add device admission

Signed-off-by: cl2017 <chenlin.liu@daocloud.io>

2 files changed, 91 insertions, 0 deletions

diff --git a/cloud/pkg/admissioncontroller/admission.go b/cloud/pkg/admissioncontroller/admission.go
index 7d9240512..c9217aa0a 100644
--- a/cloud/pkg/admissioncontroller/admission.go
+++ b/cloud/pkg/admissioncontroller/admission.go
@@ -28,6 +28,7 @@ import (
 
 const (
 	ValidateCRDWebhookConfigName    = "kubeedge-crds-validate-webhook-configuration"
+	ValidateDeviceWebhookName       = "validatedevice.kubeedge.io"
 	ValidateDeviceModelWebhookName  = "validatedevicemodel.kubeedge.io"
 	ValidateRuleWebhookName         = "validatedrule.kubeedge.io"
 	ValidateRuleEndpointWebhookName = "validatedruleendpoint.kubeedge.io"
@@ -99,6 +100,7 @@ func Run(opt *options.AdmissionOptions) error {
 		return fmt.Errorf("failed to register the webhook with error: %v", err)
 	}
 
+	http.HandleFunc("/devices", serveDevice)
 	http.HandleFunc("/devicemodels", serveDeviceModel)
 	http.HandleFunc("/rules", serveRule)
 	http.HandleFunc("/ruleendpoints", serveRuleEndpoint)
@@ -162,6 +164,33 @@ func (ac *AdmissionController) registerWebhooks(opt *options.AdmissionOptions, c
 			Name: ValidateCRDWebhookConfigName,
 		},
 		Webhooks: []admissionregistrationv1.ValidatingWebhook{
+			// Device Validating Webhook
+			{
+				Name: ValidateDeviceWebhookName,
+				Rules: []admissionregistrationv1.RuleWithOperations{{
+					Operations: []admissionregistrationv1.OperationType{
+						admissionregistrationv1.Create,
+						admissionregistrationv1.Update,
+					},
+					Rule: admissionregistrationv1.Rule{
+						APIGroups:   []string{"devices.kubeedge.io"},
+						APIVersions: []string{"v1beta1"},
+						Resources:   []string{"devices"},
+					},
+				}},
+				ClientConfig: admissionregistrationv1.WebhookClientConfig{
+					Service: &admissionregistrationv1.ServiceReference{
+						Namespace: opt.AdmissionServiceNamespace,
+						Name:      opt.AdmissionServiceName,
+						Path:      strPtr("/devices"),
+						Port:      &opt.Port,
+					},
+					CABundle: cabundle,
+				},
+				FailurePolicy:           &ignorePolicy,
+				SideEffects:             &noneSideEffect,
+				AdmissionReviewVersions: []string{"v1"},
+			},
 			// Device Model Validating Webhook
 			{
 				Name: ValidateDeviceModelWebhookName,
diff --git a/cloud/pkg/admissioncontroller/admit_device.go b/cloud/pkg/admissioncontroller/admit_device.go
new file mode 100644
index 000000000..a6a6d2fe2
--- /dev/null
+++ b/cloud/pkg/admissioncontroller/admit_device.go
@@ -0,0 +1,62 @@
+package admissioncontroller
+
+import (
+	"net/http"
+	"strings"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/klog/v2"
+
+	devicesv1beta1 "github.com/kubeedge/kubeedge/pkg/apis/devices/v1beta1"
+)
+
+func admitDevice(review admissionv1.AdmissionReview) *admissionv1.AdmissionResponse {
+	reviewResponse := admissionv1.AdmissionResponse{}
+	reviewResponse.Allowed = true
+	var msg string
+
+	switch review.Request.Operation {
+	case admissionv1.Create, admissionv1.Update:
+		raw := review.Request.Object.Raw
+		device := devicesv1beta1.Device{}
+		deserializer := codecs.UniversalDeserializer()
+		if _, _, err := deserializer.Decode(raw, nil, &device); err != nil {
+			klog.Errorf("validation failed with error: %v", err)
+			return toAdmissionResponse(err)
+		}
+		msg = validateDevice(&device, &reviewResponse)
+	case admissionv1.Delete, admissionv1.Connect:
+		//no rule defined for above operations, greenlight for all of above.
+		reviewResponse.Allowed = true
+	default:
+		klog.Infof("Unsupported webhook operation %v", review.Request.Operation)
+		reviewResponse.Allowed = false
+		msg = "Unsupported webhook operation!"
+	}
+	if !reviewResponse.Allowed {
+		reviewResponse.Result = &metav1.Status{Message: strings.TrimSpace(msg)}
+	}
+	return &reviewResponse
+}
+
+func validateDevice(device *devicesv1beta1.Device, response *admissionv1.AdmissionResponse) string {
+	//device properties name must be unique.
+	var msg string
+	size := len(device.Spec.Properties)
+	for i := range device.Spec.Properties {
+		for j := i + 1; j < size; j++ {
+			if device.Spec.Properties[i].Name == device.Spec.Properties[j].Name {
+				msg = "property names must be unique."
+				response.Allowed = false
+				return msg
+			}
+		}
+	}
+
+	return msg
+}
+
+func serveDevice(w http.ResponseWriter, r *http.Request) {
+	serve(w, r, admitDevice)
+}