feat(platform): support validate platform cluster (#2056)

cmd/tke-platform-controller/app/run.go

@@ -27,6 +27,7 @@ import (
 	"k8s.io/apiserver/pkg/server/healthz"
 	"tkestack.io/tke/api/platform"
 	"tkestack.io/tke/cmd/tke-platform-controller/app/config"
+	"tkestack.io/tke/cmd/tke-platform-controller/app/webhook"
 	"tkestack.io/tke/pkg/controller"
 	clusterprovider "tkestack.io/tke/pkg/platform/provider/cluster"
 	machineprovider "tkestack.io/tke/pkg/platform/provider/machine"
@@ -52,6 +53,9 @@ func Run(cfg *config.Config, stopCh <-chan struct{}) error {
 	// Start the controller manager HTTP server
 	// serverMux is the handler for these controller *after* authn/authz filters have been applied
 	serverMux := controller.NewBaseHandler(&cfg.Component.Debugging, checks...)
+	if cfg.ClusterController.IsCRDMode {
+		serverMux.HandleFunc("/validate", webhook.Validate)
+	}
 	handler := controller.BuildHandlerChain(serverMux, &cfg.Authorization, &cfg.Authentication, platform.Codecs)
 	if _, err := cfg.SecureServing.Serve(handler, 0, stopCh); err != nil {
 		return err

cmd/tke-platform-controller/app/webhook/validate.go

@@ -0,0 +1,153 @@
+package webhook
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+
+	"k8s.io/api/admission/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	platform "tkestack.io/tke/api/platform"
+	platformv1 "tkestack.io/tke/api/platform/v1"
+	"tkestack.io/tke/api/platform/validation"
+	"tkestack.io/tke/pkg/platform/types"
+)
+
+var (
+	runtimeScheme = runtime.NewScheme()
+	codecs        = serializer.NewCodecFactory(runtimeScheme)
+	deserializer  = codecs.UniversalDeserializer()
+)
+
+func init() {
+	_ = v1.AddToScheme(runtimeScheme)
+}
+
+func Validate(reponseWriter http.ResponseWriter, request *http.Request) {
+	var body []byte
+	var err error
+	if request.Body != nil {
+		if body, err = ioutil.ReadAll(request.Body); err != nil {
+			http.Error(reponseWriter, fmt.Sprintf("request body read failed, err: %v", err), http.StatusBadRequest)
+			return
+		}
+		if len(body) == 0 {
+			http.Error(reponseWriter, "request body length 0", http.StatusBadRequest)
+			return
+		}
+	} else {
+		http.Error(reponseWriter, "request body nil", http.StatusBadRequest)
+		return
+	}
+
+	contentType := request.Header.Get("Content-Type")
+	if contentType != "application/json" {
+		http.Error(reponseWriter, fmt.Sprintf("Content-Type=%s, expect `application/json`", contentType), http.StatusUnsupportedMediaType)
+		return
+	}
+
+	admissionReview := v1.AdmissionReview{}
+	if _, _, err := deserializer.Decode(body, nil, &admissionReview); err != nil {
+		http.Error(reponseWriter, fmt.Sprintf("decode request body to admission review failed, err: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	var admissionResponse *v1.AdmissionResponse
+	switch admissionReview.Request.Kind.Kind {
+	case "Cluster":
+		v1Cluster := platformv1.Cluster{}
+		if err := json.Unmarshal(admissionReview.Request.Object.Raw, &v1Cluster); err != nil {
+			http.Error(reponseWriter, fmt.Sprintf("Can't unmarshal cluster, err: %v", err), http.StatusInternalServerError)
+			return
+		}
+
+		cluster := platform.Cluster{}
+		if err = platformv1.Convert_v1_Cluster_To_platform_Cluster(&v1Cluster, &cluster, nil); err != nil {
+			http.Error(reponseWriter, fmt.Sprintf("Can't convert v1cluster to cluster, err: %v", err), http.StatusInternalServerError)
+			return
+		}
+
+		if admissionReview.Request.Operation == v1.Create {
+			admissionResponse = ValidateCluster(&cluster)
+		}
+		if admissionReview.Request.Operation == v1.Update {
+			oldCluster := platform.Cluster{}
+			if err := json.Unmarshal(admissionReview.Request.Object.Raw, &oldCluster); err != nil {
+				http.Error(reponseWriter, fmt.Sprintf("Can't unmarshal cluster, err: %v", err), http.StatusInternalServerError)
+				return
+			}
+			admissionResponse = ValidateClusterUpdate(&cluster, &oldCluster)
+		}
+	default:
+		http.Error(reponseWriter, fmt.Sprintf("Can't recognized request kind %v", admissionReview.Request.Kind), http.StatusBadRequest)
+		return
+	}
+
+	admissionReview.Response = admissionResponse
+	admissionReview.Response.UID = admissionReview.Request.UID
+
+	admissionReviewBytes, err := json.Marshal(admissionReview)
+	if err != nil {
+		http.Error(reponseWriter, fmt.Sprintf("Can't encode response: %v", err), http.StatusInternalServerError)
+		return
+	}
+	if _, err := reponseWriter.Write(admissionReviewBytes); err != nil {
+		http.Error(reponseWriter, fmt.Sprintf("Can't write response: %v", err), http.StatusInternalServerError)
+		return
+	}
+}
+
+func ValidateCluster(cluster *platform.Cluster) *v1.AdmissionResponse {
+	typeCluster := types.Cluster{
+		Cluster: cluster,
+	}
+	errorList := validation.ValidateCluster(&typeCluster)
+	if len(errorList) == 0 {
+		return &v1.AdmissionResponse{
+			Allowed: true,
+		}
+	}
+	return transferErrorList(&errorList, fmt.Sprintf("cluster %s create validate failed", cluster.Name))
+}
+
+func ValidateClusterUpdate(cluster *platform.Cluster, oldCluster *platform.Cluster) *v1.AdmissionResponse {
+	typeCluster := types.Cluster{
+		Cluster: cluster,
+	}
+	oldTypeCluster := types.Cluster{
+		Cluster: oldCluster,
+	}
+	errorList := validation.ValidateClusterUpdate(&typeCluster, &oldTypeCluster)
+	if len(errorList) == 0 {
+		return &v1.AdmissionResponse{
+			Allowed: true,
+		}
+	}
+	return transferErrorList(&errorList, fmt.Sprintf("cluster %s update validate failed", oldCluster.Name))
+}
+
+func transferErrorList(errorList *field.ErrorList, failedMessage string) *v1.AdmissionResponse {
+	causes := make([]metav1.StatusCause, 0)
+	for _, validateError := range *errorList {
+		cause := metav1.StatusCause{
+			Type:    metav1.CauseType(validateError.Type),
+			Message: validateError.Detail,
+			Field:   validateError.Field,
+		}
+		causes = append(causes, cause)
+	}
+	return &v1.AdmissionResponse{
+		Allowed: false,
+		Result: &metav1.Status{
+			Code:    400,
+			Message: failedMessage,
+			Details: &metav1.StatusDetails{
+				Causes: causes,
+			},
+		},
+	}
+}