webhook

type NetworkPoolValidator ¶

type NetworkPoolValidator struct {
	Client client.Client
}

NetworkPoolValidator validates NetworkPool resources on admission.

func (v *NetworkPoolValidator) SetupWebhookWithManager(mgr ctrl.Manager) error

func (v *NetworkPoolValidator) ValidateCreate(_ context.Context, obj runtime.Object) (admission.Warnings, error)

func (v *NetworkPoolValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error)

func (v *NetworkPoolValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error)

type ProviderConfigValidator ¶

type ProviderConfigValidator struct {
	Client client.Client
}

ProviderConfigValidator validates ProviderConfig resources on admission.

func (v *ProviderConfigValidator) SetupWebhookWithManager(mgr ctrl.Manager) error

func (v *ProviderConfigValidator) ValidateCreate(_ context.Context, obj runtime.Object) (admission.Warnings, error)

func (v *ProviderConfigValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error)

func (v *ProviderConfigValidator) ValidateUpdate(_ context.Context, _, newObj runtime.Object) (admission.Warnings, error)

type TeamValidator ¶ added in v0.15.0

type TeamValidator struct {
	Client    client.Client
	APIReader client.Reader
}

TeamValidator validates Team mutations and enforces the platform-admin / team-admin split on ResourceLimits and Environments[].Limits fields.

spec.resourceLimits is the team's absolute ceiling and may only be set or modified by a platform admin. Team admins cannot raise their own ceiling.

spec.environments[].limits are per-environment sub-caps within that ceiling and may be modified by a team admin of the team being edited (platform admins can modify them as well).

The check runs on both create and update. On create, any resourceLimits or env-limits present on the incoming Team require platform admin, because no team admin can exist for a team that does not yet exist.

Client is the cached manager client; APIReader is uncached. User CRDs are read via the uncached reader so a recent isPlatformAdmin flip is observed immediately rather than after a cache tick.

func (v *TeamValidator) Handle(ctx context.Context, req admission.Request) admission.Response

func (v *TeamValidator) SetupWebhookWithManager(mgr ctrl.Manager) error

type TenantClusterValidator ¶

type TenantClusterValidator struct {
	Client    client.Client
	APIReader client.Reader
}

TenantClusterValidator validates TenantCluster resources on admission.

Client is the cached, manager-backed client used for high-volume reads (TenantCluster list for sibling counts); staleness up to 1s is tolerable because webhook decisions only need approximate counts.

APIReader is an uncached reader used for reads whose staleness would flip an admission decision: Team spec (env list, limits, access). controller-runtime's cached client can lag apiserver writes by a reconcile tick, which is enough to miss a just-applied env rename or access-block edit. The Team admission webhook for "resourceLimits changed, needs platform admin" wants the current answer, not a 1s- old one.

func (v *TenantClusterValidator) Handle(ctx context.Context, req admission.Request) admission.Response

func (v *TenantClusterValidator) SetupWebhookWithManager(mgr ctrl.Manager) error