From 645547ba99dbd1eb8b50960af482949a210f4459 Mon Sep 17 00:00:00 2001 From: Matt Moore Date: Tue, 7 Sep 2021 13:35:37 -0700 Subject: [PATCH] Drop the unused `apiReader` I noticed the unused parameter in my previous change and tugged. Seems completely unused. I also noticed another unused field for the unstructured decoder, so dropping that. Signed-off-by: Matt Moore --- cmd/cosign/webhook/main.go | 10 +------- pkg/cosign/kubernetes/webhook/handler.go | 28 ++++++++------------- pkg/cosign/kubernetes/webhook/validation.go | 3 +-- 3 files changed, 13 insertions(+), 28 deletions(-) diff --git a/cmd/cosign/webhook/main.go b/cmd/cosign/webhook/main.go index 15c53444b24..466da3729ff 100644 --- a/cmd/cosign/webhook/main.go +++ b/cmd/cosign/webhook/main.go @@ -63,8 +63,6 @@ func main() { flags.Uint16Var(&bindPort, "secure-port", bindPort, "The port on which to serve HTTPS.") flags.StringVar(&tlsCertDirectory, "tls-cert-dir", tlsCertDirectory, "The directory where the TLS certs are located.") - kubernetesClientOptions := webhook.NewClientOptions(webhook.Scheme) - err := flags.Parse(os.Args[1:]) if err != nil { klog.Error(err) @@ -80,13 +78,7 @@ func main() { appsv1.SchemeGroupVersion.WithKind("DaemonSet"): webhook.ValidateSignedResources, } - dynamicClient, err := kubernetesClientOptions.NewDynamicClient() - if err != nil { - klog.Error(err, "Failed to create client") - os.Exit(1) - } - - cosignedValidationHook := webhook.NewFuncAdmissionValidator(webhook.Scheme, dynamicClient, cosignedValidationFuncs, secretKeyRef) + cosignedValidationHook := webhook.NewFuncAdmissionValidator(webhook.Scheme, cosignedValidationFuncs, secretKeyRef) opts := ctrl.Options{ Scheme: webhook.Scheme, diff --git a/pkg/cosign/kubernetes/webhook/handler.go b/pkg/cosign/kubernetes/webhook/handler.go index 70b23851511..78bb2876508 100644 --- a/pkg/cosign/kubernetes/webhook/handler.go +++ b/pkg/cosign/kubernetes/webhook/handler.go @@ -26,13 +26,11 @@ import ( batchv1 "k8s.io/api/batch/v1" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/serializer" utilruntime "k8s.io/apimachinery/pkg/util/runtime" "k8s.io/apimachinery/pkg/util/validation/field" - "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/webhook" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" @@ -50,29 +48,25 @@ func init() { //nolint:gochecknoinits } type funcAdmissionValidator struct { - regularDecoder runtime.Decoder - unstructuredDecoder runtime.Decoder - apiReader client.Reader - validations map[schema.GroupVersionKind]ValidationFunc - scheme *runtime.Scheme - secretKeyRef string + regularDecoder runtime.Decoder + validations map[schema.GroupVersionKind]ValidationFunc + scheme *runtime.Scheme + secretKeyRef string } -func NewFuncAdmissionValidator(scheme *runtime.Scheme, dynamicClient client.Client, fns map[schema.GroupVersionKind]ValidationFunc, secretKeyRef string) *webhook.Admission { +func NewFuncAdmissionValidator(scheme *runtime.Scheme, fns map[schema.GroupVersionKind]ValidationFunc, secretKeyRef string) *webhook.Admission { factory := serializer.NewCodecFactory(scheme) return &webhook.Admission{ Handler: &funcAdmissionValidator{ - regularDecoder: factory.UniversalDeserializer(), - unstructuredDecoder: unstructured.UnstructuredJSONScheme, - apiReader: dynamicClient, - scheme: scheme, - validations: fns, - secretKeyRef: secretKeyRef, + regularDecoder: factory.UniversalDeserializer(), + scheme: scheme, + validations: fns, + secretKeyRef: secretKeyRef, }, } } -type ValidationFunc func(newObj runtime.Object, apiReader client.Reader, keys []*ecdsa.PublicKey) field.ErrorList +type ValidationFunc func(newObj runtime.Object, keys []*ecdsa.PublicKey) field.ErrorList func (c *funcAdmissionValidator) Handle(_ context.Context, admissionSpec admission.Request) admission.Response { var ( @@ -147,7 +141,7 @@ func (c *funcAdmissionValidator) Handle(_ context.Context, admissionSpec admissi switch admissionSpec.Operation { case admissionv1.Create, admissionv1.Update: - validationErrs = validateFunc(newObj, c.apiReader, keys) + validationErrs = validateFunc(newObj, keys) default: return admission.Response{ diff --git a/pkg/cosign/kubernetes/webhook/validation.go b/pkg/cosign/kubernetes/webhook/validation.go index deff10a8f45..d493f0b3c5b 100644 --- a/pkg/cosign/kubernetes/webhook/validation.go +++ b/pkg/cosign/kubernetes/webhook/validation.go @@ -33,14 +33,13 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/util/validation/field" ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client" ) var ( log = ctrl.Log.WithName("cosigned") ) -func ValidateSignedResources(obj runtime.Object, apiReader client.Reader, keys []*ecdsa.PublicKey) field.ErrorList { +func ValidateSignedResources(obj runtime.Object, keys []*ecdsa.PublicKey) field.ErrorList { containers, err := getContainers(obj) if err != nil { return field.ErrorList{field.InternalError(field.NewPath(""), err)}