Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not block pod creating on internal error in webhook #811

Merged
merged 5 commits into from
Apr 25, 2022
Merged

Do not block pod creating on internal error in webhook #811

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
011c5a9
Do not block pod creating on internal error
pavolloffay Apr 6, 2022
a729b12
Fix
pavolloffay Apr 6, 2022
84082e2
Fix
pavolloffay Apr 7, 2022
c8167a8
Add more docs
pavolloffay Apr 14, 2022
a0f168d
Fix
pavolloffay Apr 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions internal/webhookhandler/webhookhandler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,19 +78,27 @@ func (p *podSidecarInjector) Handle(ctx context.Context, req admission.Request)
ns := corev1.Namespace{}
err = p.client.Get(ctx, types.NamespacedName{Name: req.Namespace, Namespace: ""}, &ns)
if err != nil {
return admission.Errored(http.StatusInternalServerError, err)
res := admission.Errored(http.StatusInternalServerError, err)
// By default, admission.Errored sets Allowed to false which blocks pod creation even though the failurePolicy=ignore.
// Allowed set to true makes sure failure does not block pod creation in case of an error.
res.Allowed = true
pavolloffay marked this conversation as resolved.
Show resolved Hide resolved
return res
}

for _, m := range p.podMutators {
pod, err = m.Mutate(ctx, ns, pod)
if err != nil {
return admission.Errored(http.StatusInternalServerError, err)
res := admission.Errored(http.StatusInternalServerError, err)
res.Allowed = true
return res
jpkrohling marked this conversation as resolved.
Show resolved Hide resolved
}
}

marshaledPod, err := json.Marshal(pod)
if err != nil {
return admission.Errored(http.StatusInternalServerError, err)
res := admission.Errored(http.StatusInternalServerError, err)
res.Allowed = true
return res
}
return admission.PatchResponseFromRaw(req.Object.Raw, marshaledPod)
}
Expand Down
17 changes: 10 additions & 7 deletions internal/webhookhandler/webhookhandler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,15 +403,17 @@ func TestFailOnInvalidRequest(t *testing.T) {
name string
req admission.Request
expected int32
allowed bool
}{
{
"empty payload",
admission.Request{},
http.StatusBadRequest,
name: "empty payload",
req: admission.Request{},
expected: http.StatusBadRequest,
allowed: false,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now the webhook fails the pod creation only if it cannot decode the request, which should not happen in practice.

},
{
"namespace doesn't exist",
func() admission.Request {
name: "namespace doesn't exist",
req: func() admission.Request {
pod := corev1.Pod{}
encoded, err := json.Marshal(pod)
require.NoError(t, err)
Expand All @@ -425,7 +427,8 @@ func TestFailOnInvalidRequest(t *testing.T) {
},
}
}(),
http.StatusInternalServerError,
expected: http.StatusInternalServerError,
allowed: true,
},
} {
t.Run(tt.name, func(t *testing.T) {
Expand All @@ -442,7 +445,7 @@ func TestFailOnInvalidRequest(t *testing.T) {
res := injector.Handle(context.Background(), tt.req)

// verify
assert.False(t, res.Allowed)
assert.Equal(t, tt.allowed, res.Allowed)
assert.NotNil(t, res.AdmissionResponse.Result)
assert.Equal(t, tt.expected, res.AdmissionResponse.Result.Code)
})
Expand Down