Skip to content
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
156 lines (129 sloc) 5.29 KB
Copyright (c) 2019 StackRox Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.
package main
import (
metav1 ""
const (
jsonContentType = `application/json`
var (
universalDeserializer = serializer.NewCodecFactory(runtime.NewScheme()).UniversalDeserializer()
// patchOperation is an operation of a JSON patch, see .
type patchOperation struct {
Op string `json:"op"`
Path string `json:"path"`
Value interface{} `json:"value,omitempty"`
// admitFunc is a callback for admission controller logic. Given an AdmissionRequest, it returns the sequence of patch
// operations to be applied in case of success, or the error that will be shown when the operation is rejected.
type admitFunc func(*v1beta1.AdmissionRequest) ([]patchOperation, error)
// isKubeNamespace checks if the given namespace is a Kubernetes-owned namespace.
func isKubeNamespace(ns string) bool {
return ns == metav1.NamespacePublic || ns == metav1.NamespaceSystem
// doServeAdmitFunc parses the HTTP request for an admission controller webhook, and -- in case of a well-formed
// request -- delegates the admission control logic to the given admitFunc. The response body is then returned as raw
// bytes.
func doServeAdmitFunc(w http.ResponseWriter, r *http.Request, admit admitFunc) ([]byte, error) {
// Step 1: Request validation. Only handle POST requests with a body and json content type.
if r.Method != http.MethodPost {
return nil, fmt.Errorf("invalid method %s, only POST requests are allowed", r.Method)
body, err := ioutil.ReadAll(r.Body)
if err != nil {
return nil, fmt.Errorf("could not read request body: %v", err)
if contentType := r.Header.Get("Content-Type"); contentType != jsonContentType {
return nil, fmt.Errorf("unsupported content type %s, only %s is supported", contentType, jsonContentType)
// Step 2: Parse the AdmissionReview request.
var admissionReviewReq v1beta1.AdmissionReview
if _, _, err := universalDeserializer.Decode(body, nil, &admissionReviewReq); err != nil {
return nil, fmt.Errorf("could not deserialize request: %v", err)
} else if admissionReviewReq.Request == nil {
return nil, errors.New("malformed admission review: request is nil")
// Step 3: Construct the AdmissionReview response.
admissionReviewResponse := v1beta1.AdmissionReview{
Response: &v1beta1.AdmissionResponse{
UID: admissionReviewReq.Request.UID,
var patchOps []patchOperation
// Apply the admit() function only for non-Kubernetes namespaces. For objects in Kubernetes namespaces, return
// an empty set of patch operations.
if !isKubeNamespace(admissionReviewReq.Request.Namespace) {
patchOps, err = admit(admissionReviewReq.Request)
if err != nil {
// If the handler returned an error, incorporate the error message into the response and deny the object
// creation.
admissionReviewResponse.Response.Allowed = false
admissionReviewResponse.Response.Result = &metav1.Status{
Message: err.Error(),
} else {
// Otherwise, encode the patch operations to JSON and return a positive response.
patchBytes, err := json.Marshal(patchOps)
if err != nil {
return nil, fmt.Errorf("could not marshal JSON patch: %v", err)
admissionReviewResponse.Response.Allowed = true
admissionReviewResponse.Response.Patch = patchBytes
// Return the AdmissionReview with a response as JSON.
bytes, err := json.Marshal(&admissionReviewResponse)
if err != nil {
return nil, fmt.Errorf("marshaling response: %v", err)
return bytes, nil
// serveAdmitFunc is a wrapper around doServeAdmitFunc that adds error handling and logging.
func serveAdmitFunc(w http.ResponseWriter, r *http.Request, admit admitFunc) {
log.Print("Handling webhook request ...")
var writeErr error
if bytes, err := doServeAdmitFunc(w, r, admit); err != nil {
log.Printf("Error handling webhook request: %v", err)
_, writeErr = w.Write([]byte(err.Error()))
} else {
log.Print("Webhook request handled successfully")
_, writeErr = w.Write(bytes)
if writeErr != nil {
log.Printf("Could not write response: %v", writeErr)
// admitFuncHandler takes an admitFunc and wraps it into a http.Handler by means of calling serveAdmitFunc.
func admitFuncHandler(admit admitFunc) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
serveAdmitFunc(w, r, admit)
You can’t perform that action at this time.