel{
			Operations: ops,
			Resources:  rs,
		})
	}
	return resources
}
func (w *WebHookClient) fillRulesForValidating(webhook v1beta1.ValidatingWebhook) []printer.ResourceModel {
	var resources []printer.ResourceModel
	var ops, rs []string
	for _, rule := range webhook.Rules {

		for _, op := range rule.Operations {
			ops = append(rs, string(op))
		}

		rs = append(rs, rule.Resources...)

		resources = append(resources, printer.ResourceModel{
			Operations: ops,
			Resources:  rs,
		})
	}
	return resources
}
func (w *WebHookClient) fillActiveNamespacesForMutating(webhook v1beta1.MutatingWebhook, activeNamespaces *[]string) {
	if webhook.NamespaceSelector != nil {
		ncList, _ := w.nClient.List(w.context, metaV1.ListOptions{})

		if ncList != nil {
			for _, ns := range ncList.Items {
				available := false
				for k, v := range webhook.NamespaceSelector.MatchLabels {
					if ns.Labels[k] == v {
						available = true
					}
				}
				if available {
					*activeNamespaces = append(*activeNamespaces, ns.Name)
				}
			}
		}
	}
}
func (w *WebHookClient) fillActiveNamespacesForValidating(webhook v1beta1.ValidatingWebhook, activeNamespaces *[]string) {
	if webhook.NamespaceSelector != nil {
		ncList, _ := w.nClient.List(w.context, metaV1.ListOptions{})

		if ncList != nil {
			for _, ns := range ncList.Items {
				available := false
				for k, v := range webhook.NamespaceSelector.MatchLabels {
					if ns.Labels[k] == v {
						available = true
					}
				}
				if available {
					*activeNamespaces = append(*activeNamespaces, ns.Name)
				}
			}
		}
	}
}

//retrieveValidDateCount returns remaining time of the given
//webhook's CABundle certificate.
func retrieveValidDateCount(certificate []byte) time.Duration {
	block, _ := pem.Decode(certificate)
	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		log.Fatalf("x509.ParseCertificate - error occurred, detail: %v", err)
	}
	return time.Until(cert.NotAfter)
}