Admission webhooks for validation & mutation

[nolar]

This is an early preview of admission webhooks.

For documentation preview, see:

• https://kopf.readthedocs.io/en/admission-hooks/admission/

A brief functional example:

import warnings

import kopf


@kopf.on.startup()
def config(settings: kopf.OperatorSettings, **_):
    settings.admission.managed = 'auto.kopf.dev'
    # settings.admission.server = kopf.WebhookServer()
    # settings.admission.server = kopf.WebhookServer(certfile='../../cert.pem', pkeyfile='../../key.pem', port=1234)
    # settings.admission.server = kopf.WebhookK3dServer(certfile='../../k3d-cert.pem', pkeyfile='../../k3d-key.pem', port=1234)
    # settings.admission.server = kopf.WebhookK3dServer(port=1234, cadump='../../ca.pem', verify_cafile='../../client-cert.pem')
    settings.admission.server = kopf.WebhookNgrokTunnel(binary="/usr/local/bin/ngrok", port=1234)


@kopf.on.validate('kopfexamples')
def validate1(spec, dryrun, **_):
    print(f'{dryrun=}')
    if spec.get('field') == 'value':
        raise kopf.AdmissionError("Meh! I don't like it. Change the field.")


@kopf.on.validate('kopfexamples')
def validate2(**_):
    raise kopf.AdmissionError("I'm too lazy anyway. Go away!", status=555)


@kopf.on.validate('kopfexamples')
def authhook(headers, sslpeer, **_):
    print(f'{headers=}')
    print(f'{sslpeer=}')
    if sslpeer is None:
        warnings.warn("SSL peer is not identified.")
    else:
        common_name = None
        for key, val in sslpeer['subject'][0]:
            if key == 'commonName':
                common_name = val
                break
        else:
            warnings.warn("SSL peer's common name is absent.")
        if common_name is not None:
            warnings.warn(f"SSL peer is {common_name}.")


@kopf.on.mutate('kex', labels={'somelabel': 'somevalue'})
def mutate1(patch: kopf.Patch, **_):
    patch.spec['injected'] = 123

[lgtm-com]

This pull request introduces 1 alert when merging 6d32bf3 into 8a08e0a - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 6d32bf3 into e71dc60 - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 3 alerts when merging 7dd0d93 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Wrong name for an argument in a call
• 1 for Wrong name for an argument in a class instantiation
• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 3 alerts when merging 8d20d7a into e90ceaa - view on LGTM.com

new alerts:

• 1 for Wrong name for an argument in a call
• 1 for Wrong name for an argument in a class instantiation
• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 3 alerts when merging 11a52ef into e90ceaa - view on LGTM.com

new alerts:

• 1 for Wrong name for an argument in a call
• 1 for Wrong name for an argument in a class instantiation
• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 3 alerts when merging 6059f3a into e90ceaa - view on LGTM.com

new alerts:

• 1 for Wrong name for an argument in a call
• 1 for Wrong name for an argument in a class instantiation
• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 2 alerts when merging 4a22f40 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Wrong name for an argument in a class instantiation
• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging ebe9ec9 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 0dc46bf into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 45f2b68 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 24cd933 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 77d4d57 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 1 alert when merging 405b346 into e90ceaa - view on LGTM.com

new alerts:

• 1 for Unguarded next in generator

[lgtm-com]

This pull request introduces 31 alerts when merging e89ac21 into 0ad6551 - view on LGTM.com

new alerts:

• 31 for Module-level cyclic import