webhook: forbid use internal protocols (koordinator-sh#1911)

Signed-off-by: 刘硕 <liushuo@zetyun.com>
Co-authored-by: 刘硕 <liushuo@zetyun.com>

pkg/webhook/pod/validating/validating_handler.go

@@ -57,6 +57,10 @@ func (h *PodValidatingHandler) validatingPodFn(ctx context.Context, req admissio
 		klog.Warningf("Skip to validate pod %s/%s deletion for no old object, maybe because of Kubernetes version < 1.16", req.Namespace, req.Name)
 		return
 	}
+	_, reason, err = h.clusterReservationValidatingPod(ctx, req)
+	if err != nil {
+		return false, reason, err
+	}
 
 	allowed, reason, err = h.clusterColocationProfileValidatingPod(ctx, req)
 	if err == nil {

pkg/webhook/pod/validating/verify_annotations.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2022 The Koordinator Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validating
+
+import (
+	"context"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	"github.com/koordinator-sh/koordinator/apis/extension"
+	"github.com/koordinator-sh/koordinator/pkg/util/reservation"
+)
+
+func (h *PodValidatingHandler) clusterReservationValidatingPod(ctx context.Context, req admission.Request) (bool, string, error) {
+	newPod := &corev1.Pod{}
+	var allErrs field.ErrorList
+	switch req.Operation {
+	case admissionv1.Create:
+		if err := h.Decoder.DecodeRaw(req.Object, newPod); err != nil {
+			return false, "", err
+		}
+	case admissionv1.Update:
+		oldPod := &corev1.Pod{}
+		if err := h.Decoder.DecodeRaw(req.OldObject, oldPod); err != nil {
+			return false, "", err
+		}
+		if err := h.Decoder.DecodeRaw(req.Object, newPod); err != nil {
+			return false, "", err
+		}
+
+	}
+
+	allErrs = append(allErrs, forbidSpecialAnnotations(newPod)...)
+	err := allErrs.ToAggregate()
+	allowed := true
+	reason := ""
+	if err != nil {
+		allowed = false
+		reason = err.Error()
+	}
+	return allowed, reason, err
+}
+
+var forbidAnnotations = []string{
+	extension.AnnotationReservationAllocated,
+	reservation.AnnotationReservePod,
+}
+
+func forbidSpecialAnnotations(pod *corev1.Pod) field.ErrorList {
+	if pod.Annotations == nil {
+		return nil
+	}
+	errorList := field.ErrorList{}
+
+	for _, annotation := range forbidAnnotations {
+		if _, ok := pod.Annotations[annotation]; ok {
+			errorList = append(errorList, field.Forbidden(field.NewPath("annotations", extension.AnnotationReservationAllocated), "cannot set in annotations"))
+		}
+	}
+	return errorList
+}

pkg/webhook/pod/validating/verify_annotations_test.go

@@ -0,0 +1,105 @@
+/*
+Copyright 2022 The Koordinator Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validating
+
+import (
+	"context"
+	"testing"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	configv1alpha1 "github.com/koordinator-sh/koordinator/apis/config/v1alpha1"
+	"github.com/koordinator-sh/koordinator/apis/extension"
+	"github.com/koordinator-sh/koordinator/pkg/util"
+)
+
+func init() {
+	_ = configv1alpha1.AddToScheme(scheme.Scheme)
+}
+
+func TestClusterReservationValidatingPod(t *testing.T) {
+	tests := []struct {
+		name        string
+		operation   admissionv1.Operation
+		oldPod      *corev1.Pod
+		newPod      *corev1.Pod
+		wantAllowed bool
+		wantReason  string
+		wantErr     bool
+	}{
+
+		{
+			name:      "forbidden resources annotations",
+			operation: admissionv1.Create,
+			newPod: &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						extension.AnnotationReservationAllocated: "",
+					},
+				},
+			},
+			wantErr:     true,
+			wantAllowed: false,
+			wantReason:  `annotations.scheduling.koordinator.sh/reservation-allocated: Forbidden: cannot set in annotations`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client := fake.NewClientBuilder().Build()
+			decoder, _ := admission.NewDecoder(scheme.Scheme)
+			h := &PodValidatingHandler{
+				Client:  client,
+				Decoder: decoder,
+			}
+
+			var objRawExt, oldObjRawExt runtime.RawExtension
+			if tt.newPod != nil {
+				objRawExt = runtime.RawExtension{
+					Raw: []byte(util.DumpJSON(tt.newPod)),
+				}
+			}
+			if tt.oldPod != nil {
+				oldObjRawExt = runtime.RawExtension{
+					Raw: []byte(util.DumpJSON(tt.oldPod)),
+				}
+			}
+
+			req := newAdmissionRequest(tt.operation, objRawExt, oldObjRawExt, "pods")
+			gotAllowed, gotReason, err := h.clusterReservationValidatingPod(context.TODO(), admission.Request{AdmissionRequest: req})
+			if (err != nil) != tt.wantErr {
+				t.Errorf("clusterReservationValidatingPod() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if gotAllowed != tt.wantAllowed {
+				t.Errorf("clusterReservationValidatingPod() gotAllowed = %v, want %v", gotAllowed, tt.wantAllowed)
+			}
+			if gotReason != tt.wantReason {
+				t.Errorf("clusterReservationValidatingPod():\n"+
+					"gotReason = %v,\n"+
+					"want = %v", gotReason, tt.wantReason)
+				t.Errorf("got=%v, want=%v", len(gotReason), len(tt.wantReason))
+			}
+		})
+	}
+}