feat: kubesphere 4.0 (#6115)

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

---------

Signed-off-by: ci-bot <ci-bot@kubesphere.io>
Co-authored-by: ks-ci-bot <ks-ci-bot@example.com>
Co-authored-by: joyceliu <joyceliu@yunify.com>

pkg/controller/cluster/cluster_webhook.go

@@ -1,85 +1,88 @@
 /*
-Copyright 2020 The KubeSphere Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
+ * Please refer to the LICENSE file in the root directory of the project.
+ * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
+ */
 
 package cluster
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"net/http"
+	"strings"
+
+	kscontroller "kubesphere.io/kubesphere/pkg/controller"
 
-	v1 "k8s.io/api/admission/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
-	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	clusterv1alpha1 "kubesphere.io/api/cluster/v1alpha1"
 )
 
-type ValidatingHandler struct {
-	Client  client.Client
-	decoder *admission.Decoder
+const webhookName = "cluster-webhook"
+
+func (v *Webhook) Name() string {
+	return webhookName
 }
 
-var _ admission.DecoderInjector = &ValidatingHandler{}
-
-// InjectDecoder injects the decoder into a ValidatingHandler.
-func (h *ValidatingHandler) InjectDecoder(d *admission.Decoder) error {
-	h.decoder = d
-	return nil
+func (v *Webhook) Enabled(clusterRole string) bool {
+	return strings.EqualFold(clusterRole, string(clusterv1alpha1.ClusterRoleHost))
 }
 
-// Handle handles admission requests.
-func (h *ValidatingHandler) Handle(ctx context.Context, req admission.Request) admission.Response {
-	if req.Operation != v1.Update {
-		return admission.Allowed("")
-	}
+var _ kscontroller.Controller = &Webhook{}
+var _ admission.CustomValidator = &Webhook{}
 
-	newCluster := &clusterv1alpha1.Cluster{}
-	if err := h.decoder.DecodeRaw(req.Object, newCluster); err != nil {
-		return admission.Errored(http.StatusBadRequest, err)
-	}
+type Webhook struct {
+}
 
-	oldCluster := &clusterv1alpha1.Cluster{}
-	if err := h.decoder.DecodeRaw(req.OldObject, oldCluster); err != nil {
-		return admission.Errored(http.StatusBadRequest, err)
+func (v *Webhook) SetupWithManager(mgr *kscontroller.Manager) error {
+	return builder.WebhookManagedBy(mgr).
+		For(&clusterv1alpha1.Cluster{}).
+		WithValidator(v).
+		Complete()
+}
+
+func (v *Webhook) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	return nil, nil
+}
+
+func (v *Webhook) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
+	oldCluster, ok := oldObj.(*clusterv1alpha1.Cluster)
+	if !ok {
+		return nil, fmt.Errorf("expected a Cluster but got a %T", oldObj)
+	}
+	newCluster, ok := newObj.(*clusterv1alpha1.Cluster)
+	if !ok {
+		return nil, fmt.Errorf("expected a Cluster but got a %T", newObj)
 	}
 
 	// The cluster created for the first time has no status information
 	if oldCluster.Status.UID == "" {
-		return admission.Allowed("")
+		return nil, nil
 	}
 
 	clusterConfig, err := clientcmd.RESTConfigFromKubeConfig(newCluster.Spec.Connection.KubeConfig)
 	if err != nil {
-		return admission.Denied(fmt.Sprintf("failed to load cluster config for %s: %s", newCluster.Name, err))
+		return nil, fmt.Errorf("failed to load cluster config for %s: %s", newCluster.Name, err)
 	}
 	clusterClient, err := kubernetes.NewForConfig(clusterConfig)
 	if err != nil {
-		return admission.Denied(err.Error())
+		return nil, err
 	}
 	kubeSystem, err := clusterClient.CoreV1().Namespaces().Get(ctx, metav1.NamespaceSystem, metav1.GetOptions{})
 	if err != nil {
-		return admission.Denied(err.Error())
+		return nil, err
 	}
-
 	if oldCluster.Status.UID != kubeSystem.UID {
-		return admission.Denied("this kubeconfig corresponds to a different cluster than the previous one, you need to make sure that kubeconfig is not from another cluster")
+		return nil, errors.New("this kubeconfig corresponds to a different cluster than the previous one, you need to make sure that kubeconfig is not from another cluster")
 	}
-	return admission.Allowed("")
+	return nil, nil
+}
+
+func (v *Webhook) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	return nil, nil
 }