API Server Poc

apiserver/resource.go

@@ -37,18 +37,6 @@ type Resource struct {
  Reconciler operator.Reconciler // TODO: do we want this here, or only here for the simple package version?
 }
 
-func (r *Resource) RegisterAdmissionPlugin(plugins *admission.Plugins) {
- if r.Validator == nil && r.Mutator == nil {
- fmt.Printf("Resource %s has no admission plugins\n", r.Kind.Kind())
- return
- }
- gvk := r.Kind.Group() + "/" + r.Kind.Version() + "/" + r.Kind.Kind()
- fmt.Printf("Registering admission plugins for %s\n", gvk)
- plugins.Register(gvk+"Admission", func(config io.Reader) (admission.Interface, error) {
- return &AdmissionWrapper{resource: r}, nil
- })
-}
-
 func (r *Resource) AddToScheme(scheme *runtime.Scheme) {
  gv := schema.GroupVersion{
  Group: r.Kind.Group(),
@@ -65,89 +53,79 @@ func (r *Resource) AddToScheme(scheme *runtime.Scheme) {
  }
 }
 
-var _ admission.MutationInterface = &AdmissionWrapper{}
-var _ admission.ValidationInterface = &AdmissionWrapper{}
-var _ admission.Interface = &AdmissionWrapper{}
-
-type AdmissionWrapper struct {
- resource *Resource
+func (r *Resource) RegisterAdmissionPlugin(plugins *admission.Plugins) {
+ if r.Validator == nil && r.Mutator == nil {
+ return
+ }
+ gvk := r.Kind.Group() + "/" + r.Kind.Version() + "/" + r.Kind.Kind()
+ plugins.Register(gvk+"Admission", func(config io.Reader) (admission.Interface, error) {
+ return r, nil
+ })
 }
 
-func (v *AdmissionWrapper) Handles(o admission.Operation) bool {
- if v.resource.Validator == nil && v.resource.Mutator == nil {
+func (r *Resource) Handles(o admission.Operation) bool {
+ if r.Validator == nil && r.Mutator == nil {
  return false
  }
  return true
 }
 
-func (v *AdmissionWrapper) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
- if v.resource.Validator == nil {
+func (r *Resource) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+ if r.Validator == nil {
  return nil
  }
 
- // skip if the gvk doesn't match
- if a.GetKind().Kind != v.resource.Kind.Kind() || a.GetKind().Group != v.resource.Kind.Group() || a.GetKind().Version != v.resource.Kind.Version() {
+ if !r.matchesResouce(a) {
  return nil
  }
 
- userInfoExtra := make(map[string]any)
- for k, v := range a.GetUserInfo().GetExtra() {
- userInfoExtra[k] = v
+ req, err := buildAdmissionRequest(a)
+ if err != nil {
+ return err
  }
 
- userInfo := resource.AdmissionUserInfo{}
- if a.GetUserInfo() != nil {
- userInfoExtra := make(map[string]any)
- for k, v := range a.GetUserInfo().GetExtra() {
- userInfoExtra[k] = v
- }
- userInfo.Extra = userInfoExtra
- userInfo.Groups = a.GetUserInfo().GetGroups()
- userInfo.UID = a.GetUserInfo().GetUID()
- userInfo.Username = a.GetUserInfo().GetName()
+ return r.Validator.Validate(ctx, req)
+}
+
+func (r *Resource) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+ if r.Mutator == nil {
+ return nil
  }
 
- var (
- obj, oldObj resource.Object
- ok bool
- )
+ if !r.matchesResouce(a) {
+ return nil
+ }
 
- obj, ok = a.GetObject().(resource.Object)
- if !ok {
- return errors.NewInternalError(fmt.Errorf("new obj is not a valid resource.Object"))
+ req, err := buildAdmissionRequest(a)
+ if err != nil {
+ return err
  }
 
- if a.GetOldObject() != nil {
- oldObj, ok = a.GetOldObject().(resource.Object)
- if !ok {
- return errors.NewInternalError(fmt.Errorf("old object is not a valid resource.Object"))
- }
+ res, err := r.Mutator.Mutate(ctx, req)
+ if err != nil {
+ return err
  }
 
- req := &resource.AdmissionRequest{
- Action: resource.AdmissionAction(a.GetOperation()),
- Kind: a.GetKind().Kind,
- Group: a.GetKind().Group,
- Version: a.GetKind().Group,
- UserInfo: userInfo,
- Object: obj,
- OldObject: oldObj,
+ if err := copyModifiedObjectToDestination(res.UpdatedObject, req.Object); err != nil {
+ return errors.NewInternalError(fmt.Errorf("unable to copy updated object to destination: %w", err))
  }
 
- return v.resource.Validator.Validate(ctx, req)
+ return nil
 }
 
-func (v *AdmissionWrapper) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
- if v.resource.Mutator == nil {
- return nil
- }
-
- // skip if the gvk doesn't match
- if a.GetKind().Kind != v.resource.Kind.Kind() || a.GetKind().Group != v.resource.Kind.Group() || a.GetKind().Version != v.resource.Kind.Version() {
- return nil
- }
+func (r *Resource) matchesResouce(a admission.Attributes) bool {
+ kindMatch := a.GetKind().Kind == r.Kind.Kind()
+ groupMatch := a.GetKind().Group == r.Kind.Group()
+ versionMatch := a.GetKind().Version == r.Kind.Version()
+ return kindMatch && groupMatch && versionMatch
+}
 
- userInfo := resource.AdmissionUserInfo{}
+func buildAdmissionRequest(a admission.Attributes) (*resource.AdmissionRequest, error) {
+ var (
+ userInfo = resource.AdmissionUserInfo{}
+ obj, oldObj resource.Object
+ ok bool
+ )
  if a.GetUserInfo() != nil {
  userInfoExtra := make(map[string]any)
  for k, v := range a.GetUserInfo().GetExtra() {
@@ -159,43 +137,27 @@ func (v *AdmissionWrapper) Admit(ctx context.Context, a admission.Attributes, o
  userInfo.Username = a.GetUserInfo().GetName()
  }
 
- var (
- obj, oldObj resource.Object
- ok bool
- )
-
  obj, ok = a.GetObject().(resource.Object)
  if !ok {
- return errors.NewInternalError(fmt.Errorf("new obj is not a valid resource.Object"))
+ return nil, errors.NewInternalError(fmt.Errorf("new obj is not a valid resource.Object"))
  }
 
  if a.GetOldObject() != nil {
  oldObj, ok = a.GetOldObject().(resource.Object)
  if !ok {
- return errors.NewInternalError(fmt.Errorf("old object is not a valid resource.Object"))
+ return nil, errors.NewInternalError(fmt.Errorf("old object is not a valid resource.Object"))
  }
  }
 
- req := &resource.AdmissionRequest{
+ return &resource.AdmissionRequest{
  Action: resource.AdmissionAction(a.GetOperation()),
  Kind: a.GetKind().Kind,
  Group: a.GetKind().Group,
  Version: a.GetKind().Group,
  UserInfo: userInfo,
  Object: obj,
  OldObject: oldObj,
- }
-
- res, err := v.resource.Mutator.Mutate(ctx, req)
- if err != nil {
- return err
- }
-
- if err := copyModifiedObjectToDestination(res.UpdatedObject, obj); err != nil {
- return errors.NewInternalError(fmt.Errorf("unable to copy updated object to destination: %w", err))
- }
-
- return nil
+ }, nil
 }
 
 func copyModifiedObjectToDestination(updatedObj runtime.Object, destination runtime.Object) error {
@@ -248,30 +210,18 @@ type ResourceGroup struct {
  // This SHOULD be supplied if multiple versions of the same GroupKind exist in the ResourceGroup.
  // If not supplied, a GenericConverter will be used for all conversions.
  // This can be empty or nil and specific MutatingAdmissionControllers can be set later with Operator.MutateKind
- Converters map[metav1.GroupKind]Converter
+ converters map[metav1.GroupKind]Converter
 }
 
-func (g *ResourceGroup) Scheme() *runtime.Scheme {
- scheme := runtime.NewScheme()
- g.AddToScheme(scheme)
- return scheme
+func NewResourceGroup(name string, resources []Resource) *ResourceGroup {
+ g := &ResourceGroup{
+ Name: name,
+ Resources: resources,
+ }
+ return g
 }
 
-func (g *ResourceGroup) AddToScheme(scheme *runtime.Scheme) {
- // we need to add the options to empty v1
- // TODO fix the server code to avoid this
- metav1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
-
- // TODO: keep the generic API server from wanting this
- unversioned := schema.GroupVersion{Group: "", Version: "v1"}
- scheme.AddUnversionedTypes(unversioned,
- &metav1.Status{},
- &metav1.APIVersions{},
- &metav1.APIGroupList{},
- &metav1.APIGroup{},
- &metav1.APIResourceList{},
- )
-
+func (g *ResourceGroup) AddToScheme(scheme *runtime.Scheme) error {
  // TODO: this assumes items in the Resources slice are ordered by version
  versions := make(map[metav1.GroupKind][]Resource)
  for _, r := range g.Resources {
@@ -291,14 +241,15 @@ func (g *ResourceGroup) AddToScheme(scheme *runtime.Scheme) {
  Group: latest.Kind.Group(),
  Version: runtime.APIVersionInternal,
  }
+
  scheme.AddKnownTypeWithName(gv.WithKind(gk.Kind), latest.Kind.ZeroValue())
  scheme.AddKnownTypeWithName(gv.WithKind(gk.Kind+"List"), latest.Kind.ZeroListValue())
 
  // Get the converter for this GroupKind, or use a Generic one if none was supplied
  var converter Converter = GenericConverter{}
- if g.Converters != nil {
+ if g.converters != nil {
  ok := false
- converter, ok = g.Converters[gk]
+ converter, ok = g.converters[gk]
  if !ok {
  converter = GenericConverter{}
  }
@@ -325,6 +276,7 @@ func (g *ResourceGroup) AddToScheme(scheme *runtime.Scheme) {
  // Set version priorities based on the reverse-order list we built
  scheme.SetVersionPriority(priorities...)
  }
+ return nil
 }
 
 type StorageProviderFunc func(resource.Kind, *runtime.Scheme, generic.RESTOptionsGetter) (rest.Storage, error)
@@ -343,10 +295,7 @@ type StorageProvider2 interface {
  StandardStorage(kind resource.Kind, scheme *runtime.Scheme) (StandardStorage, error)
 }
 
-func (g *ResourceGroup) APIGroupInfo(storageProvider StorageProvider2) (*server.APIGroupInfo, error) {
- scheme := g.Scheme() // TODO: have this be an argument?
- parameterCodec := runtime.NewParameterCodec(scheme) // TODO: have this be an argument?
- codecs := serializer.NewCodecFactory(scheme) // TODO: codec based on kinds?
+func (g *ResourceGroup) APIGroupInfo(scheme *runtime.Scheme, codecs serializer.CodecFactory, parameterCodec runtime.ParameterCodec, storageProvider StorageProvider2) (*server.APIGroupInfo, error) {
  apiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(g.Name, scheme, parameterCodec, codecs)
  for _, r := range g.Resources {
  plural := strings.ToLower(r.Kind.Plural())

examples/apiserver/main.go

@@ -54,14 +54,11 @@ func main() {
  // apiserver.Resource items must be added to an apiserver.ResourceGroup.
  // Currently, there is no validation that the Name in the ResourceGroup matches the Group in each added Resource
  // TODO: have a Validate() method on ResourceGroup to check that?
- resourceGroup := apiserver.ResourceGroup{
- Name: corev1.ExternalNameKind().Group(),
- Resources: []apiserver.Resource{externalNameV1, externalNameV2},
- }
+ resourceGroup := apiserver.NewResourceGroup(corev1.ExternalNameKind().Group(), []apiserver.Resource{externalNameV1, externalNameV2})
 
  // APIServerOptions is used to create the API server from one or more ResourceGroups.
  // TODO: this will be expanded upon
- o := simple.NewAPIServerOptions([]apiserver.ResourceGroup{resourceGroup}, os.Stdout, os.Stderr)
+ o := simple.NewAPIServerOptions([]apiserver.ResourceGroup{*resourceGroup}, os.Stdout, os.Stderr)
  o.RecommendedOptions.Authorization = nil
  o.RecommendedOptions.Authentication = nil
  o.RecommendedOptions.CoreAPI = nil

simple/apiserver.go

@@ -102,8 +102,8 @@ type Server struct {
 }
 
 func (c completedConfig) NewServer() (*Server, error) {
- //scheme := c.ExtraConfig.Scheme
- //codecs := c.ExtraConfig.Codecs
+ scheme := c.ExtraConfig.Scheme
+ codecs := c.ExtraConfig.Codecs
  openapiGetters := []common.GetOpenAPIDefinitions{}
 
  for _, g := range c.ExtraConfig.ResourceGroups {
@@ -129,10 +129,10 @@ func (c completedConfig) NewServer() (*Server, error) {
  GenericAPIServer: genericServer,
  }
 
- //parameterCodec := runtime.NewParameterCodec(scheme)
+ parameterCodec := runtime.NewParameterCodec(scheme)
  provider := apiserver.NewRESTStorageProvider(c.GenericConfig.RESTOptionsGetter)
  for _, g := range c.ExtraConfig.ResourceGroups {
- apiGroupInfo, err := g.APIGroupInfo(provider)
+ apiGroupInfo, err := g.APIGroupInfo(scheme, codecs, parameterCodec, provider)
  if err != nil {
  return nil, err
  }
@@ -166,7 +166,6 @@ func NewAPIServerOptions(groups []apiserver.ResourceGroup, out, errOut io.Writer
  Version: r.Kind.Version(),
  }
  gvs = append(gvs, gv)
-
  }
  }
 
@@ -184,8 +183,9 @@ func NewAPIServerOptions(groups []apiserver.ResourceGroup, out, errOut io.Writer
  }
 
  o.RecommendedOptions.Admission.Plugins = admission.NewPlugins()
- for _, g := range groups {
- for _, r := range g.Resources {
+ for gid, g := range groups {
+ for rid, _ := range g.Resources {
+ r := &groups[gid].Resources[rid]
  r.RegisterAdmissionPlugin(o.RecommendedOptions.Admission.Plugins)
  }
  }