-
Notifications
You must be signed in to change notification settings - Fork 55
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Xieshen Zhang <[email protected]>
- Loading branch information
Showing
8 changed files
with
529 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| package webhook | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "reflect" | ||
|
|
||
| nimv1 "github.com/opendatahub-io/odh-model-controller/api/nim/v1" | ||
|
|
||
| v1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/api/errors" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| "k8s.io/apimachinery/pkg/types" | ||
| "k8s.io/apimachinery/pkg/util/validation/field" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| logf "sigs.k8s.io/controller-runtime/pkg/log" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| ) | ||
|
|
||
| // +kubebuilder:webhook:admissionReviewVersions=v1,path=/validate-nim-opendatahub-io-v1-account,mutating=false,failurePolicy=fail,groups=nim.opendatahub.io,resources=accounts,verbs=create;update,versions=v1,name=validating.nim.account.odh-model-controller.opendatahub.io,sideEffects=None | ||
|
|
||
| type nimAccountValidator struct { | ||
| client client.Client | ||
| } | ||
|
|
||
| func NewNimAccountValidator(client client.Client) admission.CustomValidator { | ||
| return &nimAccountValidator{client: client} | ||
| } | ||
|
|
||
| func (v *nimAccountValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (warnings admission.Warnings, err error) { | ||
| log := logf.FromContext(ctx).WithName("NIMAccountValidatingWebhook") | ||
|
|
||
| account := obj.(*nimv1.Account) | ||
|
|
||
| log = log.WithValues("namespace", account.Namespace, "account", account.Name) | ||
| log.Info("Validating NIM Account creation") | ||
|
|
||
| err = v.verifySingletonInNamespace(ctx, account) | ||
| if err != nil { | ||
| log.Error(err, "Rejecting NIM Account creation because checking singleton didn't pass") | ||
| return nil, err | ||
| } | ||
|
|
||
| err = v.verifyAPIKeySecret(ctx, nil, account) | ||
| if err != nil { | ||
| log.Error(err, "Rejecting NIM Account creation because checking API key Secret didn't pass") | ||
| return nil, err | ||
| } | ||
|
|
||
| return nil, nil | ||
| } | ||
|
|
||
| func (v *nimAccountValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (warnings admission.Warnings, err error) { | ||
| log := logf.FromContext(ctx).WithName("NIMAccountValidatingWebhook") | ||
|
|
||
| account := newObj.(*nimv1.Account) | ||
|
|
||
| log = log.WithValues("namespace", account.Namespace, "account", account.Name) | ||
| log.Info("Validating NIM Account update") | ||
|
|
||
| err = v.verifyAPIKeySecret(ctx, oldObj.(*nimv1.Account), account) | ||
| if err != nil { | ||
| log.Error(err, "Rejecting NIM Account update because checking API key Secret didn't pass") | ||
| return nil, err | ||
| } | ||
|
|
||
| return nil, nil | ||
| } | ||
|
|
||
| func (v *nimAccountValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (warnings admission.Warnings, err error) { | ||
| // For deletion, nothing needs to be validated | ||
| return nil, nil | ||
| } | ||
|
|
||
| func (v *nimAccountValidator) verifyAPIKeySecret(ctx context.Context, oldAccount, newAccount *nimv1.Account) error { | ||
| if oldAccount == nil || !reflect.DeepEqual(oldAccount.Spec.APIKeySecret, newAccount.Spec.APIKeySecret) { | ||
| if newAccount.Spec.APIKeySecret.Name == "" { | ||
| msg := "name of the Secret for the API key is invalid" | ||
| return field.Invalid(field.NewPath("spec").Child("apiKeySecret").Child("name"), newAccount.Spec.APIKeySecret.Name, msg) | ||
| } | ||
| name := newAccount.Spec.APIKeySecret.Name | ||
| namespace := newAccount.Spec.APIKeySecret.Namespace | ||
| if namespace == "" { | ||
| namespace = newAccount.Namespace | ||
| } | ||
|
|
||
| err := v.client.Get(ctx, | ||
| types.NamespacedName{ | ||
| Name: name, | ||
| Namespace: namespace, | ||
| }, | ||
| &v1.Secret{}) | ||
| if err != nil { | ||
| if errors.IsNotFound(err) { | ||
| msg := "Secret for the API key cannot be found" | ||
| return field.Invalid(field.NewPath("spec").Child("apiKeySecret").Child("name"), newAccount.Spec.APIKeySecret.Name, msg) | ||
| } else { | ||
| return fmt.Errorf("failed to verify the API key Secret with err: %s", err.Error()) | ||
| } | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (v *nimAccountValidator) verifySingletonInNamespace(ctx context.Context, account *nimv1.Account) error { | ||
| accountList := nimv1.AccountList{} | ||
| err := v.client.List(ctx, | ||
| &accountList, | ||
| client.InNamespace(account.Namespace)) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to verify if there are existing Accounts with err: %s", err.Error()) | ||
| } | ||
|
|
||
| if len(accountList.Items) > 0 { | ||
| return fmt.Errorf("rejecting creation of Account %s in namespace %s because there is already an Account created in the namespace", account.Name, account.Namespace) | ||
| } | ||
| return nil | ||
| } |
Oops, something went wrong.