如何为kubernetes准入控制器编写响应

Question

我正试图为pod命名(验证(编写一个简单的准入控制器，但由于某种原因，我生成了错误的响应。

这是我的代码：

package main
import (
"fmt" 
"encoding/json"
"io/ioutil"
"net/http"
"github.com/golang/glog"
// for Kubernetes 
"k8s.io/api/admission/v1beta1"
"k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"regexp"
)
type myValidServerhandler struct {
}
// this is the handler fuction from the HTTP server 
func (gs *myValidServerhandler) serve(w http.ResponseWriter, r *http.Request) {
var Body []byte
if r.Body != nil {
if data , err := ioutil.ReadAll(r.Body); err == nil {
Body = data
}
}
if len(Body) == 0 {
glog.Error("Unable to retrive Body from API")
http.Error(w,"Empty Body", http.StatusBadRequest)
return
}
glog.Info("Received Request")
// this is where I make sure the request is for the validation prefix
if r.URL.Path != "/validate" {
glog.Error("Not a Validataion String")
http.Error(w,"Not a Validataion String", http.StatusBadRequest)
return
}
// in this part the function takes the AdmissionReivew and make sure in is in the right
// JSON format 
arRequest := &v1beta1.AdmissionReview{}
if err := json.Unmarshal(Body, arRequest); err != nil {
glog.Error("incorrect Body")
http.Error(w, "incorrect Body", http.StatusBadRequest)
return
}
raw := arRequest.Request.Object.Raw
pod := v1.Pod{}
if err := json.Unmarshal(raw, &pod); err != nil {
glog.Error("Error Deserializing Pod")
return
}
// this is where I make sure the pod name contains the kuku string
podnamingReg := regexp.MustCompile(`kuku`)
if podnamingReg.MatchString(string(pod.Name)) {
return
} else {
glog.Error("the pod does not contain "kuku"")
http.Error(w, "the pod does not contain "kuku"", http.StatusBadRequest)
return
}
// I think the main problem is with this part of the code because the 
// error from the events I getting in the Kubernetes namespace is that 
// I am sending 200 without a body response
arResponse := v1beta1.AdmissionReview{
Response: &v1beta1.AdmissionResponse{
Result:  &metav1.Status{},
Allowed: true,
},
}
// generating the JSON response after the validation 
resp, err := json.Marshal(arResponse)
if err != nil {
glog.Error("Can't encode response:", err)
http.Error(w, fmt.Sprintf("couldn't encode response: %v", err), http.StatusInternalServerError)
}
glog.Infof("Ready to write  response ...")
if _, err := w.Write(resp); err != nil {
glog.Error("Can't write response", err)
http.Error(w, fmt.Sprintf("cloud not write response: %v", err), http.StatusInternalServerError)
}
}

除了正输出(pod名称符合条件(外，代码仍按预期工作还有另一个文件的main只是获取TLS文件并启动HTTP服务。

Answer 1

所以经过几次挖掘，我发现我的代码有什么问题

第一部分

if podnamingReg.MatchString(string(pod.Name)) {
return
} else {
glog.Error("the pod does not contain "kuku"")
http.Error(w, "the pod does not contain "kuku"", http.StatusBadRequest)
return
}

通过书写"；返回"；我两次放弃了其余的代码，所以我没有将请求UID附加到响应UID，因为我使用的是v1，而不是v1beta1，所以我需要在响应中添加APIVersion所以代码的其余部分看起来像：

arResponse := v1beta1.AdmissionReview{
Response: &v1beta1.AdmissionResponse{
Result:  &metav1.Status{},
Allowed: false,
},
}
podnamingReg := regexp.MustCompile(`kuku`)
if podnamingReg.MatchString(string(pod.Name)) {
fmt.Printf("the pod %s is up to the name standard", pod.Name)
arResponse.Response.Allowed = true  
} 
arResponse.APIVersion = "admission.k8s.io/v1"
arResponse.Kind = arRequest.Kind
arResponse.Response.UID = arRequest.Request.UID

所以我需要添加两个部分，并确保在吊舱名称不符合标准的情况下，我需要返回正确的响应