Handle storageClassName specified by StatefulSet's volumeClaimTemplates

[flavio]

Currently this policy inspects the creation/update of PersistentVolumeClass objects to prevent the usage of certain storage classes.

The StatefulSet Kubernetes resource has a spec.volumeClaimTemplates attribute which holds a list of PersistentVolumeClaim objects.

The policy should be extended to be able to inspect also StatefulSet resources.

Basically, inside of its validate, the policy should look at what kind of object is the subject of the admission request. If that's a PVC, the current code is going to used, otherwise, if it's a StatefulSet, the new code will be handled.

The configuration of the policy is not going to be changed.

Examples

Given the following configuration

# the list of storage classes that cannot be used
deniedStorageClasses:
- fast
- nvme

The following StatefulSet request is going to be accepted:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "cheap"
      resources:
        requests:
          storage: 1Gi

While the following one is going to be rejected:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
        - name: uploads
          mountPath: /usr/share/nginx/uploads
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "cheap"
      resources:
        requests:
          storage: 1Gi
  - uploads:
      name: uploads
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "fast"
      resources:
        requests:
          storage: 1Gi

Mutation

Given the following configuration:

# the list of storage classes that cannot be used
deniedStorageClasses:
- fast
- nvme

# optional - the storage class to be used when a denied is requested
fallbackStorageClass: cheap

The following StatefulSet definition:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
        - name: uploads
          mountPath: /usr/share/nginx/uploads
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "cheap"
      resources:
        requests:
          storage: 1Gi
  - uploads:
      name: uploads
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "fast"
      resources:
        requests:
          storage: 1Gi

Is going to be accepted, but it will be mutated to create this object:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
        - name: uploads
          mountPath: /usr/share/nginx/uploads
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "cheap"
      resources:
        requests:
          storage: 1Gi
  - uploads:
      name: uploads
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "cheap"
      resources:
        requests:
          storage: 1Gi