编写一个动态准入控制

字数统计: 454阅读时长: 2 min

 2017/04/03 

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - name: test
    image: nginx:alpine

{
   "kind":"Pod",
   "apiVersion":"v1",
   "metadata":{
      "name":"test",
      "namespace":"default",
      "creationTimestamp":null,
      "annotations":{
         "kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"name\":\"test\",\"namespace\":\"default\"},\"spec\":{\"containers\":[{\"image\":\"nginx:alpine\",\"name\":\"test\"}]}}\n"
      }
   },
   "spec":{
      "volumes":[
         {
            "name":"default-token-lsh6v",
            "secret":{
               "secretName":"default-token-lsh6v"
            }
         }
      ],
      "containers":[
         {
            "name":"test",
            "image":"nginx:alpine",
            "resources":{
               
            },
            "volumeMounts":[
               {
                  "name":"default-token-lsh6v",
                  "readOnly":true,
                  "mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"
               }
            ],
            "terminationMessagePath":"/dev/termination-log",
            "terminationMessagePolicy":"File",
            "imagePullPolicy":"IfNotPresent"
         }
      ],
      "restartPolicy":"Always",
      "terminationGracePeriodSeconds":30,
      "dnsPolicy":"ClusterFirst",
      "serviceAccountName":"default",
      "serviceAccount":"default",
      "securityContext":{
         
      },
      "schedulerName":"default-scheduler",
      "enableServiceLinks":true
   },
   "status":{
      
   }
}


var (
	TerminationGracePeriodSeconds int64 = 30
	EnableServiceLinks = true
)

var pod = corev1.Pod{
	TypeMeta:   metav1.TypeMeta{
		Kind: "pod",
		APIVersion: "v1",
	},
	ObjectMeta: metav1.ObjectMeta{
		Name: "test",
		Namespace: "default",
		CreationTimestamp: metav1.Time{},
	},
	Spec:       corev1.PodSpec{
		Volumes: []corev1.Volume{
			{
				Name: "default-token-lsh6v",
				VolumeSource: corev1.VolumeSource{
					Secret: &corev1.SecretVolumeSource{
						SecretName: "default-token-lsh6v",
					},
				},
			},
		},
		Containers: []corev1.Container{
			{
				Name: "test",
				Image: "nginx:alpine",
				Resources: corev1.ResourceRequirements{},
				VolumeMounts: []corev1.VolumeMount{
					{
						Name: "default-token-lsh6v",
						ReadOnly: true,
						MountPath: "/var/run/secrets/kubernetes.io/serviceaccount",
					},
				},
			},
		},
		RestartPolicy: corev1.RestartPolicyAlways,
		TerminationGracePeriodSeconds: &TerminationGracePeriodSeconds,
		DNSPolicy: corev1.DNSClusterFirst,
		ServiceAccountName: "default",
		SecurityContext: &corev1.PodSecurityContext{},
		SchedulerName: "default-scheduler",
		EnableServiceLinks: &EnableServiceLinks,
	},
	Status:     corev1.PodStatus{},
}

https://github.com/redhat-cop/podpreset-webhook/blob/master/pkg/handler/handler.go#L107
https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/webhook/admission#PatchResponseFromRaw

原文作者：Zhangguanzhang

原文链接：http://zhangguanzhang.github.io/2017/04/03/kubernetes-admission-controllers/

发表日期：April 3rd 2017, 7:28:30 pm

更新日期：April 3rd 2017, 7:28:30 pm

Next Post

centos配置bond
Previous Post

Linux 僵尸进程处理

CATALOG