Documentation
¶
Overview ¶
Package webhook provides the validating admission webhook for agent-orca CRDs. The webhook is registered at /validate-agentorca-io-v1alpha1-agentrun and /validate-agentorca-io-v1alpha1-agent. It enforces:
- Image registry allowlist: all ociRef fields must use an approved registry prefix.
- Required field validation beyond what kubebuilder markers express.
- OCI signature check hook point (actual Cosign verification deferred to the AgentRun controller to avoid blocking admission for long).
The webhook uses failurePolicy: Fail for AgentRun (if we can't validate, don't run) and failurePolicy: Ignore for other resources (avoid blocking unrelated workloads).
Index ¶
- func CheckRegistryAllowlist(ociRef string, allowedRegistries []string) error
- func SetupAgentRunWebhook(mgr ctrl.Manager, allowedRegistries []string) error
- func SetupAgentWebhook(mgr ctrl.Manager, allowedRegistries []string) error
- func SetupToolWebhook(mgr ctrl.Manager, allowedRegistries []string) error
- type AgentRunValidator
- type AgentValidator
- type ToolValidator
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckRegistryAllowlist ¶ added in v0.9.0
CheckRegistryAllowlist verifies an OCI image reference against an allowlist of registry prefixes; an empty allowlist allows everything. The workflow controller uses it for container steps, which no admission webhook sees.
func SetupAgentRunWebhook ¶
SetupAgentRunWebhook registers the AgentRun validating webhook with the manager.
func SetupAgentWebhook ¶
SetupAgentWebhook registers the Agent validating webhook with the manager.
Types ¶
type AgentRunValidator ¶
type AgentRunValidator struct {
Client client.Client
Decoder admission.Decoder
AllowedRegistries []string // empty = allow all
}
AgentRunValidator validates AgentRun resources on admission.
type AgentValidator ¶
type AgentValidator struct {
Client client.Client
Decoder admission.Decoder
AllowedRegistries []string // empty = allow all
}
AgentValidator validates Agent resources on admission.
Source Files