简介

admission

admission准入参数初始化基于command options，加载的命令行参数会通过applyTo应用到genericConfig，最终注册为准入插件。

1
// NewAPIServerCommand creates a *cobra.Command object with default parameters
2
func NewAPIServerCommand() *cobra.Command {
3

4
    s := options.NewServerRunOptions()
5
    ...
6
}
7

8
// NewServerRunOptions creates a new ServerRunOptions object with default parameters
41 行折叠代码
9
func NewServerRunOptions() *ServerRunOptions {
10
    s := ServerRunOptions{
11
        ...
12
        Admission:               kubeoptions.NewAdmissionOptions(),
13
        ...
14
    }
15
    ...
16

17
    return &s
18
}
19

20
// NewAdmissionOptions creates a new instance of AdmissionOptions.
21
func NewAdmissionOptions() *AdmissionOptions {
22
    // 初始化AdmissionOptions
23
    options := genericoptions.NewAdmissionOptions()
24
    // 注册内置插件(安全策略、资源管理、证书管理、调度和节点限制...)
25
    RegisterAllAdmissionPlugins(options.Plugins)
26
    // 设置推荐的插件顺序
27
    options.RecommendedPluginOrder = AllOrderedPlugins
28
    // 设置部分禁用的准入插件
29
    options.DefaultOffPlugins = DefaultOffAdmissionPlugins()
30

31
    return &AdmissionOptions{
32
        GenericAdmission: options,
33
    }
34
}
35

36
// NewAdmissionOptions creates a new instance of AdmissionOptions.
37
func NewAdmissionOptions() *AdmissionOptions {
38
    options := &AdmissionOptions{
39
        Plugins:    admission.NewPlugins(),
40
        Decorators: admission.Decorators{admission.DecoratorFunc(admissionmetrics.WithControllerMetrics)},
41
        // 推荐的插件执行顺序
42
        RecommendedPluginOrder: []string{lifecycle,mutatingwebhook,validatingadmissionpolicy,validatingwebhook},
43
        DefaultOffPlugins:      sets.NewString(),
44
    }
45
    // 注册上述默认插件
46
    server.RegisterAllAdmissionPlugins(options.Plugins)
47

48
    return options
49
}

参数初始化

注意

kube-apiserver准入控制支持的插件很多，最常用的一般是validatingwebhook和mutatingwebhook，用于管理动态注册的准入插件

build

applyTo会将AdmissionOptions加载的准入插件参数应用到config，进行准入插件的真正加载及初始化，将准入控制加入请求处理链中。

1
// CreateServerChain creates the apiservers connected via delegation.
2
func CreateServerChain(completedOptions completedServerRunOptions) (*aggregatorapiserver.APIAggregator, error) {
3
    kubeAPIServerConfig, serviceResolver, pluginInitializer, err := CreateKubeAPIServerConfig(completedOptions)
4
    ...
5

6
    return aggregatorServer, nil
7
}
8

36 行折叠代码
9
// CreateKubeAPIServerConfig creates all the resources for running the API server, but runs none of them.
10
func CreateKubeAPIServerConfig(s completedServerRunOptions) (...) {
11
    ...
12

13
    genericConfig, versionedInformers, serviceResolver, pluginInitializers, admissionPostStartHook, storageFactory, err := buildGenericConfig(s.ServerRunOptions, proxyTransport)
14
    ...
15

16
    return config, serviceResolver, pluginInitializers, nil
17
}
18

19
// BuildGenericConfig takes the master server options and produces the genericapiserver.Config.
20
func buildGenericConfig(s *options.ServerRunOptions, proxyTransport *http.Transport) (...) {
21
    ...
22

23
    admissionConfig := &kubeapiserveradmission.Config{
24
        ExternalInformers:    versionedInformers,
25
        LoopbackClientConfig: genericConfig.LoopbackClientConfig,
26
        CloudConfigFile:      s.CloudProvider.CloudConfigFile,
27
    }
28

29
    // svc地址解析
30
    serviceResolver = buildServiceResolver(s.EnableAggregatorRouting, genericConfig.LoopbackClientConfig.Host, versionedInformers)
31

32
    // 对象结构解析
33
    schemaResolver := resolver.NewDefinitionsSchemaResolver(k8sscheme.Scheme, genericConfig.OpenAPIConfig.GetDefinitions)
34

35
    // 准入初始化回调
36
    pluginInitializers, admissionPostStartHook, err = admissionConfig.New(proxyTransport, genericConfig.EgressSelector, serviceResolver, genericConfig.TracerProvider, schemaResolver)
37
    ...
38

39
    // 应用到genericConfig
40
    s.Admission.ApplyTo(genericConfig,versionedInformers,kubeClientConfig,featureGate,pluginInitializers...)
41
    ...
42

43
    return
44
}

准入加载

注意

准入加载其实就是根据配置参数初始化准入插件，挂到通用配置上

plugin

admission初始化会读取文件中准入配置，进一步创建插件及加入admissionControl，admissionControl会挂到请求处理handler。

1
// ApplyTo adds the admission chain to the server configuration.
2
func (a *AdmissionOptions) ApplyTo(...) error {
3
    ...
4

5
    // 根据顺序梳理启用的插件
6
    pluginNames := a.enabledPluginNames()
7

8
    // 由文件获取启用的插件配置(一般为空)
71 行折叠代码
9
    pluginsConfigProvider, err := admission.ReadAdmissionConfiguration(pluginNames, a.ConfigFile, configScheme)
10
    ...
11

12
    // 构建admission initializer对象
13
    genericInitializer := initializer.New(clientset, dynamicClient, informers, c.Authorization.Authorizer, features, c.DrainedNotify())
14

15
    // 追加到pluginInitializers
16
    initializersChain := admission.PluginInitializers{genericInitializer}
17
    initializersChain = append(initializersChain, pluginInitializers...)
18

19
    // 生成admissionChain
20
    admissionChain, err := a.Plugins.NewFromPlugins(pluginNames, pluginsConfigProvider, initializersChain, a.Decorators)
21

22
    c.AdmissionControl = admissionmetrics.WithStepMetrics(admissionChain)
23

24
    return nil
25
}
26

27
// NewFromPlugins returns an admission.Interface that will enforce admission control decisions of given plugins.
28
func (ps *Plugins) NewFromPlugins(...) (Interface, error) {
29
    ...
30

31
    // 遍历启用插件
32
    for _, pluginName := range pluginNames {
33
        // 加载插件配置
34
        pluginConfig, err := configProvider.ConfigFor(pluginName)
35
        ...
36

37
        // 初始化插件
38
        plugin, err := ps.InitPlugin(pluginName, pluginConfig, pluginInitializer)
39
        ...
40

41
        if plugin != nil {
42
            // 用decorator包装加入handlers(admissionmetrics.WithControllerMetrics)
43
            if decorator != nil {
44
                handlers = append(handlers, decorator.Decorate(plugin, pluginName))
45
            } else {
46
                handlers = append(handlers, plugin)
47
            }
48

49
            // 记录到mutationPlugins/validationPlugins
50
            if _, ok := plugin.(MutationInterface); ok {
51
                mutationPlugins = append(mutationPlugins, pluginName)
52
            }
53
            if _, ok := plugin.(ValidationInterface); ok {
54
                validationPlugins = append(validationPlugins, pluginName)
55
            }
56
        }
57
    }
58
    ...
59

60
    return newReinvocationHandler(chainAdmissionHandler(handlers)), nil
61
}
62

63
// InitPlugin creates an instance of the named interface.
64
func (ps *Plugins) InitPlugin(...) (Interface, error) {
65
    ...
66

67
    // 获取注册的插件
68
    plugin, found, err := ps.getPlugin(name, config)
69
    ...
70

71
    // 初始化插件(webhookInitializer-->kubeInitializer-->pluginInitializer)
72
    pluginInitializer.Initialize(plugin)
73

74
    // 执行plugin.ValidateInitialization()进行验证
75
    ValidateInitialization(plugin)
76
    ...
77

78
    return plugin, nil
79
}

插件初始化

注意

admission初始化就是基于配置执行注册的plugin回调，所有的plugin转为chainHandler再包装为reinvoker统一准入调度

admissionChain

准入插件初始化会转为chainAdmissionHandler，将handler拆分为mutating及validating实现执行真正的plugin准入函数。

1
// chainAdmissionHandler is an instance of admission.NamedHandler that performs admission control.
2
type chainAdmissionHandler []Interface
3

4
// Admit performs an admission control check using a chain of handlers, and returns immediately on first error
5
func (admissionHandler chainAdmissionHandler) Admit(...) error {
6
    // 遍历所有handler
7
    for _, handler := range admissionHandler {
8
        // plugin handler不关心当前操作类型
42 行折叠代码
9
        if !handler.Handles(a.GetOperation()) {
10
            continue
11
        }
12

13
        // plugin实现MutationInterface,执行修改请求
14
        if mutator, ok := handler.(MutationInterface); ok {
15
            mutator.Admit(ctx, a, o)
16
            ...
17
        }
18
    }
19
    return nil
20
}
21

22
// Validate performs an admission control check using a chain of handlers.
23
func (admissionHandler chainAdmissionHandler) Validate(...) error {
24
    // 遍历所有handler
25
    for _, handler := range admissionHandler {
26
        // plugin handler不关心当前操作类型
27
        if !handler.Handles(a.GetOperation()) {
28
            continue
29
        }
30

31
        // plugin实现ValidationInterface,执行校验请求
32
        if validator, ok := handler.(ValidationInterface); ok {
33
            validator.Validate(ctx, a, o)
34
            ...
35
        }
36
    }
37
    return nil
38
}
39

40
// Handles will return true if any of the handlers handles the given operation
41
func (admissionHandler chainAdmissionHandler) Handles(operation Operation) bool {
42
    // 遍历 plugin handler
43
    for _, handler := range admissionHandler {
44
        // 检查是否关心当前操作类型
45
        if handler.Handles(operation) {
46
            return true
47
        }
48
    }
49
    return false
50
}

补充

chainHandler作为plugin执行入口，外层根据plugin关心操作及实现接口执行对应实现

reinvoker

newReinvocationHandler()会封装admissionChain，基于原始插件链增加重入机制，实现对象修改后其它依赖插件的延迟调用。

1
// chainAdmissionHandler is an instance of admission.NamedHandler that performs admission control.
2
type chainAdmissionHandler []Interface
3

4
// newReinvocationHandler creates a handler that wraps the provided admission chain and reinvokes it.
5
func newReinvocationHandler(admissionChain Interface) Interface {
6
    return &reinvoker{admissionChain}
7
}
8

34 行折叠代码
9
// 修改请求
10
func (r *reinvoker) Admit(ctx context.Context, a Attributes, o ObjectInterfaces) error {
11
    // admissionChain实现MutationInterface
12
    if mutator, ok := r.admissionChain.(MutationInterface); ok {
13

14
        // 执行admissionChain修改请求
15
        mutator.Admit(ctx, a, o)
16
        ...
17
        // 需重入
18
        s := a.GetReinvocationContext()
19
        if s.ShouldReinvoke() {
20
            // 标记已重入调用,避免无限递归
21
            s.SetIsReinvoke()
22
            // 再次执行修改请求
23
            return mutator.Admit(ctx, a, o)
24
        }
25
    }
26
    return nil
27
}
28

29
// 校验请求
30
func (r *reinvoker) Validate(ctx context.Context, a Attributes, o ObjectInterfaces) error {
31
    // admissionChain实现ValidationInterface,执行校验
32
    if validator, ok := r.admissionChain.(ValidationInterface); ok {
33
        return validator.Validate(ctx, a, o)
34
    }
35

36
    return nil
37
}
38

39
// 检查admissionChain是否关心当前操作类型
40
func (r *reinvoker) Handles(operation Operation) bool {
41
    return r.admissionChain.Handles(operation)
42
}

补充

reinvoker对chainHandler又进行一次包装，其实还是检查chainHandler实现的接口执行对应实现，只是在Admit阶段加入冲入检查

实现

svcaccount

pod创建未指定serviceAccount会默认关联serviceAccount和对应的secrets，这种默认关联的维护就是serviceAccount插件实现的。

1
// Register registers a plugin
2
func Register(plugins *admission.Plugins) {
3
    plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
4
        // 初始化serviceAccount准入插件
5
        serviceAccountAdmission := NewServiceAccount()
6
        return serviceAccountAdmission, nil
7
    })
8
}
127 行折叠代码
9

10
// NewServiceAccount return an admission.Interface implementation which limits admission of Pod CREATE requests.
11
func NewServiceAccount() *Plugin {
12
    return &Plugin{
13
        Handler:                  admission.NewHandler(admission.Create, admission.Update),
14
        LimitSecretReferences:    false,
15
        MountServiceAccountToken: true,
16
        generateName:             names.SimpleNameGenerator.GenerateName,
17
    }
18
}
19

20
// Admit verifies if the pod should be admitted
21
func (s *Plugin) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
22
    // 处理pod或pod ephemeralcontainers子资源,其它不处理
23
    if shouldIgnore(a) {
24
        return nil
25
    }
26

27
    // 只处理create操作
28
    if a.GetOperation() != admission.Create {
29
        // we only mutate pods during create requests
30
        return nil
31
    }
32

33
    // 转为pod
34
    pod := a.GetObject().(*api.Pod)
35

36
    // mirror pod由只是由kubelet接管,不是由其创建,不能修改spec,仅执行校验
37
    if _, isMirrorPod := pod.Annotations[api.MirrorPodAnnotationKey]; isMirrorPod {
38
        return s.Validate(ctx, a, o)
39
    }
40

41
    // pod未挂载sa
42
    if len(pod.Spec.ServiceAccountName) == 0 {
43
        // 设置为default sa
44
        pod.Spec.ServiceAccountName = DefaultServiceAccountName
45
    }
46

47
    // 获取sa
48
    serviceAccount, err := s.getServiceAccount(a.GetNamespace(), pod.Spec.ServiceAccountName)
49
    ...
50
    // pod未挂载
51
    if s.MountServiceAccountToken && shouldAutomount(serviceAccount, pod) {
52
        // 基于sa刷新pod volume配置
53
        s.mountServiceAccountToken(serviceAccount, pod)
54
    }
55

56
    // 未指定镜像拉取密钥
57
    if len(pod.Spec.ImagePullSecrets) == 0 {
58
        // 将sa的imagePullSecret挂进去
59
        pod.Spec.ImagePullSecrets = make([]api.LocalObjectReference, len(serviceAccount.ImagePullSecrets))
60
        for i := 0; i < len(serviceAccount.ImagePullSecrets); i++ {
61
            pod.Spec.ImagePullSecrets[i].Name = serviceAccount.ImagePullSecrets[i].Name
62
        }
63
    }
64

65
    // 执行校验
66
    return s.Validate(ctx, a, o)
67
}
68

69
// Validate the data we obtained
70
func (s *Plugin) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
71
    // 处理pod或pod ephemeralcontainers子资源,其它不处理
72
    if shouldIgnore(a) {
73
        return nil
74
    }
75

76
    // 转为pod
77
    pod := a.GetObject().(*api.Pod)
78

79
    // pod ephemeralcontainers子资源更新
80
    if a.GetOperation() == admission.Update && a.GetSubresource() == "ephemeralcontainers" {
81
        // 限制临时容器引用的secret
82
        return s.limitEphemeralContainerSecretReferences(pod, a)
83
    }
84

85
    // 不是创建请求不处理
86
    if a.GetOperation() != admission.Create {
87
        // we only validate pod specs during create requests
88
        return nil
89
    }
90

91
    // mirror pod处理
92
    if _, isMirrorPod := pod.Annotations[api.MirrorPodAnnotationKey]; isMirrorPod {
93
        // 不允许挂sa
94
        if len(pod.Spec.ServiceAccountName) != 0 {
95
            return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference service accounts"))
96
        }
97
        // 不允许引用secret
98
        hasSecrets := false
99
        podutil.VisitPodSecretNames(pod, func(name string) bool {
100
            hasSecrets = true
101
            return false
102
        }, podutil.AllContainers)
103
        if hasSecrets {
104
            return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not reference secrets"))
105
        }
106
        // 不允许挂载sa投影卷
107
        for _, v := range pod.Spec.Volumes {
108
            if proj := v.Projected; proj != nil {
109
                for _, projSource := range proj.Sources {
110
                    if projSource.ServiceAccountToken != nil {
111
                        return admission.NewForbidden(a, fmt.Errorf("a mirror pod may not use ServiceAccountToken volume projections"))
112
                    }
113
                }
114
            }
115
        }
116
        return nil
117
    }
118

119
    // 其它请求,不允许未挂载sa
120
    if len(pod.Spec.ServiceAccountName) == 0 {
121
        return admission.NewForbidden(a, fmt.Errorf("no service account specified for pod %s/%s", a.GetNamespace(), pod.Name))
122
    }
123
    // 获取sa
124
    serviceAccount, err := s.getServiceAccount(a.GetNamespace(), pod.Spec.ServiceAccountName)
125
    ...
126
    // secret强制挂载(plugin开启强制挂载/sa开启kubernetes.io/enforce-mountable-secrets注解)
127
    if s.enforceMountableSecrets(serviceAccount) {
128
        // 验证pod只能挂载sa关联的secret/imagePullSecret
129
        if err := s.limitSecretReferences(serviceAccount, pod); err != nil {
130
            return admission.NewForbidden(a, err)
131
        }
132
    }
133

134
    return nil
135
}

sa准入检查

补充

sa admission准入有两种实现，早期基于Secret挂载Token，v1.24版本后基于projected映射卷和tokenRequest动态签发

lifecycle

namespaceLifecycle准入插件用于控制namespace准入检查，禁止删除kube-system、kube-public、default这些系统命名空间。

1
// Register registers a plugin
2
func Register(plugins *admission.Plugins) {
3
    plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
4
        return NewLifecycle(sets.NewString("default", "kube-system", "kube-public"))
5
    })
6
}
7

8
func newLifecycleWithClock(immortalNamespaces sets.String, clock utilcache.Clock) (*Lifecycle, error) {
87 行折叠代码
9
    // LRU缓存
10
    forceLiveLookupCache := utilcache.NewLRUExpireCacheWithClock(100, clock)
11
    return &Lifecycle{
12
        Handler:              admission.NewHandler(admission.Create, admission.Update, admission.Delete),
13
        immortalNamespaces:   immortalNamespaces,
14
        forceLiveLookupCache: forceLiveLookupCache,
15
    }, nil
16
}
17

18
// Admit makes an admission decision based on the request attributes
19
func (l *Lifecycle) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
20
    // 不允许删除default/kube-system/kube-public命名空间
21
    if a.GetOperation() == admission.Delete && a.GetKind().GroupKind() == "Namespace" && l.immortalNamespaces.Has(a.GetName()) {
22
        return errors.NewForbidden(a.GetResource().GroupResource(), a.GetName(), fmt.Errorf("this namespace may not be deleted"))
23
    }
24

25
    // 忽略非namespace操作及未限制namespace的资源操作
26
    if len(a.GetNamespace()) == 0 && a.GetKind().GroupKind() != "Namespace" {
27
        return nil
28
    }
29

30
    // namespace请求
31
    if a.GetKind().GroupKind() == v1.SchemeGroupVersion.WithKind("Namespace").GroupKind() {
32
        // 删除行为,强制标记由apiserver读取状态
33
        if a.GetOperation() == admission.Delete {
34
            l.forceLiveLookupCache.Add(a.GetName(), true, forceLiveLookupTTL)
35
        }
36
        // allow all operations to namespaces
37
        return nil
38
    }
39

40
    // 其它资源删除请求放行
41
    if a.GetOperation() == admission.Delete {
42
        return nil
43
    }
44

45
    // accessReview请求放行(kubectl auth can-i watch services --as=system:serviceaccount:kube-system:coredns)
46
    if isAccessReview(a) {
47
        return nil
48
    }
49

50
    // 等待lifecycle插件缓存就绪
51
    if !l.WaitForReady() {
52
        return admission.NewForbidden(a, fmt.Errorf("not yet ready to handle request"))
53
    }
54
    ...
55

56
    // 获取namespace
57
    namespace, err := l.namespaceLister.Get(a.GetNamespace())
58
    ...
59

60
    // create请求,再等一会缓存
61
    if !exists && a.GetOperation() == admission.Create {
62
        // 50ms延迟
63
        time.Sleep(missingNamespaceWait)
64
        // 再次由缓存获取
65
        namespace, err = l.namespaceLister.Get(a.GetNamespace())
66
        ...
67
    }
68
    ...
69

70
    // 检查namespace删除状态
71
    if _, ok := l.forceLiveLookupCache.Get(a.GetNamespace()); ok {
72
        // namespace删除,缓存还是Active状态
73
        forceLiveLookup = exists && namespace.Status.Phase == v1.NamespaceActive
74
    }
75

76
    // apiserver直查
77
    if !exists || forceLiveLookup {
78
        // 获取namespace
79
        namespace, err = l.client.CoreV1().Namespaces().Get(context.TODO(), a.GetNamespace(), metav1.GetOptions{})
80
        ...
81
    }
82

83
    // 创建请求
84
    if a.GetOperation() == admission.Create {
85
        // 不允许向正在删除的namespace写
86
        if namespace.Status.Phase != v1.NamespaceTerminating {
87
            return nil
88
        }
89
        ...
90

91
    return admission.NewForbidden(...)
92
    }
93

94
    return nil
95
}

namespace准入

补充

lifecycle未实现Validate，基于Admit限制资源请求和namespace状态的删除操作

registry

addmission chainHandler会注册到请求的处理逻辑，整个调用链较深，忽略路由注册部分，最终会在installer.Install()注册到请求链上。

1
// installAPIResources is a private method for installing the REST storage backing each api groupversionresource
2
func (s *GenericAPIServer) installAPIResources(...) error {
3
    ...
4

5
    for _, groupVersion := range apiGroupInfo.PrioritizedVersions {
6
        ...
7

8
        // 执行注册
144 行折叠代码
9
        discoveryAPIResources, r, err := apiGroupVersion.InstallREST(s.Handler.GoRestfulContainer)
10
        ...
11
        resourceInfos = append(resourceInfos, r...)
12

13
    }
14
    ...
15

16
    return nil
17
}
18

19
// InstallREST registers the REST handlers (storage, watch, proxy and redirect) into a restful Container.
20
func (g *APIGroupVersion) InstallREST(container *restful.Container) (...) {
21
    prefix := path.Join(g.Root, g.GroupVersion.Group, g.GroupVersion.Version)
22
    installer := &APIInstaller{
23
        group:             g,
24
        prefix:            prefix,
25
        minRequestTimeout: g.MinRequestTimeout,
26
    }
27

28
    // 构造webservice
29
    apiResources, resourceInfos, ws, registrationErrors := installer.Install()
30
    ...
31

32
    // 注册webservice到container
33
    container.Add(ws)
34
    ...
35

36
    return aggregatedDiscoveryResources, removeNonPersistedResources(resourceInfos), utilerrors.NewAggregate(registrationErrors)
37
}
38

39
// Install handlers for API resources.
40
func (a *APIInstaller) Install() (...) {
41
    ...
42

43
    // 初始化webservice
44
    ws := a.newWebService()
45
    ...
46

47
    // 遍历资源路径列表
48
    for _, path := range paths {
49
        // 各资源向webservice注册handler
50
        apiResource, resourceInfo, err := a.registerResourceHandlers(path, a.group.Storage[path], ws)
51
        ...
52

53
        // 记录discovery apiResources
54
        if apiResource != nil {
55
            apiResources = append(apiResources, *apiResource)
56
        }
57

58
        // 记录storage apiResources
59
        if resourceInfo != nil {
60
            resourceInfos = append(resourceInfos, resourceInfo)
61
        }
62
    }
63
    return apiResources, resourceInfos, ws, errors
64
}
65

66
func (a *APIInstaller) registerResourceHandlers(...) (*metav1.APIResource,*storageversion.ResourceInfo,error) {
67
    // 先获取注册的admissionControl对象
68
    admit := a.group.Admit
69
    ...
70

71
    for _, action := range actions {
72
        ...
73

74
        switch action.Verb {
75
        ...
76
        case "POST": // Create a resource.
77
            ...
78

79
            // 准入控制包装
80
            if isNamedCreater {
81
                handler = restfulCreateNamedResource(namedCreater, reqScope, admit)
82
            } else {
83
                handler = restfulCreateResource(creater, reqScope, admit)
84
            }
85
            ...
86

87
            route := ws.POST(action.Path).To(handler)...
88
            ...
89
            routes = append(routes, route)
90
        ...
91
        }
92
        // route注册到webservice
93
        for _, route := range routes {
94
            ...
95
            ws.Route(route)
96
        }
97
    }
98
    ...
99

100
    return &apiResource, resourceInfo, nil
101
}
102

103
// wrapper admissionControl
104
func restfulCreateResource(...) restful.RouteFunction {
105
    return func(req *restful.Request, res *restful.Response) {
106
        handlers.CreateResource(r, &scope, admit)(res.ResponseWriter, req.Request)
107
    }
108
}
109

110
// CreateResource returns a function that will handle a resource creation.
111
func CreateResource(r rest.Creater, scope *RequestScope, admission admission.Interface) http.HandlerFunc {
112
    return createHandler(&namedCreaterAdapter{r}, scope, admission, false)
113
}
114

115
func createHandler(...) http.HandlerFunc {
116
    return func(w http.ResponseWriter, req *http.Request) {
117
        ...
118

119
        // 将后端存储的Create逻辑用匿名函数包装
120
        requestFunc := func() (runtime.Object, error) {
121
            return r.Create(
122
                ctx,
123
                name,
124
                obj,
125
                rest.AdmissionToValidateObjectFunc(admit, admissionAttributes, scope),
126
                options,
127
            )
128
        }
129
        ...
130

131
        // 将获取后端结果的调用基于FinishRequest包装
132
        result, err := finisher.FinishRequest(ctx, func() (runtime.Object, error) {
133
            ...
134

135
            // 存储前先Admit,执行准入修改
136
            if mutatingAdmission, ok := admit.(admission.MutationInterface); ok && mutatingAdmission.Handles(admission.Create) {
137
                if err := mutatingAdmission.Admit(ctx, admissionAttributes, scope); err != nil {
138
                    return nil, err
139
                }
140
            }
141
            ...
142

143
            // 获取存储持久化结果
144
            result, err := requestFunc()
145
            ...
146

147
            return result, err
148
        })
149
        ...
150

151
    }
152
}

准入注册

补充

admission注册到请求链本质是对installer动态注册的资源route handler包装，作用于认证/鉴权后，真正存储前