admission

package

v0.1.8 Latest Latest Go to latest Published: Apr 18, 2026 License: MIT Imports: 9 Imported by: 0

Details

Package admission provides shared admission-webhook helpers: decode/dispatch/encode, allow/deny builders, and JSON patch utilities.

View Source

const DefaultMaxBody int64 = 10 << 20

DefaultMaxBody is the request-body ceiling Serve applies when the caller passes 0.

This section is empty.

func Allow() *admissionv1.AdmissionResponse

Allow returns an AdmissionResponse that permits the request.

func Decode(r *http.Request, maxBytes int64) (*admissionv1.AdmissionReview, error)

Decode parses an AdmissionReview from r, using DefaultMaxBody when maxBytes <= 0.

func Deny(msg string) *admissionv1.AdmissionResponse

Deny returns a forbidden AdmissionResponse with the given message.

func EscapeJSONPointer(s string) string

EscapeJSONPointer escapes ~ and / per RFC 6901 for use in patch paths.

func MarshalPatch(ops []JSONPatchOp) ([]byte, error)

MarshalPatch encodes patch ops as JSON for AdmissionResponse.Patch.

func Serve(w http.ResponseWriter, r *http.Request, maxBytes int64, handler Handler)

Serve decodes an AdmissionReview, dispatches to handler, and writes the response.

type Handler func(ctx context.Context, review *admissionv1.AdmissionReview) *admissionv1.AdmissionResponse

Handler is the admission callback. A nil return is treated as Allow().

type JSONPatchOp struct {
	Op    string `json:"op"`
	Path  string `json:"path"`
	Value any    `json:"value,omitempty"`
}

JSONPatchOp represents a single RFC 6902 JSON Patch operation.