Documentation
¶
Overview ¶
Package webhook implements the runeward admission webhook enforcing ClusterPolicy defaults and guardrails on Sandbox and Fleet resources. The decision logic (Decide) is a pure function over a policy snapshot; Server wires it to the Kubernetes AdmissionReview contract.
Index ¶
- func Decide(policies []Policy, namespace string, labels map[string]string, ...) (allowed bool, mutatedProfile string, reason string)
- func GenerateCert(dnsNames []string) (certPEM, keyPEM, caPEM []byte, err error)
- func LoadOrCreateCert(ctx context.Context, client kubernetes.Interface, namespace, secretName string, ...) (certPEM, keyPEM, caPEM []byte, err error)
- func Register(ctx context.Context, clientset kubernetes.Interface, caPEM []byte, ...) error
- type Policy
- type Server
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Decide ¶
func Decide(policies []Policy, namespace string, labels map[string]string, profileName string) (allowed bool, mutatedProfile string, reason string)
Decide evaluates an admission request against every policy. If profileName is empty, the first policy with a DefaultProfile supplies it; the effective profile, namespace, and labels are then validated, first violation wins. mutatedProfile always reflects the effective profile, so the caller applies it when it differs from the incoming profileName.
func GenerateCert ¶
GenerateCert mints an ECDSA CA plus a leaf serving certificate for the supplied DNS names (typically <svc>.<ns>.svc and <svc>.<ns>.svc.cluster.local) and returns PEM blocks: leaf cert, leaf key, and the CA cert to publish in the webhook caBundle.
func LoadOrCreateCert ¶
func LoadOrCreateCert(ctx context.Context, client kubernetes.Interface, namespace, secretName string, dnsNames []string) (certPEM, keyPEM, caPEM []byte, err error)
LoadOrCreateCert returns a serving certificate that is stable across restarts and shared by every webhook replica. It reads the named Secret; if the Secret already holds a complete cert it is reused, otherwise a fresh cert is generated and stored. On a create race (another replica won), the winner's Secret is read back, so all replicas converge on one CA — which is what makes running more than one replica behind the Service safe.
When client is nil (no cluster access) it falls back to an ephemeral, in-memory cert, preserving the previous single-process behavior.
func Register ¶
func Register(ctx context.Context, clientset kubernetes.Interface, caPEM []byte, service, namespace string) error
Register upserts the validating and mutating webhook configurations that route Sandbox/Fleet admission to the given Service. caPEM is published as each webhook's caBundle so the API server trusts the self-signed serving certificate.
Types ¶
type Policy ¶
type Policy struct {
AllowedProfiles []string
DeniedProfiles []string
AllowedNamespaces []string
// RequiredLabels are label keys that must be present on the resource.
RequiredLabels []string
// DefaultProfile is applied (mutating) when spec.profile is empty.
DefaultProfile string
}
Policy mirrors the enforceable fields of a ClusterPolicy spec as a plain value type, so the decision logic can be tested without a cluster. The profile/namespace lists are glob patterns; empty means no constraint.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server serves the admission webhook endpoints. It lists ClusterPolicies on every request so policy changes take effect without a restart.
Source Files