admission.go 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. /*
  2. Copyright 2017 The Kubernetes Authors.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. */
  13. package storageobjectinuseprotection
  14. import (
  15. "context"
  16. "io"
  17. "k8s.io/apiserver/pkg/admission"
  18. "k8s.io/apiserver/pkg/admission/initializer"
  19. "k8s.io/component-base/featuregate"
  20. "k8s.io/klog"
  21. api "k8s.io/kubernetes/pkg/apis/core"
  22. "k8s.io/kubernetes/pkg/features"
  23. volumeutil "k8s.io/kubernetes/pkg/volume/util"
  24. )
  25. const (
  26. // PluginName is the name of this admission controller plugin
  27. PluginName = "StorageObjectInUseProtection"
  28. )
  29. // Register registers a plugin
  30. func Register(plugins *admission.Plugins) {
  31. plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
  32. plugin := newPlugin()
  33. return plugin, nil
  34. })
  35. }
  36. // storageProtectionPlugin holds state for and implements the admission plugin.
  37. type storageProtectionPlugin struct {
  38. *admission.Handler
  39. storageObjectInUseProtection bool
  40. }
  41. var _ admission.Interface = &storageProtectionPlugin{}
  42. var _ initializer.WantsFeatures = &storageProtectionPlugin{}
  43. // newPlugin creates a new admission plugin.
  44. func newPlugin() *storageProtectionPlugin {
  45. return &storageProtectionPlugin{
  46. Handler: admission.NewHandler(admission.Create),
  47. }
  48. }
  49. var (
  50. pvResource = api.Resource("persistentvolumes")
  51. pvcResource = api.Resource("persistentvolumeclaims")
  52. )
  53. // Admit sets finalizer on all PVCs(PVs). The finalizer is removed by
  54. // PVCProtectionController(PVProtectionController) when it's not referenced.
  55. //
  56. // This prevents users from deleting a PVC that's used by a running pod.
  57. // This also prevents admin from deleting a PV that's bound by a PVC
  58. func (c *storageProtectionPlugin) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
  59. if !c.storageObjectInUseProtection {
  60. return nil
  61. }
  62. switch a.GetResource().GroupResource() {
  63. case pvResource:
  64. return c.admitPV(a)
  65. case pvcResource:
  66. return c.admitPVC(a)
  67. default:
  68. return nil
  69. }
  70. }
  71. func (c *storageProtectionPlugin) admitPV(a admission.Attributes) error {
  72. if len(a.GetSubresource()) != 0 {
  73. return nil
  74. }
  75. pv, ok := a.GetObject().(*api.PersistentVolume)
  76. // if we can't convert the obj to PV, just return
  77. if !ok {
  78. return nil
  79. }
  80. for _, f := range pv.Finalizers {
  81. if f == volumeutil.PVProtectionFinalizer {
  82. // Finalizer is already present, nothing to do
  83. return nil
  84. }
  85. }
  86. klog.V(4).Infof("adding PV protection finalizer to %s", pv.Name)
  87. pv.Finalizers = append(pv.Finalizers, volumeutil.PVProtectionFinalizer)
  88. return nil
  89. }
  90. func (c *storageProtectionPlugin) admitPVC(a admission.Attributes) error {
  91. if len(a.GetSubresource()) != 0 {
  92. return nil
  93. }
  94. pvc, ok := a.GetObject().(*api.PersistentVolumeClaim)
  95. // if we can't convert the obj to PVC, just return
  96. if !ok {
  97. return nil
  98. }
  99. for _, f := range pvc.Finalizers {
  100. if f == volumeutil.PVCProtectionFinalizer {
  101. // Finalizer is already present, nothing to do
  102. return nil
  103. }
  104. }
  105. klog.V(4).Infof("adding PVC protection finalizer to %s/%s", pvc.Namespace, pvc.Name)
  106. pvc.Finalizers = append(pvc.Finalizers, volumeutil.PVCProtectionFinalizer)
  107. return nil
  108. }
  109. func (c *storageProtectionPlugin) InspectFeatureGates(featureGates featuregate.FeatureGate) {
  110. c.storageObjectInUseProtection = featureGates.Enabled(features.StorageObjectInUseProtection)
  111. }
  112. func (c *storageProtectionPlugin) ValidateInitialization() error {
  113. return nil
  114. }