k-space/harbor-operator
10
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Activity

Exclude CNI, CSI namespaces from mutation

Browse Source
This commit is contained in:
Lauri Võsandi 2022-12-23 08:40:54 +02:00
parent 700af5259b
commit 81fe2eb69f
1 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
app/harbor-operator.py
View File

@ -10,6 +10,18 @@ from sanic.response import json
from image_mutation import mutate_image
from harbor_wrapper import Harbor
mutation_excluded_namespaces = set([
# Do not fiddle with CNI stuff
"kube-system", # kube-proxy hosted here
"tigera-operator",
"calico-system",
# Do not fiddle with CSI stuff
"longhorn-system",
# Don't touch Harbor itself
"harbor-operator",
])
harbor = Harbor(os.environ["HARBOR_URI"])
cached_registries = set()
app = Sanic("admission_control")
@ -18,17 +30,21 @@ app = Sanic("admission_control")
@app.post("/")
async def admission_control_handler(request):
patches = []
for index, container in enumerate(request.json["request"]["object"]["spec"]["containers"]):
mutated_image = mutate_image(container["image"], harbor.hostname, cached_registries)
patches.append({
"op": "replace",
"path": "/spec/containers/%d/image" % index,
"value": mutated_image,
})
print("Substituting %s with %s for pod %s/%s" % (
container["image"], mutated_image,
request.json["request"]["object"]["metadata"]["namespace"],
request.json["request"]["object"]["metadata"]["name"]))
pod_namespace = request.json["request"]["object"]["metadata"]["namespace"]
pod_name = request.json["request"]["object"]["metadata"].get("name", "")
pod_ref = "%s/%s" % (pod_namespace, pod_name)
if pod_namespace in mutation_excluded_namespaces:
print("Pod %s not mutated by namespace exclusion" % pod_ref)
else:
for index, container in enumerate(request.json["request"]["object"]["spec"]["containers"]):
mutated_image = mutate_image(container["image"], harbor.hostname, cached_registries)
patches.append({
"op": "replace",
"path": "/spec/containers/%d/image" % index,
"value": mutated_image,
})
print("Substituting %s with %s for pod %s" % (
container["image"], mutated_image, pod_ref))
response = {
"apiVersion": "admission.k8s.io/v1",
"kind": "AdmissionReview",