feat: kubesphere 4.0 (#6115)

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

---------

Signed-off-by: ci-bot <ci-bot@kubesphere.io>
Co-authored-by: ks-ci-bot <ks-ci-bot@example.com>
Co-authored-by: joyceliu <joyceliu@yunify.com>

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/conversion.go

@@ -1,112 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package generic
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apiserver/pkg/admission"
-)
-
-// ConvertToGVK converts object to the desired gvk.
-func ConvertToGVK(obj runtime.Object, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) (runtime.Object, error) {
-	// Unlike other resources, custom resources do not have internal version, so
-	// if obj is a custom resource, it should not need conversion.
-	if obj.GetObjectKind().GroupVersionKind() == gvk {
-		return obj, nil
-	}
-	out, err := o.GetObjectCreater().New(gvk)
-	if err != nil {
-		return nil, err
-	}
-	err = o.GetObjectConvertor().Convert(obj, out, nil)
-	if err != nil {
-		return nil, err
-	}
-	// Explicitly set the GVK
-	out.GetObjectKind().SetGroupVersionKind(gvk)
-	return out, nil
-}
-
-// NewVersionedAttributes returns versioned attributes with the old and new object (if non-nil) converted to the requested kind
-func NewVersionedAttributes(attr admission.Attributes, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) (*VersionedAttributes, error) {
-	// convert the old and new objects to the requested version
-	versionedAttr := &VersionedAttributes{
-		Attributes:    attr,
-		VersionedKind: gvk,
-	}
-	if oldObj := attr.GetOldObject(); oldObj != nil {
-		out, err := ConvertToGVK(oldObj, gvk, o)
-		if err != nil {
-			return nil, err
-		}
-		versionedAttr.VersionedOldObject = out
-	}
-	if obj := attr.GetObject(); obj != nil {
-		out, err := ConvertToGVK(obj, gvk, o)
-		if err != nil {
-			return nil, err
-		}
-		versionedAttr.VersionedObject = out
-	}
-	return versionedAttr, nil
-}
-
-// ConvertVersionedAttributes converts VersionedObject and VersionedOldObject to the specified kind, if needed.
-// If attr.VersionedKind already matches the requested kind, no conversion is performed.
-// If conversion is required:
-// * attr.VersionedObject is used as the source for the new object if Dirty=true (and is round-tripped through attr.Attributes.Object, clearing Dirty in the process)
-// * attr.Attributes.Object is used as the source for the new object if Dirty=false
-// * attr.Attributes.OldObject is used as the source for the old object
-func ConvertVersionedAttributes(attr *VersionedAttributes, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) error {
-	// we already have the desired kind, we're done
-	if attr.VersionedKind == gvk {
-		return nil
-	}
-
-	// convert the original old object to the desired GVK
-	if oldObj := attr.Attributes.GetOldObject(); oldObj != nil {
-		out, err := ConvertToGVK(oldObj, gvk, o)
-		if err != nil {
-			return err
-		}
-		attr.VersionedOldObject = out
-	}
-
-	if attr.VersionedObject != nil {
-		// convert the existing versioned object to internal
-		if attr.Dirty {
-			err := o.GetObjectConvertor().Convert(attr.VersionedObject, attr.Attributes.GetObject(), nil)
-			if err != nil {
-				return err
-			}
-		}
-
-		// and back to external
-		out, err := ConvertToGVK(attr.Attributes.GetObject(), gvk, o)
-		if err != nil {
-			return err
-		}
-		attr.VersionedObject = out
-	}
-
-	// Remember we converted to this version
-	attr.VersionedKind = gvk
-	attr.Dirty = false
-
-	return nil
-}

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go

@@ -19,43 +19,21 @@ package generic
 import (
 	"context"
 
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook"
 )
 
+type VersionedAttributeAccessor interface {
+	VersionedAttribute(gvk schema.GroupVersionKind) (*admission.VersionedAttributes, error)
+}
+
 // Source can list dynamic webhook plugins.
 type Source interface {
 	Webhooks() []webhook.WebhookAccessor
 	HasSynced() bool
 }
 
-// VersionedAttributes is a wrapper around the original admission attributes, adding versioned
-// variants of the object and old object.
-type VersionedAttributes struct {
-	// Attributes holds the original admission attributes
-	admission.Attributes
-	// VersionedOldObject holds Attributes.OldObject (if non-nil), converted to VersionedKind.
-	// It must never be mutated.
-	VersionedOldObject runtime.Object
-	// VersionedObject holds Attributes.Object (if non-nil), converted to VersionedKind.
-	// If mutated, Dirty must be set to true by the mutator.
-	VersionedObject runtime.Object
-	// VersionedKind holds the fully qualified kind
-	VersionedKind schema.GroupVersionKind
-	// Dirty indicates VersionedObject has been modified since being converted from Attributes.Object
-	Dirty bool
-}
-
-// GetObject overrides the Attributes.GetObject()
-func (v *VersionedAttributes) GetObject() runtime.Object {
-	if v.VersionedObject != nil {
-		return v.VersionedObject
-	}
-	return v.Attributes.GetObject()
-}
-
 // WebhookInvocation describes how to call a webhook, including the resource and subresource the webhook registered for,
 // and the kind that should be sent to the webhook.
 type WebhookInvocation struct {

vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go

@@ -21,18 +21,24 @@ import (
 	"fmt"
 	"io"
 
+	admissionmetrics "k8s.io/apiserver/pkg/admission/metrics"
+	"k8s.io/klog/v2"
+
 	admissionv1 "k8s.io/api/admission/v1"
 	admissionv1beta1 "k8s.io/api/admission/v1beta1"
-	"k8s.io/api/admissionregistration/v1"
+	v1 "k8s.io/api/admissionregistration/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
 	genericadmissioninit "k8s.io/apiserver/pkg/admission/initializer"
+	"k8s.io/apiserver/pkg/admission/plugin/cel"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/namespace"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/object"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/predicates/rules"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+	"k8s.io/apiserver/pkg/cel/environment"
 	webhookutil "k8s.io/apiserver/pkg/util/webhook"
 	"k8s.io/client-go/informers"
 	clientset "k8s.io/client-go/kubernetes"
@@ -49,6 +55,8 @@ type Webhook struct {
 	namespaceMatcher *namespace.Matcher
 	objectMatcher    *object.Matcher
 	dispatcher       Dispatcher
+	filterCompiler   cel.FilterCompiler
+	authorizer       authorizer.Authorizer
 }
 
 var (
@@ -92,6 +100,7 @@ func NewWebhook(handler *admission.Handler, configFile io.Reader, sourceFactory
 		namespaceMatcher: &namespace.Matcher{},
 		objectMatcher:    &object.Matcher{},
 		dispatcher:       dispatcherFactory(&cm),
+		filterCompiler:   cel.NewFilterCompiler(environment.MustBaseEnvSet(environment.DefaultCompatibilityVersion())),
 	}, nil
 }
 
@@ -124,6 +133,10 @@ func (a *Webhook) SetExternalKubeInformerFactory(f informers.SharedInformerFacto
 	})
 }
 
+func (a *Webhook) SetAuthorizer(authorizer authorizer.Authorizer) {
+	a.authorizer = authorizer
+}
+
 // ValidateInitialization implements the InitializationValidator interface.
 func (a *Webhook) ValidateInitialization() error {
 	if a.hookSource == nil {
@@ -140,7 +153,7 @@ func (a *Webhook) ValidateInitialization() error {
 
 // ShouldCallHook returns invocation details if the webhook should be called, nil if the webhook should not be called,
 // or an error if an error was encountered during evaluation.
-func (a *Webhook) ShouldCallHook(h webhook.WebhookAccessor, attr admission.Attributes, o admission.ObjectInterfaces) (*WebhookInvocation, *apierrors.StatusError) {
+func (a *Webhook) ShouldCallHook(ctx context.Context, h webhook.WebhookAccessor, attr admission.Attributes, o admission.ObjectInterfaces, v VersionedAttributeAccessor) (*WebhookInvocation, *apierrors.StatusError) {
 	matches, matchNsErr := a.namespaceMatcher.MatchNamespaceSelector(h, attr)
 	// Should not return an error here for webhooks which do not apply to the request, even if err is an unexpected scenario.
 	if !matches && matchNsErr == nil {
@@ -206,6 +219,25 @@ func (a *Webhook) ShouldCallHook(h webhook.WebhookAccessor, attr admission.Attri
 	if matchObjErr != nil {
 		return nil, matchObjErr
 	}
+	matchConditions := h.GetMatchConditions()
+	if len(matchConditions) > 0 {
+		versionedAttr, err := v.VersionedAttribute(invocation.Kind)
+		if err != nil {
+			return nil, apierrors.NewInternalError(err)
+		}
+
+		matcher := h.GetCompiledMatcher(a.filterCompiler)
+		matchResult := matcher.Match(ctx, versionedAttr, nil, a.authorizer)
+
+		if matchResult.Error != nil {
+			klog.Warningf("Failed evaluating match conditions, failing closed %v: %v", h.GetName(), matchResult.Error)
+			return nil, apierrors.NewForbidden(attr.GetResource().GroupResource(), attr.GetName(), matchResult.Error)
+		} else if !matchResult.Matches {
+			admissionmetrics.Metrics.ObserveMatchConditionExclusion(ctx, h.GetName(), "webhook", h.GetType(), string(attr.GetOperation()))
+			// if no match, always skip webhook
+			return nil, nil
+		}
+	}
 
 	return invocation, nil
 }