c6c2c525a6
Also fix some tests that were broken by bumping golang and dependencies in the previous commits. Note that in addition to changes made to satisfy the linter which do not impact the behavior of the code, this commit also adds ReadHeaderTimeout to all usages of http.Server to satisfy the linter (and because it seemed like a good suggestion).
74 lines
2.0 KiB
Go
74 lines
2.0 KiB
Go
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package ownerref
|
|
|
|
import (
|
|
"context"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
"go.pinniped.dev/internal/kubeclient"
|
|
)
|
|
|
|
func New(refObj kubeclient.Object) kubeclient.Middleware {
|
|
ref := metav1.OwnerReference{
|
|
Name: refObj.GetName(),
|
|
UID: refObj.GetUID(),
|
|
}
|
|
ref.APIVersion, ref.Kind = refObj.GetObjectKind().GroupVersionKind().ToAPIVersionAndKind()
|
|
refNamespace := refObj.GetNamespace()
|
|
|
|
// if refNamespace is empty, we assume the owner ref is to a cluster scoped object which can own any object
|
|
refIsNamespaced := len(refNamespace) != 0
|
|
|
|
// special handling of namespaces to treat them as namespace scoped to themselves
|
|
if isNamespace(refObj) {
|
|
refNamespace = refObj.GetName()
|
|
refIsNamespaced = true
|
|
}
|
|
|
|
return kubeclient.MiddlewareFunc(func(_ context.Context, rt kubeclient.RoundTrip) {
|
|
// we should not mess with owner refs on things we did not create
|
|
if rt.Verb() != kubeclient.VerbCreate {
|
|
return
|
|
}
|
|
|
|
// we probably do not want to set an owner ref on a subresource
|
|
if len(rt.Subresource()) != 0 {
|
|
return
|
|
}
|
|
|
|
// when ref is not cluster scoped, we ignore cluster scoped resources
|
|
if refIsNamespaced && !rt.NamespaceScoped() {
|
|
return
|
|
}
|
|
|
|
// when ref is not cluster scoped, we require refNamespace to match
|
|
// the request namespace since cross namespace ownership is disallowed
|
|
if refIsNamespaced && refNamespace != rt.Namespace() {
|
|
return
|
|
}
|
|
|
|
rt.MutateRequest(func(obj kubeclient.Object) error {
|
|
// we only want to set the owner ref on create and when one is not already present
|
|
if len(obj.GetOwnerReferences()) != 0 {
|
|
return nil
|
|
}
|
|
|
|
obj.SetOwnerReferences([]metav1.OwnerReference{ref})
|
|
|
|
return nil
|
|
})
|
|
})
|
|
}
|
|
|
|
//nolint:gochecknoglobals
|
|
var namespaceGVK = corev1.SchemeGroupVersion.WithKind("Namespace")
|
|
|
|
func isNamespace(obj kubeclient.Object) bool {
|
|
_, ok := obj.(*corev1.Namespace)
|
|
return ok || obj.GetObjectKind().GroupVersionKind() == namespaceGVK
|
|
}
|