/
m_ingress.go
125 lines (112 loc) · 3.69 KB
/
m_ingress.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
// Copyright 2022 The kubegems.io Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package webhooks
import (
"context"
"encoding/json"
"fmt"
"math/rand"
"net/http"
"strings"
v1 "k8s.io/api/admission/v1"
corev1 "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
"k8s.io/apimachinery/pkg/types"
gemlabels "kubegems.io/kubegems/pkg/apis/gems"
gemsv1beta1 "kubegems.io/kubegems/pkg/apis/gems/v1beta1"
"kubegems.io/kubegems/pkg/apis/networking"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
)
var (
defaultGatewayName = "default-gateway"
notenant = "notenant"
lowercase = []rune("abcdefghijklmnopqrstuvwxyz")
)
func (r *ResourceMutate) MutateIngress(ctx context.Context, req admission.Request) admission.Response {
ingress := &networkingv1.Ingress{}
err := r.decoder.Decode(req, ingress)
if err != nil {
return admission.Errored(http.StatusBadRequest, err)
}
switch req.Operation {
case v1.Create, v1.Update:
// 指定ingressclass的,校验租户网关
ingressClassName := ""
if ingress.Spec.IngressClassName != nil {
ingressClassName = *ingress.Spec.IngressClassName
}
// 默认网关创建
// ingress生成随机域名
var tgs gemsv1beta1.TenantGatewayList
if err := r.Client.List(ctx, &tgs, client.MatchingLabels{
networking.LabelIngressClass: ingressClassName,
}); err != nil {
log.Log.Error(err, "list gateway failed")
return admission.Denied(fmt.Sprintf("list gateway failed: %v", err))
}
// 没找到对应的租户网关,不接管
if len(tgs.Items) == 0 {
log.Log.Info(fmt.Sprintf("no such ingressclass: [%s]", ingressClassName))
return admission.Allowed("pass")
}
for i := range ingress.Spec.Rules {
if ingress.Spec.Rules[i].Host == "" {
ingress.Spec.Rules[i].Host = RandHost(tgs.Items[0].Spec.BaseDomain)
}
}
if err := CheckGatewayAndIngressProtocol(tgs.Items[0], []networkingv1.Ingress{*ingress}); err != nil {
log.Log.Error(err, "ingress and gateway protocol check failed")
return admission.Denied(err.Error())
}
for j := range ingress.Spec.TLS {
if len(ingress.Spec.TLS[j].Hosts) == 0 {
return admission.Denied("ingress tls must specify at least one host")
}
}
if ingress.Labels == nil {
ingress.Labels = make(map[string]string)
}
// ingress打上 ingressClass标签
var ns corev1.Namespace
if err := r.Client.Get(ctx, types.NamespacedName{Name: ingress.Namespace}, &ns); err != nil {
return admission.Denied(err.Error())
}
nslabel := ns.GetLabels()
for _, label := range gemlabels.CommonLabels {
if v, ok := nslabel[label]; ok {
ingress.Labels[label] = v
}
}
ingress.Labels[networking.LabelIngressClass] = ingressClassName
modifyed, _ := json.Marshal(ingress)
return admission.PatchResponseFromRaw(req.Object.Raw, modifyed)
default:
return admission.Allowed("pass")
}
}
func RandHost(old string) string {
tmp := strings.Split(old, ".")
for i := range tmp {
if tmp[i] == "*" {
rands := make([]rune, 5)
for i := range rands {
rands[i] = lowercase[rand.Intn(len(lowercase))]
}
tmp[i] = string(rands)
}
}
return strings.Join(tmp, ".")
}