强制 kubernetes ingress cname 格式

Question

使用 Kubernetes，在多租户环境中，由 RBAC 控制，在创建新的 Ingress cname 时，我想强制 cname 格式如下：

${service}.${namespace}.${cluster}.kube.infra

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ${servce}
spec:
  tls:
    - hosts:
        - ${service}.${namespace}.${cluster}.kube.infra
      secretName: conso-elasticsearch-ssl
  rules:
    - host: ${service}.${namespace}.${cluster}.kube.infra
      http:
        paths:
          - path: /
            backend:
              serviceName: ${service}
              servicePort: 9200

可能吗？

Answer 1

您可以通过编写一个 validating admission webhook which validates the ingress yaml and rejects it if the cname format is not as per the way you want. A better way to is to use Open Policy agent(OPA) and write rego policy. Here 来完成它是关于如何使用 OPA 执行策略驱动的入口验证的指南。

package kubernetes.admission

import data.kubernetes.namespaces

operations = {"CREATE", "UPDATE"}

deny[msg] {
    input.request.kind.kind == "Ingress"
    operations[input.request.operation]
    host := input.request.object.spec.rules[_].host
    not fqdn_matches_any(host, valid_ingress_hosts)
    msg := sprintf("invalid ingress host %q", [host])
}

valid_ingress_hosts = {
    // valid hosts
}

fqdn_matches_any(str, patterns) {
    fqdn_matches(str, patterns[_])
}

fqdn_matches(str, pattern) {
    // validation logic
}

fqdn_matches(str, pattern) {
    not contains(pattern, "*")
    str == pattern
}

强制 kubernetes ingress cname 格式

Force kubernetes ingress cname format

kubernetes

kubernetes-ingress