README
¶
pkg/controller/dryrunvalidator
Webhook-side validator: implements the DryRunValidator interface that pkg/controller/webhook calls into when an admission request arrives.
Overview
The validating admission webhook needs a synchronous answer to "would this proposed change render and validate cleanly?" — not via events, just a direct function call returning allowed bool, reason string. This component bridges that synchronous call into the controller's render-validate pipeline by:
- Receiving the proposed and old objects from the webhook adapter (
ValidateDirect). - Resolving the request GVK to its GVR, then finding every configured store alias for that GVR.
- Building one selector-aware
*stores.StoreOverlayper alias. - Delegating render+validate to
pkg/controller/proposalvalidator.Service, which merges the overlays on top of the live stores for the duration of the call. - Returning a flat allow/deny + simplified reason string (plus soft warnings) for the webhook response. Pluggable validators run inside the shared pipeline before this component receives the result.
The component does not subscribe to any events. It does not run the chart's embedded validationTests — those are chart-author scenarios with their own fixtures, run in CI via haptic validate / make test-templates, not per admission request.
Quick Start
import (
"github.com/haproxy-haptic/HAPTIC/pkg/controller/dryrunvalidator"
)
component, err := dryrunvalidator.New(&dryrunvalidator.ComponentConfig{
ProposalValidator: proposalValidator, // *proposalvalidator.Service
RESTMapper: restMapper,
WatchedResources: cfg.WatchedResources,
Logger: logger,
})
// pkg/controller/webhook hands this component as DryRunValidator and
// calls ValidateDirect synchronously per admission request. There is
// no Start() — the validator is a library, not a lifecycle component.
Webhook Wiring
// In iteration.go (sketch)
webhookComp := webhook.New(logger, &webhook.Config{
// ... TLS material from the cert Secret loaded at controller startup,
// rules from ExtractWebhookRules ...
DryRunValidator: dryRunComp, // <- this package's *Component
}, restMapper, metricsRecorder)
The webhook adapter then registers a webhook.ValidationFunc per GVK and calls dryRunComp.ValidateDirect with the request identity, operation, new object, and old object.
Failure Modes
(false, reason, nil)— proposed change failed render or validation; the webhook denies and the API server forwardsreasonto the user.(true, "", nil)— proposed change is admissible with no warnings.(true, "", warnings)— proposed change is admissible;warningsare soft diagnostics from pluggable validators, surfaced viaAdmissionResponse.Warnings.ValidateDirectreturns(allowed bool, reason string, warnings []string). Internal errors (e.g. a render panic) are logged and surface as a deny with a descriptive reason — the webhook never returns HTTP 500 from this path. ConfigurefailurePolicy: Failin theValidatingWebhookConfigurationif you want the API server to reject on transport failures (TLS handshake, dial errors); deny-with-reason is for application-level rejections.
See Also
pkg/controller/webhook— HTTPS adapter that callsValidateDirectpkg/controller/proposalvalidator— render-validate pipeline driven in sync modepkg/stores— overlay primitives used for each configured aliaspkg/controller/dryrunvalidator/CLAUDE.md— design notes (overlay-store pattern, why direct calls are acceptable here)
License
Apache-2.0 — see root LICENSE.
Documentation
¶
Overview ¶
Package dryrunvalidator implements the DryRunValidator that performs dry-run reconciliation for webhook validation.
The validator is called synchronously by pkg/controller/webhook via ValidateDirect. It creates an overlay store simulating the admission request's hypothetical state and delegates to ProposalValidator.ValidateSync for rendering and validation.
Index ¶
Constants ¶
const ComponentName = "dryrun-validator"
ComponentName identifies this validator in log records.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Component ¶
type Component struct {
// contains filtered or unexported fields
}
Component implements the dry-run validator.
It creates store overlays from admission requests and delegates validation to ProposalValidator and returns the shared pipeline's diagnostics.
func New ¶
func New(cfg *ComponentConfig) (*Component, error)
New creates a new DryRunValidator component.
func (*Component) ValidateDirect ¶
func (c *Component) ValidateDirect(ctx context.Context, gvk, namespace, name string, object, oldObject any, operation string) (allowed bool, reason string, warnings []string)
ValidateDirect performs synchronous dry-run validation.
Parameters:
- ctx: Context for cancellation and timeout
- gvk: GroupVersionKind string (e.g., "networking.k8s.io/v1.Ingress")
- namespace: Resource namespace
- name: Resource name
- object: The proposed Kubernetes resource object
- oldObject: The existing object for UPDATE and DELETE
- operation: Admission operation (CREATE, UPDATE, DELETE)
Returns:
- allowed: Whether the resource passed validation
- reason: Denial reason if not allowed, empty otherwise
- warnings: Pipeline warnings surfaced through AdmissionResponse.Warnings
type ComponentConfig ¶
type ComponentConfig struct {
ProposalValidator *proposalvalidator.Service
// RESTMapper resolves an admission request's GVK to its GVR.
RESTMapper meta.RESTMapper
// WatchedResources defines the configured store aliases for each GVR.
WatchedResources map[string]config.WatchedResource
// Logger is the structured logger.
Logger *slog.Logger
}
ComponentConfig contains configuration for creating a DryRunValidator.
Source Files