Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set Forbidden as the response status reason #1693

Closed
regadas opened this issue Nov 25, 2021 · 0 comments · Fixed by #1692
Closed

Set Forbidden as the response status reason #1693

regadas opened this issue Nov 25, 2021 · 0 comments · Fixed by #1692
Labels
enhancement New feature or request

Comments

@regadas
Copy link
Contributor

regadas commented Nov 25, 2021

Describe the solution you'd like
Hello 👋

Recently while integrating gatekeeper I noticed that a denied admission webook response will look somewhat like this:

Message and Reason kinda have the same info.

errors.StatusError{
    ErrStatus:v1.Status{
        TypeMeta:v1.TypeMeta{Kind:\"\", APIVersion:\"\"},
        ListMeta:v1.ListMeta{
            SelfLink:\"\",
            ResourceVersion:\"\",
            Continue:\"\",
            RemainingItemCount:(*int64)(nil)},
        Status:\"Failure\",
        Message:\"admission webhook \\\"validation.gatekeeper.sh\\\" denied the request: [enforce-resource-quota] resource exceeded cpu quota\",
        Reason:\"[enforce-resource-quota] resource exceeded cpu quota\",
        Details:(*v1.StatusDetails)(nil),
        Code:403}
}

I guess this is generally ok! However, if one is using "k8s.io/apimachinery/pkg/api/errors" to determine the type of error we are out of luck since it relies on the Reason property.

Given the above example:

errors.IsForbidden(err) // False

I suggest a small change in the StatusError and give Reason the proper description keeping Message as the human-readable description of this operation.

errors.StatusError{
    ErrStatus:v1.Status{
        TypeMeta:v1.TypeMeta{Kind:\"\", APIVersion:\"\"},
        ListMeta:v1.ListMeta{
            SelfLink:\"\",
            ResourceVersion:\"\",
            Continue:\"\",
            RemainingItemCount:(*int64)(nil)},
        Status:\"Failure\",
        Message:\"admission webhook \\\"validation.gatekeeper.sh\\\" denied the request: [enforce-resource-quota] resource exceeded cpu quota\",
        Reason:\"Forbidden\",
        Details:(*v1.StatusDetails)(nil),
        Code:403}
}

Anything else you would like to add:

Here's a PR with the proposed change. #1692

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant