github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-07 03:03:59 +00:00
Code Issues Projects Releases Wiki Activity

apiserver/admission/webhook: construct static CEL compiler only once

Browse Source 
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
This commit is contained in:
Dr. Stefan Schimanski 2024-09-16 18:23:01 +02:00
parent 60c4c2b252
commit 26aeda3cc2
No known key found for this signature in database
GPG Key ID: 4C68E0F19F95EC33
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go
View File

@ -20,7 +20,11 @@ import (
"context" "context"
"fmt" "fmt"
"io" "io"
"sync"
"k8s.io/apiserver/pkg/cel/environment"
"k8s.io/apiserver/pkg/features"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/klog/v2" "k8s.io/klog/v2"
admissionv1 "k8s.io/api/admission/v1" admissionv1 "k8s.io/api/admission/v1"
@ -38,14 +42,17 @@ import (
"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/object" "k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/object"
"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/rules" "k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/rules"
"k8s.io/apiserver/pkg/authorization/authorizer" "k8s.io/apiserver/pkg/authorization/authorizer"
"k8s.io/apiserver/pkg/cel/environment"
"k8s.io/apiserver/pkg/features"
utilfeature "k8s.io/apiserver/pkg/util/feature"
webhookutil "k8s.io/apiserver/pkg/util/webhook" webhookutil "k8s.io/apiserver/pkg/util/webhook"
"k8s.io/client-go/informers" "k8s.io/client-go/informers"
clientset "k8s.io/client-go/kubernetes" clientset "k8s.io/client-go/kubernetes"
) )
var (
// filterCompiler is memory heavy, so we only want to create it once and share it.
filterCompilerOnce sync.Once
filterCompiler cel.FilterCompiler
)
// Webhook is an abstract admission plugin with all the infrastructure to define Admit or Validate on-top. // Webhook is an abstract admission plugin with all the infrastructure to define Admit or Validate on-top.
type Webhook struct { type Webhook struct {
*admission.Handler *admission.Handler
@ -57,7 +64,6 @@ type Webhook struct {
namespaceMatcher *namespace.Matcher namespaceMatcher *namespace.Matcher
objectMatcher *object.Matcher objectMatcher *object.Matcher
dispatcher Dispatcher dispatcher Dispatcher
filterCompiler cel.FilterCompiler
authorizer authorizer.Authorizer authorizer authorizer.Authorizer
} }
@ -95,6 +101,10 @@ func NewWebhook(handler *admission.Handler, configFile io.Reader, sourceFactory
cm.SetAuthenticationInfoResolver(authInfoResolver) cm.SetAuthenticationInfoResolver(authInfoResolver)
cm.SetServiceResolver(webhookutil.NewDefaultServiceResolver()) cm.SetServiceResolver(webhookutil.NewDefaultServiceResolver())
filterCompilerOnce.Do(func() {
filterCompiler = cel.NewFilterCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForWebhooks)))
})
return &Webhook{ return &Webhook{
Handler: handler, Handler: handler,
sourceFactory: sourceFactory, sourceFactory: sourceFactory,
@ -102,7 +112,6 @@ func NewWebhook(handler *admission.Handler, configFile io.Reader, sourceFactory
namespaceMatcher: &namespace.Matcher{}, namespaceMatcher: &namespace.Matcher{},
objectMatcher: &object.Matcher{}, objectMatcher: &object.Matcher{},
dispatcher: dispatcherFactory(&cm), dispatcher: dispatcherFactory(&cm),
filterCompiler: cel.NewFilterCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion(), utilfeature.DefaultFeatureGate.Enabled(features.StrictCostEnforcementForWebhooks))),
}, nil }, nil
} }
@ -228,7 +237,7 @@ func (a *Webhook) ShouldCallHook(ctx context.Context, h webhook.WebhookAccessor,
return nil, apierrors.NewInternalError(err) return nil, apierrors.NewInternalError(err)
} }
matcher := h.GetCompiledMatcher(a.filterCompiler) matcher := h.GetCompiledMatcher(filterCompiler)
matchResult := matcher.Match(ctx, versionedAttr, nil, a.authorizer) matchResult := matcher.Match(ctx, versionedAttr, nil, a.authorizer)
if matchResult.Error != nil { if matchResult.Error != nil {