Skip to content

Conversation

@ryotarai
Copy link
Collaborator

@ryotarai ryotarai commented Aug 18, 2025

  • Confirm that the webhooks work on kind cluster.
  • Replace objects validator too.

fixes #20

@ryotarai ryotarai changed the title Replace webhooks with WebhookManagedBy. Replace webhook implementation with WebhookManagedBy. Aug 18, 2025
ryotarai and others added 11 commits September 1, 2025 21:27
Updates the hncconfig validator to use the modern WebhookManagedBy pattern
instead of manual webhook registration, following the same approach used
for HierarchyConfiguration.

Changes:
- Add NewValidator constructor function
- Replace Handle method with ValidateCreate/Update/Delete methods
- Convert internal validation logic to return errors instead of admission responses
- Update webhook registration in setup/webhooks.go to use WebhookManagedBy
- Update tests to use new API and remove unused logResult function

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
Updates the anchor (SubnamespaceAnchor) validator to use the modern
WebhookManagedBy pattern instead of manual webhook registration.

Changes:
- Add NewValidator constructor function
- Replace Handle method with ValidateCreate/Update/Delete methods
- Convert internal validation logic to return errors instead of admission responses
- Update webhook registration in setup/webhooks.go to use WebhookManagedBy
- Update tests to use new handleValidation method and remove unused logResult function

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
Updates the namespace validator to use the modern WebhookManagedBy pattern
instead of manual webhook registration.

Changes:
- Add NewValidator constructor function
- Replace Handle method with ValidateCreate/Update/Delete methods
- Convert internal validation logic to return errors instead of admission responses
- Update all validation methods to return errors
- Update webhook registration in setup/webhooks.go to use WebhookManagedBy
- Update tests to use new handleValidation method and remove unused logResult function

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
Updates the namespace mutator to use the modern WebhookManagedBy pattern
instead of manual webhook registration.

Changes:
- Add NewMutator constructor function
- Replace Handle method with Default method for the defaulter interface
- Rename internal handle method to mutateNamespace
- Update webhook registration in setup/webhooks.go to use WebhookManagedBy with WithDefaulter
- Update tests to use new mutateNamespace method
- Remove unused imports and InjectDecoder method

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
- Convert ResourceQuotaStatus to use ValidateCreate/Update/Delete methods instead of Handle
- Add NewResourceQuotaStatus constructor with client and forest parameters
- Update validateResourceQuotaStatus to return errors instead of admission responses
- Add helper functions for admission responses (allow, deny, denyInvalidField, codeFromReason)
- Update tests to use validateHRQResourceQuotaStatus method directly
- Remove old injection methods (InjectClient, InjectDecoder)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
- Convert HRQ to use ValidateCreate/Update/Delete methods instead of Handle
- Add NewHRQ constructor with client parameter for dry-run client setup
- Update validate method to return errors instead of admission responses
- Convert validation to use apierrors.NewInvalid with field validation
- Update tests to use validate method directly with error checking
- Remove old injection methods (InjectClient, InjectDecoder)
- Add missing imports for field validation and runtime types

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
…a and HierarchicalResourceQuota.

- Replace manual webhook registration with builder.WebhookManagedBy() pattern
- Use NewResourceQuotaStatus constructor for ResourceQuota webhook
- Use NewHRQ constructor for HierarchicalResourceQuota webhook
- Add proper error handling for webhook creation
- Remove old manual injection and registration code

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
@ryotarai
Copy link
Collaborator Author

ryotarai commented Oct 3, 2025

Confirmed the validator for HierarchyConfiguration works:

❯   kubectl create ns parent
namespace/parent created

❯ kubectl apply -f - <<EOF
apiVersion: hnc.x-k8s.io/v1alpha2
kind: HierarchyConfiguration
metadata:
  name: hierarchy
  namespace: kube-system
spec:
  parent: parent
EOF
Error from server (Forbidden): error when creating "STDIN": admission webhook "hierarchyconfigurations.hnc.x-k8s.io" denied the request: hierarchyconfigurations.hnc.x-k8s.io "hierarchy" is forbidden: namespace "kube-system" is not managed by HNC (excluded by the HNC administrator) and cannot be set as a child of another namespace

}

// Create webhooks for managed objects
// Note: We cannot use WebhookManagedBy here because objects validator handles all resource types dynamically (*)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We cannot use WebhookManagedBy here because getType(), which is called by registerWebhooks, returns an error when the type is not set.

https://github.com/kubernetes-sigs/controller-runtime/blob/v0.20.4/pkg/builder/webhook.go#L263-L268

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👀

@ryotarai ryotarai marked this pull request as ready for review October 17, 2025 02:31
Copy link
Member

@utam0k utam0k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/hold for @superbrothers's review
Thanks. AFAI, the existing core logic remains unchanged, but the details have been modified to support WebhookManagedBy, such as returning err.

@superbrothers superbrothers merged commit e37741d into pfnet:master Oct 30, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Register webhooks by using sigs.k8s.io/controller-runtime/pkg/builder.WebhookManagedBy

3 participants