api - 如何为 Kubernetes 准入 Controller 编写响应

Question

我正在尝试为 pod 命名(验证)编写一个简单的准入 Controller ，但由于某种原因，我产生了错误的响应。
这是我的代码:

package main

import (
      "fmt" 
      "encoding/json"
      "io/ioutil"
      "net/http"
      "github.com/golang/glog"

      // for Kubernetes 
      "k8s.io/api/admission/v1beta1"
      "k8s.io/api/core/v1"
      metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
      "regexp"
)

type myValidServerhandler struct {

}
// this is the handler fuction from the HTTP server 
func (gs *myValidServerhandler) serve(w http.ResponseWriter, r *http.Request) {
    var Body []byte
    if r.Body != nil {
        if data , err := ioutil.ReadAll(r.Body); err == nil {
            Body = data
        }
    }

    if len(Body) == 0 {
        glog.Error("Unable to retrive Body from API")
        http.Error(w,"Empty Body", http.StatusBadRequest)
        return
    }

    glog.Info("Received Request")
// this is where I make sure the request is for the validation prefix
    if r.URL.Path != "/validate" {
         glog.Error("Not a Validataion String")
        http.Error(w,"Not a Validataion String", http.StatusBadRequest)
        return
    }
// in this part the function takes the AdmissionReivew and make sure in is in the right
// JSON format 
    arRequest := &v1beta1.AdmissionReview{}
    if err := json.Unmarshal(Body, arRequest); err != nil {
        glog.Error("incorrect Body")
        http.Error(w, "incorrect Body", http.StatusBadRequest)
        return
    }

    raw := arRequest.Request.Object.Raw
    pod := v1.Pod{}
    if err := json.Unmarshal(raw, &pod); err != nil {
        glog.Error("Error Deserializing Pod")
        return
    }
// this is where I make sure the pod name contains the kuku string
    podnamingReg := regexp.MustCompile(`kuku`)
    if podnamingReg.MatchString(string(pod.Name)) {
        return
    } else {
        glog.Error("the pod does not contain \"kuku\"")
        http.Error(w, "the pod does not contain \"kuku\"", http.StatusBadRequest)
        return
    }

// I think the main problem is with this part of the code because the 
// error from the events I getting in the Kubernetes namespace is that 
// I am sending 200 without a body response

    arResponse := v1beta1.AdmissionReview{
        Response: &v1beta1.AdmissionResponse{
            Result:  &metav1.Status{},
            Allowed: true,
        },
    }
// generating the JSON response after the validation 
    resp, err := json.Marshal(arResponse)
    if err != nil {
        glog.Error("Can't encode response:", err)
        http.Error(w, fmt.Sprintf("couldn't encode response: %v", err), http.StatusInternalServerError)
    }

    glog.Infof("Ready to write  response ...")
    if _, err := w.Write(resp); err != nil {
        glog.Error("Can't write response", err)
        http.Error(w, fmt.Sprintf("cloud not write response: %v", err), http.StatusInternalServerError)
    }
}

代码按预期工作，但输出为正(其中 pod 名称符合条件)
还有另一个文件，其主要内容只是抓取 TLS 文件并启动 HTTP 服务。

Answer 1

所以经过几次挖掘后，我发现我的代码有什么问题
首先这部分

  if podnamingReg.MatchString(string(pod.Name)) {
    return
  } else {
    glog.Error("the pod does not contain \"kuku\"")
    http.Error(w, "the pod does not contain \"kuku\"", http.StatusBadRequest)
    return
  }

通过写“return”两次，我丢弃了其余代码等等，所以我没有将请求 UID 附加到响应 UID，因为我使用的是 v1 而不是 v1beta1，所以我需要在响应中添加 APIVersion
所以其余的代码看起来像:

   arResponse := v1beta1.AdmissionReview{
        Response: &v1beta1.AdmissionResponse{
            Result:  &metav1.Status{},
            Allowed: false,
        },
    }

    podnamingReg := regexp.MustCompile(`kuku`)

    if podnamingReg.MatchString(string(pod.Name)) {
        fmt.Printf("the pod %s is up to the name standard", pod.Name)
        arResponse.Response.Allowed = true  
    } 

    arResponse.APIVersion = "admission.k8s.io/v1"
    arResponse.Kind = arRequest.Kind
    arResponse.Response.UID = arRequest.Request.UID

所以我需要添加 2 个部分并确保如果 pod 名称不符合标准，那么我需要返回正确的响应