Documentation
¶
Index ¶
- Variables
- func CompileCuexTemplate(ctx context.Context, cueTemplate string) (cue.Value, error)
- func DenyOnInvalidIdentity(logger logging.Logger, kind, module, apiVersion string, requestUID types.UID) (admission.Response, bool)
- func IsAddonDefinition(obj client.Object) bool
- func LiveClient(mgr ctrl.Manager) client.Client
- func ReadWithLiveRetry(cached, live client.Client, read func(client.Client) error) error
- func StatusSources(status *common.Status) []string
- func ValidateCompiledCuexTemplate(val cue.Value) error
- func ValidateCueTemplate(cueTemplate string) error
- func ValidateCuexTemplate(ctx context.Context, cueTemplate string) error
- func ValidateCuexTemplateWithoutProviders(ctx context.Context, cueTemplate string) error
- func ValidateDefinitionIdentity(module, apiVersion string) error
- func ValidateDefinitionRevision(ctx context.Context, cli client.Client, def runtime.Object, ...) error
- func ValidateExtendsHasTemplate(kind, name, extends string, schematic *common.Schematic) error
- func ValidateInheritedTemplate(ctx context.Context, name, template string, ancestors []inherit.Level, ...) ([]string, error)
- func ValidateMultipleDefVersionsNotPresent(version, revisionName, objectType string) error
- func ValidateOutputResourcesExist(cueTemplate string, mapper meta.RESTMapper, obj client.Object) error
- func ValidateSemanticVersion(version string) error
- func ValidateSourceTemplate(ctx context.Context, cueTemplate string) error
- func ValidateWorkflowStepCuexTemplate(ctx context.Context, cueTemplate string) error
- type ResourceInfo
Constants ¶
This section is empty.
Variables ¶
var ContextRegex = `^.+:\sreference\s\"context\"\snot\sfound$`
ContextRegex to match '**: reference "context" not found'
Functions ¶
func CompileCuexTemplate ¶ added in v1.11.1
CompileCuexTemplate compiles cueTemplate exactly as ValidateCuexTemplate does, against the workload compiler with provider functions left unresolved, and returns the value instead of a verdict. A caller that runs more than one check against a template compiles it once here, then hands the value to ValidateCompiledCuexTemplate and to its own checks.
func DenyOnInvalidIdentity ¶
func DenyOnInvalidIdentity(logger logging.Logger, kind, module, apiVersion string, requestUID types.UID) (admission.Response, bool)
DenyOnInvalidIdentity runs ValidateDefinitionIdentity and, on failure, logs it and builds the admission.Denied response every definition webhook uses for it, so the four definition handlers (ComponentDefinition, TraitDefinition, PolicyDefinition, WorkflowStepDefinition) share one call instead of each copying the block with only the kind name changed.
kind names the definition type in the log line (e.g. "ComponentDefinition"). The second return value is true when the request should be denied; the caller returns the response immediately in that case and otherwise continues to its next check.
Logged at Info, not Error: an inconsistent module/apiVersion pair is the requester's bad input, not a server-side fault, and WithError already attaches the error to the structured log fields, so passing err again to Error would log it twice for no extra signal.
func IsAddonDefinition ¶ added in v1.10.4
IsAddonDefinition checks if the object is part of an addon installation This is a generic solution that works for ALL addons by checking owner references
func LiveClient ¶
LiveClient returns a client that reads straight from the API server, for use behind ReadWithLiveRetry.
A full client rather than mgr.GetAPIReader(): resolving a pinned revision asserts its reader back to a client.Client.
Returns nil if a client cannot be built, so a caller can fall back to the cached one rather than refuse to start: stale reads are a worse failure than no webhook, but neither is worth a crash loop.
func ReadWithLiveRetry ¶
ReadWithLiveRetry runs a read against the cached client and, if what it needed was not found, runs the whole thing again against the API server.
The retry is per lookup rather than per Get on purpose. oamutil.GetDefinition tries the Application's namespace before the system one, so in the usual layout — definitions in vela-system, the app elsewhere — its first Get is a guaranteed miss. A client wrapper that went live on each miss would pay a round trip on every lookup, and admission sits on the whole write path, including the updates a controller makes while reconciling. Retrying the lookup instead costs nothing when the cache can answer at all.
Only absence is retried: any other error says nothing about the cache being behind. A nil live client runs the read once, which is what a test supplying a fake wants and what a manager that could not build an uncached client falls back to.
func StatusSources ¶
StatusSources returns the CUE a definition carries outside its template.
func ValidateCompiledCuexTemplate ¶ added in v1.11.1
ValidateCompiledCuexTemplate is ValidateCuexTemplate for a value already produced by CompileCuexTemplate.
func ValidateCueTemplate ¶ added in v1.9.7
ValidateCueTemplate validate cueTemplate
func ValidateCuexTemplate ¶ added in v1.10.4
ValidateCuexTemplate validates a ComponentDefinition or TraitDefinition CUE template with CueX, using the workload compiler that renders those kinds.
The compiler must match the one that renders the definition. Three import paths, "vela/kube", "vela/http" and "vela/config", are registered by both the workload and the workflow compiler but resolve to different packages with different selectors and different $params schemas. Compiling against the wrong flavor does not raise an error: a selector the flavor does not define is silently accepted, and the $params schema check that would have caught a misspelled or mistyped argument disappears with it. Validating a component template against the workflow compiler therefore turns a checked template into an unchecked one, quietly. See ValidateWorkflowStepCuexTemplate for the counterpart used by workflow steps.
func ValidateCuexTemplateWithoutProviders ¶
ValidateCuexTemplateWithoutProviders validates a template's shape without executing the provider functions in it.
A SourceDefinition's whole purpose is to fetch something, and admission runs with no parameters supplied - so every provider call is either handed a non-concrete value ("cannot convert incomplete value \"string\" to JSON") or, worse, actually performed. Performing it would do the source's I/O on every apply, which is the exact cost the cache exists to avoid, and would make admission depend on a remote service being reachable.
The shape checks that matter - the schema block, the storage block, the generated key - are all static and unaffected.
Every validator here now disables provider resolution, so this is equivalent to ValidateCuexTemplate and is kept only so the SourceDefinition work that introduced it keeps its API. It can be dropped once that is confirmed.
func ValidateDefinitionIdentity ¶
ValidateDefinitionIdentity validates that a Definition's spec.module and spec.apiVersion are set together or both left empty. The apiVersion format is enforced by the CRD schema, not here.
func ValidateDefinitionRevision ¶
func ValidateDefinitionRevision(ctx context.Context, cli client.Client, def runtime.Object, defRevNamespacedName types.NamespacedName) error
ValidateDefinitionRevision validate whether definition will modify the immutable object definitionRevision
func ValidateExtendsHasTemplate ¶
ValidateExtendsHasTemplate refuses `extends` on a definition with no CUE template.
A chain is composed by rendering the child's template against its parent's, so a child with no template calls nothing: it inherits no surface and describes nothing of its own. Judged on write, because at render the complaint is about a missing `$super` block rather than about the definition being empty, and because everything else the handler checks about `extends` needs a template and so is skipped without one.
func ValidateInheritedTemplate ¶
func ValidateInheritedTemplate(ctx context.Context, name, template string, ancestors []inherit.Level, surface inherit.Surface, alsoRead ...string) ([]string, error)
ValidateInheritedTemplate validates a definition that extends another. It replaces ValidateCuexTemplate for one, since `$super` is declared nowhere in the child's template and compiling it alone always fails.
Refused: never calling the parent, omitting a parameter it requires with no default, a call it would not accept. Warned: a name it does not declare, and a published parameter that reaches neither the parent nor the child's output.
alsoRead are the healthPolicy, customStatus and details, so a parameter read only there is not reported as unused.
func ValidateMultipleDefVersionsNotPresent ¶ added in v1.10.0
ValidateMultipleDefVersionsNotPresent validates that both Name Annotation Revision and Spec.Version are not present
func ValidateOutputResourcesExist ¶ added in v1.10.4
func ValidateOutputResourcesExist(cueTemplate string, mapper meta.RESTMapper, obj client.Object) error
ValidateOutputResourcesExist validates that resources referenced in output/outputs fields exist on the cluster
func ValidateSemanticVersion ¶ added in v1.10.0
ValidateSemanticVersion validates if a Definition's version includes all of major,minor & patch version values.
func ValidateSourceTemplate ¶
ValidateSourceTemplate validates a SourceDefinition's template against the packages a source is allowed to import.
Compiling against SourceCompiler rather than WorkloadCompiler is what refuses an acting package at apply time. Without it a source importing vela/helm would be accepted and then install a chart on its first cache miss, since the render path sets no dry-run.
Not validated with cue.Final(): see validateCuexTemplateWith.
func ValidateWorkflowStepCuexTemplate ¶
ValidateWorkflowStepCuexTemplate validates a WorkflowStepDefinition CUE template against the workflow provider compiler.
Step templates import workflow-only builtin packages that the workload compiler does not register, "vela/op" above all. Validating them with ValidateCuexTemplate rejects 27 of the 37 bundled step definitions with `builtin package "vela/op" undefined`, so the two kinds cannot share a compiler. They also cannot share the workflow one, for the reason described on ValidateCuexTemplate.
Not validated with cue.Final(): see validateCuexTemplateWith. op.#ApplyApplication and friends carry internal fields a provider only fills in at run time (e.g. apply-application.yaml's bare `op.#ApplyApplication & {}`); cue.Final() rejects those as "undefined field", not as one of the incomplete/non-concrete shapes checkError already tolerates. Confirmed empirically against the bundled WorkflowStepDefinitions before adding this parameter.
Types ¶
type ResourceInfo ¶ added in v1.10.4
type ResourceInfo struct {
APIVersion string
Kind string
Name string // optional, for better error messages
}
func ExtractResourceInfo ¶ added in v1.10.4
func ExtractResourceInfo(cueTemplate string) ([]ResourceInfo, error)
ExtractResourceInfo extracts apiVersion and kind from CUE template without evaluation
Source Files