fix(controller): change managed network policy label check (#1062)

* fix(controller): change managed network policy label check Signed-off-by: Oliver Bähler <[email protected]> * fix(controller): change managed network policy label check Signed-off-by: Oliver Bähler <[email protected]> --------- Signed-off-by: Oliver Bähler <[email protected]>
projectcapsule · May 27, 2024 · 82995a3 · 82995a3
1 parent 0571e41
commit 82995a3
Showing 1 changed file with 27 additions and 36 deletions.
diff --git a/pkg/webhook/networkpolicy/validating.go b/pkg/webhook/networkpolicy/validating.go
@@ -6,14 +6,12 @@ package networkpolicy
 import (
 	"context"
 
-	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
-	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
 	capsuleutils "github.com/projectcapsule/capsule/pkg/utils"
 	capsulewebhook "github.com/projectcapsule/capsule/pkg/webhook"
 	"github.com/projectcapsule/capsule/pkg/webhook/utils"
@@ -31,39 +29,14 @@ func (r *handler) OnCreate(client.Client, admission.Decoder, record.EventRecorde
 	}
 }
 
-func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (*capsulev1beta2.Tenant, error) {
-	var err error
-
-	np := &networkingv1.NetworkPolicy{}
-	if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
-		return nil, err
-	}
-
-	tnt := &capsulev1beta2.Tenant{}
-
-	l, _ := capsuleutils.GetTypeLabel(&capsulev1beta2.Tenant{})
-	if v, ok := np.GetLabels()[l]; ok {
-		if err = client.Get(ctx, types.NamespacedName{Name: v}, tnt); err != nil {
-			return nil, err
-		}
-
-		return tnt, nil
-	}
-
-	return nil, nil //nolint:nilnil
-}
-
-//nolint:dupl
-func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
 	return func(ctx context.Context, req admission.Request) *admission.Response {
-		tnt, err := r.generic(ctx, req, client, decoder)
+		allowed, err := r.handle(ctx, req, client, decoder)
 		if err != nil {
 			return utils.ErroredResponse(err)
 		}
 
-		if tnt != nil {
-			recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyDeletion", "NetworkPolicy %s/%s cannot be deleted", req.Namespace, req.Name)
-
+		if !allowed {
 			response := admission.Denied("Capsule Network Policies cannot be deleted: please, reach out to the system administrators")
 
 			return &response
@@ -73,17 +46,14 @@ func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, reco
 	}
 }
 
-//nolint:dupl
-func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func {
+func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func {
 	return func(ctx context.Context, req admission.Request) *admission.Response {
-		tnt, err := r.generic(ctx, req, client, decoder)
+		allowed, err := r.handle(ctx, req, client, decoder)
 		if err != nil {
 			return utils.ErroredResponse(err)
 		}
 
-		if tnt != nil {
-			recorder.Eventf(tnt, corev1.EventTypeWarning, "NetworkPolicyUpdate", "NetworkPolicy %s/%s cannot be updated", req.Namespace, req.Name)
-
+		if !allowed {
 			response := admission.Denied("Capsule Network Policies cannot be updated: please, reach out to the system administrators")
 
 			return &response
@@ -92,3 +62,24 @@ func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, reco
 		return nil
 	}
 }
+
+func (r *handler) handle(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (allowed bool, err error) {
+	allowed = true
+
+	np := &networkingv1.NetworkPolicy{}
+	if err = client.Get(ctx, types.NamespacedName{Namespace: req.AdmissionRequest.Namespace, Name: req.AdmissionRequest.Name}, np); err != nil {
+		return false, err
+	}
+
+	objectLabel, err := capsuleutils.GetTypeLabel(&networkingv1.NetworkPolicy{})
+	if err != nil {
+		return
+	}
+
+	labels := np.GetLabels()
+	if _, ok := labels[objectLabel]; ok {
+		allowed = false
+	}
+
+	return
+}