webhook: support validation rules #2885
Conversation
| # request.object.kind == "Ingress" && | ||
| # has(request.object.metadata.annotations) && | ||
| # request.object.metadata.annotations["zalando.org/skipper-filter"] != "" && | ||
| # eskipParseFilters(request.object.metadata.annotations["zalando.org/skipper-filter"]) |
There was a problem hiding this comment.
TODO: expose eskip.ParseFilters as eskipParseFilters in CEL environment.
| - reject: Missing application label, see https://example.test/reference/labels-selectors/#application | ||
| when: | | ||
| request.kind.kind in ["Ingress", "RouteGroup"] && ( | ||
| !has(request.object.metadata.labels) || | ||
| !has(request.object.metadata.labels.application) || | ||
| request.object.metadata.labels.application == '' | ||
| ) |
There was a problem hiding this comment.
We may also implement
rules:
- warning: Feature X will be deprecated
when: request.kind.kind == "RouteGroup" && ...
that would allow request with warnings, see 9281783
|
I would assume that you would share pros and cons and why it's better than what we have today. |
This approach allows skipper operator to define custom rules that may be specific to a given setup or contain sensitive bits. Alternative is to deploy closed-source webhook written in go.
Its possible, see TODO comment #2885 (comment), I decided not to invest into it until we decide to move forward with this (or abandon the idea). |
AlexanderYastrebov
force-pushed
the
webhook/validation-rules
branch
2 times, most recently
from
90dbd9d to
99e05b3
Compare
AlexanderYastrebov
added
the
major
AlexanderYastrebov
force-pushed
the
webhook/validation-rules
branch
6 times, most recently
from
b2a5214 to
f34f663
Compare
Add new webhook admitter that evaluates Ingresses and RouteGroups against a set of rules. The implementation uses [Common Expression Language](https://github.com/google/cel-spec) to match properties which is also used in [Kubernetes](https://kubernetes.io/docs/reference/using-api/cel/). This is similar to work-in-progress Kubernets feature https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/#validation-expression Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
AlexanderYastrebov
force-pushed
the
webhook/validation-rules
branch
from
f34f663 to
2cdb806
Compare
Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
AlexanderYastrebov
force-pushed
the
webhook/validation-rules
branch
from
2cdb806 to
0fad68f
Compare
Add new webhook admitter that evaluates Ingresses and RouteGroups against a set of rules.
Each rule defines properties of matching resource and rejection message.
The implementation uses Common Expression Language to match properties which is also used in Kubernetes.