kubernetes Admission Controller原理介绍

metadata:
  name: test-net
  annotations:
    initializer.kubernetes.io/lxcfs: "true"   # 就是在pod的metadata里加上这个配置

kubernetes/plugin/pkg/admission/alwayspullimages/admission.go


func (a *AlwaysPullImages) Admit(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
    // 你可以在attibutes里获取到对象的一切信息，用户信息等
  if shouldIgnore(attributes) { // 检查一下是不是你关注的object, 比如创建的一个configmap 那么显然可以忽视
    return nil
  }
  pod, ok := attributes.GetObject().(*api.Pod)


    // 这里把initContainer和Container的拉取策略都给改了
  for i := range pod.Spec.InitContainers {
    pod.Spec.InitContainers[i].ImagePullPolicy = api.PullAlways
  }


  for i := range pod.Spec.Containers {
    pod.Spec.Containers[i].ImagePullPolicy = api.PullAlways
  }


  return nil
}


# 还提供一个校验接口，看是不是真的都已经被改了
func (a *AlwaysPullImages) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  pod, ok := attributes.GetObject().(*api.Pod)
  for i := range pod.Spec.InitContainers {
    if pod.Spec.InitContainers[i].ImagePullPolicy != api.PullAlways {
      return admission.NewForbidden(attributes,
        field.NotSupported(field.NewPath("spec", "initContainers").Index(i).Child("imagePullPolicy"),
          pod.Spec.InitContainers[i].ImagePullPolicy, []string{string(api.PullAlways)},
        ),
      )
    }
  }


    ...

func Register(plugins *admission.Plugins) {
  plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
    return NewAlwaysPullImages(), nil
  })
}


type AlwaysPullImages struct {
  *admission.Handler
}

kubernetes/pkg/kubeapiserver/options/plugins.go


func RegisterAllAdmissionPlugins(plugins *admission.Plugins) {
  imagepolicy.Register(plugins)
    ...
}

const (
    // 特定的json patch格式
  addFirstLabelPatch string = `[
         { "op": "add", "path": "/metadata/labels", "value": {"added-label": "yes"}}
     ]`
  addAdditionalLabelPatch string = `[
         { "op": "add", "path": "/metadata/labels/added-label", "value": "yes" }
     ]`
)


func addLabel(ar v1beta1.AdmissionReview) *v1beta1.AdmissionResponse {
  obj := struct {
    metav1.ObjectMeta
    Data map[string]string
  }{}
  raw := ar.Request.Object.Raw
  err := json.Unmarshal(raw, &obj)
  if err != nil {
    klog.Error(err)
    return toAdmissionResponse(err)
  }


  reviewResponse := v1beta1.AdmissionResponse{}
  reviewResponse.Allowed = true
  if len(obj.ObjectMeta.Labels) == 0 {
    reviewResponse.Patch = []byte(addFirstLabelPatch) // 这里最需要注意的就是修改时是通过patch的方式
  } else {
    reviewResponse.Patch = []byte(addAdditionalLabelPatch)
  }
  pt := v1beta1.PatchTypeJSONPatch
  reviewResponse.PatchType = &pt
  return &reviewResponse

apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: <name of this configuration object>
webhooks:
- name: <webhook name, e.g., pod-policy.example.io>
  rules:                                            # 最好明确一下该hook关心哪些api，防止带来不必要的额外开销。
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: "Namespaced"
  clientConfig:
    service:
      namespace: <namespace of the front-end service>  # webhook server的namespace
      name: <name of the front-end service>            # service name
    caBundle: <pem encoded ca cert that signs the server cert used by the webhook> # 因为需要通过https访问，所以要给apiserver配置ca
  admissionReviewVersions:
  - v1beta1
  timeoutSeconds: 1