github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-02 16:29:21 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #128013 from seans3/admission-configuration-strict

Browse Source 
AdmissionConfiguration now uses strict validation
This commit is contained in:
Kubernetes Prow Robot 2024-10-28 22:18:54 +00:00 committed by GitHub
commit eb5c8965be
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 33 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
staging/src/k8s.io/apiserver/pkg/admission/config.go
View File

@ -63,7 +63,7 @@ func ReadAdmissionConfiguration(pluginNames []string, configFilePath string, con
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to read admission control configuration from %q [%v]", configFilePath, err) return nil, fmt.Errorf("unable to read admission control configuration from %q [%v]", configFilePath, err)
} }
codecs := serializer.NewCodecFactory(configScheme) codecs := serializer.NewCodecFactory(configScheme, serializer.EnableStrict)
decoder := codecs.UniversalDecoder() decoder := codecs.UniversalDecoder()
decodedObj, err := runtime.Decode(decoder, data) decodedObj, err := runtime.Decode(decoder, data)
// we were able to decode the file successfully // we were able to decode the file successfully

36
staging/src/k8s.io/apiserver/pkg/admission/config_test.go
View File

@ -22,6 +22,7 @@ import (
"reflect" "reflect"
"testing" "testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
"k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime"
@ -52,7 +53,28 @@ func TestReadAdmissionConfiguration(t *testing.T) {
ConfigBody string ConfigBody string
ExpectedAdmissionConfig *apiserver.AdmissionConfiguration ExpectedAdmissionConfig *apiserver.AdmissionConfiguration
PluginNames []string PluginNames []string
ExpectedError string
}{ }{
"duplicate field configuration error": {
ConfigBody: `{
"apiVersion": "apiserver.k8s.io/v1alpha1",
"kind": "AdmissionConfiguration",
"plugins": [
{"name": "ImagePolicyWebhook-duplicate", "name": "ImagePolicyWebhook", "path": "image-policy-webhook.json"},
{"name": "ResourceQuota"}
]}`,
ExpectedError: "strict decoding error: duplicate field",
},
"unknown field configuration error": {
ConfigBody: `{
"apiVersion": "apiserver.k8s.io/v1alpha1",
"kind": "AdmissionConfiguration",
"plugins": [
{"foo": "bar", "name": "ImagePolicyWebhook", "path": "image-policy-webhook.json"},
{"name": "ResourceQuota"}
]}`,
ExpectedError: "strict decoding error: unknown field",
},
"v1alpha1 configuration - path fixup": { "v1alpha1 configuration - path fixup": {
ConfigBody: `{ ConfigBody: `{
"apiVersion": "apiserver.k8s.io/v1alpha1", "apiVersion": "apiserver.k8s.io/v1alpha1",
@ -192,12 +214,18 @@ func TestReadAdmissionConfiguration(t *testing.T) {
t.Fatalf("unexpected err writing temp file: %v", err) t.Fatalf("unexpected err writing temp file: %v", err)
} }
config, err := ReadAdmissionConfiguration(testCase.PluginNames, configFileName, scheme) config, err := ReadAdmissionConfiguration(testCase.PluginNames, configFileName, scheme)
if err != nil { if testCase.ExpectedError != "" {
if err != nil {
assert.Contains(t, err.Error(), testCase.ExpectedError)
} else {
t.Fatalf("expected error %q but received none", testCase.ExpectedError)
}
} else if err != nil {
t.Fatalf("unexpected err: %v", err) t.Fatalf("unexpected err: %v", err)
} else if !reflect.DeepEqual(config.(configProvider).config, testCase.ExpectedAdmissionConfig) {
t.Fatalf("%s: Expected:\n\t%#v\nGot:\n\t%#v", testName, testCase.ExpectedAdmissionConfig, config.(configProvider).config)
} }
if !reflect.DeepEqual(config.(configProvider).config, testCase.ExpectedAdmissionConfig) {
t.Errorf("%s: Expected:\n\t%#v\nGot:\n\t%#v", testName, testCase.ExpectedAdmissionConfig, config.(configProvider).config)
}
} }
} }