Add Webhooks for CR's

PROJECT

@@ -12,30 +12,43 @@ resources:
   domain: openshift.io
   group: csiaddons
   kind: CSIAddonsNode
-  path: github.com/csi-addons/kubernetes-csi-addons/api/v1alpha1
+  path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
+  webhooks:
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: openshift.io
   group: csiaddons
   kind: ReclaimSpaceJob
-  path: github.com/csi-addons/kubernetes-csi-addons/api/v1alpha1
+  path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
+  webhooks:
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
   controller: true
   domain: openshift.io
   group: csiaddons
   kind: NetworkFence
-  path: github.com/csi-addons/kubernetes-csi-addons/api/v1alpha1
+  path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
+  webhooks:
+    validation: true
+    webhookVersion: v1
 - controller: true
   domain: openshift.io
   group: csiaddons
   kind: ReclaimSpaceCronJob
+  path: github.com/csi-addons/kubernetes-csi-addons/apis/csiaddons/v1alpha1
   version: v1alpha1
+  webhooks:
+    validation: true
+    webhookVersion: v1
 - controller: true
   group: core
   kind: PersistentVolumeClaim

apis/csiaddons/v1alpha1/csiaddonsnode_webhook.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2022 The Kubernetes-CSI-Addons Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"errors"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+)
+
+// log is for logging in this package.
+var csnLog = logf.Log.WithName("csiaddonsnode-webhook")
+
+func (c *CSIAddonsNode) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(c).
+		Complete()
+}
+
+//+kubebuilder:webhook:path=/validate-csiaddons-openshift-io-v1alpha1-csiaddonsnode,mutating=false,failurePolicy=fail,sideEffects=None,groups=csiaddons.openshift.io,resources=csiaddonsnodes,verbs=update,versions=v1alpha1,name=vcsiaddonsnode.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &CSIAddonsNode{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (c *CSIAddonsNode) ValidateCreate() error {
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (c *CSIAddonsNode) ValidateUpdate(old runtime.Object) error {
+	csnLog.Info("validate update", "name", c.Name)
+
+	oldCSIAddonsNode, ok := old.(*CSIAddonsNode)
+	if !ok {
+		return errors.New("error casting CSIAddonsNode object")
+	}
+
+	var allErrs field.ErrorList
+
+	if c.Spec.Driver.NodeID != oldCSIAddonsNode.Spec.Driver.NodeID {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "driver", "nodeID"), c.Spec.Driver.NodeID, "nodeID cannot be updated"))
+	}
+
+	if c.Spec.Driver.Name != oldCSIAddonsNode.Spec.Driver.Name {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "driver", "name"), c.Spec.Driver.Name, "name cannot be updated"))
+	}
+
+	if len(allErrs) != 0 {
+		return apierrors.NewInvalid(
+			schema.GroupKind{Group: "csiaddons.openshift.io", Kind: "CSIAddonsNode"},
+			c.Name, allErrs)
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *CSIAddonsNode) ValidateDelete() error {
+	return nil
+}

apis/csiaddons/v1alpha1/networkfence_webhook.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2022 The Kubernetes-CSI-Addons Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"errors"
+	"reflect"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+)
+
+// log is for logging in this package.
+var nfLog = logf.Log.WithName("networkfence-webhook")
+
+func (n *NetworkFence) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(n).
+		Complete()
+}
+
+//+kubebuilder:webhook:path=/validate-csiaddons-openshift-io-v1alpha1-networkfence,mutating=false,failurePolicy=fail,sideEffects=None,groups=csiaddons.openshift.io,resources=networkfences,verbs=update,versions=v1alpha1,name=vnetworkfence.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &NetworkFence{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (n *NetworkFence) ValidateCreate() error {
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (n *NetworkFence) ValidateUpdate(old runtime.Object) error {
+	nfLog.Info("validate update", "name", n.Name)
+
+	oldNetworkFence, ok := old.(*NetworkFence)
+	if !ok {
+		return errors.New("error casting NetworkFence object")
+	}
+
+	var allErrs field.ErrorList
+	if n.Spec.Driver != oldNetworkFence.Spec.Driver {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("driver"), n.Spec.Driver, "driver cannot be changed"))
+	}
+
+	if reflect.DeepEqual(n.Spec.Parameters, oldNetworkFence.Spec.Parameters) {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("parameters"), n.Spec.Parameters, "parameters cannot be changed"))
+	}
+
+	if n.Spec.Secret.Name != oldNetworkFence.Spec.Secret.Name {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "secret", "name"), n.Spec.Secret, "secret name cannot be changed"))
+	}
+
+	if n.Spec.Secret.Namespace != oldNetworkFence.Spec.Secret.Namespace {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "secret", "namespace"), n.Spec.Secret, "secret namespace cannot be changed"))
+	}
+
+	if len(allErrs) != 0 {
+		return apierrors.NewInvalid(
+			schema.GroupKind{Group: "csiaddons.openshift.io", Kind: "NetworkFence"},
+			n.Name, allErrs)
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (n *NetworkFence) ValidateDelete() error {
+	return nil
+}

apis/csiaddons/v1alpha1/reclaimspacecronjob_webhook.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2022 The Kubernetes-CSI-Addons Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"errors"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+)
+
+// log is for logging in this package.
+var rscjLog = logf.Log.WithName("reclaimspacecronjob-webhook")
+
+func (r *ReclaimSpaceCronJob) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+//+kubebuilder:webhook:path=/validate-csiaddons-openshift-io-v1alpha1-reclaimspacecronjob,mutating=false,failurePolicy=fail,sideEffects=None,groups=csiaddons.openshift.io,resources=reclaimspacecronjobs,verbs=update,versions=v1alpha1,name=vreclaimspacecronjob.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &ReclaimSpaceCronJob{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceCronJob) ValidateCreate() error {
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceCronJob) ValidateUpdate(old runtime.Object) error {
+	rsjLog.Info("validate update", "name", r.Name)
+
+	oldReclaimSpaceCronJob, ok := old.(*ReclaimSpaceCronJob)
+	if !ok {
+		return errors.New("error casting ReclaimSpaceCronJob object")
+	}
+
+	var allErrs field.ErrorList
+
+	if r.Spec.JobSpec.Spec.Target.PersistentVolumeClaim != oldReclaimSpaceCronJob.Spec.JobSpec.Spec.Target.PersistentVolumeClaim {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "jobTemplate", "spec", "target", "persistentVolumeClaim"), r.Spec.JobSpec.Spec.Target.PersistentVolumeClaim, "persistentVolumeClaim cannot be changed"))
+	}
+
+	if len(allErrs) != 0 {
+		return apierrors.NewInvalid(
+			schema.GroupKind{Group: "csiaddons.openshift.io", Kind: "ReclaimSpaceCronJob"},
+			r.Name, allErrs)
+	}
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceCronJob) ValidateDelete() error {
+	return nil
+}

apis/csiaddons/v1alpha1/reclaimspacejob_webhook.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2022 The Kubernetes-CSI-Addons Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"errors"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+)
+
+// log is for logging in this package.
+var rsjLog = logf.Log.WithName("reclaimspacejob-webhook")
+
+func (r *ReclaimSpaceJob) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+//+kubebuilder:webhook:path=/validate-csiaddons-openshift-io-v1alpha1-reclaimspacejob,mutating=false,failurePolicy=fail,sideEffects=None,groups=csiaddons.openshift.io,resources=reclaimspacejobs,verbs=update,versions=v1alpha1,name=vreclaimspacejob.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &ReclaimSpaceJob{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceJob) ValidateCreate() error {
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceJob) ValidateUpdate(old runtime.Object) error {
+	rsjLog.Info("validate update", "name", r.Name)
+
+	oldReclaimSpaceJob, ok := old.(*ReclaimSpaceJob)
+	if !ok {
+		return errors.New("error casting ReclaimSpaceJob object")
+	}
+
+	var allErrs field.ErrorList
+
+	if r.Spec.Target.PersistentVolumeClaim != oldReclaimSpaceJob.Spec.Target.PersistentVolumeClaim {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "target", "persistentVolumeClaim"), r.Spec.Target.PersistentVolumeClaim, "persistentVolumeClaim cannot be changed"))
+	}
+
+	if len(allErrs) != 0 {
+		return apierrors.NewInvalid(
+			schema.GroupKind{Group: "csiaddons.openshift.io", Kind: "ReclaimSpaceJob"},
+			r.Name, allErrs)
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *ReclaimSpaceJob) ValidateDelete() error {
+	return nil
+}