Adjust VM admitter to VMI creation restrictions.
Since now creation of kubevirt.io lables in VNI is restricted
to kubevirt service accounts only, it is needed to validate the account
name of the admisssion request
@@ -67,6 +67,7 @@ func (admitter *VMsAdmitter) Admit(ar *v1beta1.AdmissionReview) *v1beta1.Admissi
}
raw := ar.Request.Object.Raw
+ accountName := ar.Request.UserInfo.Username
vm := v1.VirtualMachine{}
err := json.Unmarshal(raw, &vm)
@@ -74,7 +75,7 @@ func (admitter *VMsAdmitter) Admit(ar *v1beta1.AdmissionReview) *v1beta1.Admissi
return webhookutils.ToAdmissionResponseError(err)
}
- causes := ValidateVirtualMachineSpec(k8sfield.NewPath("spec"), &vm.Spec, admitter.ClusterConfig)
+ causes := ValidateVirtualMachineSpec(k8sfield.NewPath("spec"), &vm.Spec, admitter.ClusterConfig, accountName)
if len(causes) > 0 {
return webhookutils.ToAdmissionResponse(causes)
}
@@ -155,7 +156,7 @@ func (admitter *VMsAdmitter) authorizeVirtualMachineSpec(ar *v1beta1.AdmissionRe
return causes, nil
}
-func ValidateVirtualMachineSpec(field *k8sfield.Path, spec *v1.VirtualMachineSpec, config *virtconfig.ClusterConfig) []metav1.StatusCause {
+func ValidateVirtualMachineSpec(field *k8sfield.Path, spec *v1.VirtualMachineSpec, config *virtconfig.ClusterConfig, accountName string) []metav1.StatusCause {
var causes []metav1.StatusCause
if spec.Template == nil {
@@ -166,7 +167,7 @@ func ValidateVirtualMachineSpec(field *k8sfield.Path, spec *v1.VirtualMachineSpe
})
}
- causes = append(causes, ValidateVirtualMachineInstanceMetadata(field.Child("template", "metadata"), &spec.Template.ObjectMeta, config)...)
+ causes = append(causes, ValidateVirtualMachineInstanceMetadata(field.Child("template", "metadata"), &spec.Template.ObjectMeta, config, accountName)...)
causes = append(causes, ValidateVirtualMachineInstanceSpec(field.Child("template", "spec"), &spec.Template.Spec, config)...)
if len(spec.DataVolumeTemplates) > 0 {
