Documentation
¶
Overview ¶
Package webhook provides the validating admission webhook for agent-orca CRDs. The webhook is registered at /validate-agentorca-io-v1alpha1-agentrun and /validate-agentorca-io-v1alpha1-agent. It enforces:
- Image registry allowlist: all ociRef fields must use an approved registry prefix.
- Required field validation beyond what kubebuilder markers express.
- OCI signature check hook point (actual Cosign verification deferred to the AgentRun controller to avoid blocking admission for long).
The webhook uses failurePolicy: Fail for AgentRun (if we can't validate, don't run) and failurePolicy: Ignore for other resources (avoid blocking unrelated workloads).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SetupAgentRunWebhook ¶
SetupAgentRunWebhook registers the AgentRun validating webhook with the manager.
func SetupAgentWebhook ¶
SetupAgentWebhook registers the Agent validating webhook with the manager.
Types ¶
type AgentRunValidator ¶
type AgentRunValidator struct {
Client client.Client
Decoder admission.Decoder
AllowedRegistries []string // empty = allow all
}
AgentRunValidator validates AgentRun resources on admission.
type AgentValidator ¶
type AgentValidator struct {
Client client.Client
Decoder admission.Decoder
AllowedRegistries []string // empty = allow all
}
AgentValidator validates Agent resources on admission.
Source Files
Click to show internal directories.
Click to hide internal directories.