Gitlabbinding

gitlab/client.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2020 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gitlab
+
+import (
+	"context"
+	"io/ioutil"
+	"net/http"
+	"path/filepath"
+
+	"github.com/xanzy/go-gitlab"
+)
+
+const (
+	AccessTokenKey = "accessToken"
+	VolumeName     = "gitlab-binding"
+	MountPath      = "/var/bindings/gitlab"
+)
+
+// ReadKey may be used to read keys from the secret bound by the GitLabBinding.
+func ReadKey(key string) (string, error) {
+	data, err := ioutil.ReadFile(filepath.Join(MountPath, key))
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+// AccessToken reads the file named accessToken that is mounted by the GitLabBinding.
+func AccessToken() (string, error) {
+	return ReadKey(AccessTokenKey)
+}
+
+// New instantiates a new gitlab client from the access token from the GitLabBinding
+func New(ctx context.Context) (*gitlab.Client, error) {
+	at, err := AccessToken()
+	if err != nil {
+		return nil, err
+	}
+	return gitlab.NewClient(http.DefaultClient, at), nil
+}

gitlab/cmd/controller/main.go

@@ -17,92 +17,15 @@ limitations under the License.
 package main
 
 import (
-	"context"
+	gitlab "knative.dev/eventing-contrib/gitlab/pkg/reconciler/source"
 
-	sourcesv1alpha1 "knative.dev/eventing-contrib/gitlab/pkg/apis/sources/v1alpha1"
-	gitlab "knative.dev/eventing-contrib/gitlab/pkg/reconciler"
-
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"knative.dev/pkg/configmap"
-	"knative.dev/pkg/controller"
 	"knative.dev/pkg/injection/sharedmain"
-	"knative.dev/pkg/signals"
-	"knative.dev/pkg/webhook"
-	"knative.dev/pkg/webhook/certificates"
-	"knative.dev/pkg/webhook/resourcesemantics"
-	"knative.dev/pkg/webhook/resourcesemantics/defaulting"
-	"knative.dev/pkg/webhook/resourcesemantics/validation"
 )
 
 const (
 	component = "gitlab_controller"
 )
 
-var types = map[schema.GroupVersionKind]resourcesemantics.GenericCRD{
-	// List the types to validate.
-	sourcesv1alpha1.SchemeGroupVersion.WithKind("GitLabSource"): &sourcesv1alpha1.GitLabSource{},
-}
-
-func NewDefaultingAdmissionController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
-	return defaulting.NewAdmissionController(ctx,
-
-		// Name of the resource webhook.
-		"defaulting.webhook.gitlab.sources.knative.dev",
-
-		// The path on which to serve the webhook.
-		"/defaulting",
-
-		// The resources to validate and default.
-		types,
-
-		// A function that infuses the context passed to Validate/SetDefaults with custom metadata.
-		func(ctx context.Context) context.Context {
-			// Here is where you would infuse the context with state
-			// (e.g. attach a store with configmap data)
-			return ctx
-		},
-
-		// Whether to disallow unknown fields.
-		true,
-	)
-}
-
-func NewValidationAdmissionController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
-	return validation.NewAdmissionController(ctx,
-
-		// Name of the resource webhook.
-		"validation.webhook.gitlab.sources.knative.dev",
-
-		// The path on which to serve the webhook.
-		"/resource-validation",
-
-		// The resources to validate and default.
-		types,
-
-		// A function that infuses the context passed to Validate/SetDefaults with custom metadata.
-		func(ctx context.Context) context.Context {
-			// Here is where you would infuse the context with state
-			// (e.g. attach a store with configmap data)
-			return ctx
-		},
-
-		// Whether to disallow unknown fields.
-		true,
-	)
-}
-
 func main() {
-	ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
-		ServiceName: "gitlab-source-webhook",
-		Port:        8443,
-		SecretName:  "gitlabsource-webhook-certs",
-	})
-
-	sharedmain.WebhookMainWithContext(ctx, component,
-		certificates.NewController,
-		NewDefaultingAdmissionController,
-		NewValidationAdmissionController,
-
-		gitlab.NewController,
-	)
+	sharedmain.Main(component, gitlab.NewController)
 }

gitlab/cmd/webhook/main.go

@@ -0,0 +1,142 @@
+/*
+Copyright 2020 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"os"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	bindingv1alpha1 "knative.dev/eventing-contrib/gitlab/pkg/apis/bindings/v1alpha1"
+	sourcev1alpha1 "knative.dev/eventing-contrib/gitlab/pkg/apis/sources/v1alpha1"
+	"knative.dev/eventing-contrib/gitlab/pkg/reconciler/binding"
+	"knative.dev/eventing/pkg/logconfig"
+	"knative.dev/pkg/configmap"
+	"knative.dev/pkg/controller"
+	"knative.dev/pkg/injection"
+	"knative.dev/pkg/injection/sharedmain"
+	"knative.dev/pkg/signals"
+	"knative.dev/pkg/webhook"
+	"knative.dev/pkg/webhook/certificates"
+	"knative.dev/pkg/webhook/psbinding"
+	"knative.dev/pkg/webhook/resourcesemantics"
+	"knative.dev/pkg/webhook/resourcesemantics/defaulting"
+	"knative.dev/pkg/webhook/resourcesemantics/validation"
+)
+
+var types = map[schema.GroupVersionKind]resourcesemantics.GenericCRD{
+	sourcev1alpha1.SchemeGroupVersion.WithKind("GitLabSource"):   &sourcev1alpha1.GitLabSource{},
+	bindingv1alpha1.SchemeGroupVersion.WithKind("GitLabBinding"): &bindingv1alpha1.GitLabBinding{},
+}
+
+var callbacks = map[schema.GroupVersionKind]validation.Callback{}
+
+func NewDefaultingAdmissionController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
+	return defaulting.NewAdmissionController(ctx,
+
+		// Name of the resource webhook.
+		"defaulting.webhook.gitlab.sources.knative.dev",
+
+		// The path on which to serve the webhook.
+		"/defaulting",
+
+		// The resources to validate and default.
+		types,
+
+		// A function that infuses the context passed to Validate/SetDefaults with custom metadata.
+		func(ctx context.Context) context.Context {
+			// Here is where you would infuse the context with state
+			// (e.g. attach a store with configmap data)
+			return ctx
+		},
+
+		// Whether to disallow unknown fields.
+		true,
+	)
+}
+
+func NewValidationAdmissionController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
+	return validation.NewAdmissionController(ctx,
+
+		// Name of the resource webhook.
+		"validation.webhook.gitlab.sources.knative.dev",
+
+		// The path on which to serve the webhook.
+		"/resource-validation",
+
+		// The resources to validate and default.
+		types,
+
+		// A function that infuses the context passed to Validate/SetDefaults with custom metadata.
+		func(ctx context.Context) context.Context {
+			// Here is where you would infuse the context with state
+			// (e.g. attach a store with configmap data)
+			return ctx
+		},
+
+		// Whether to disallow unknown fields.
+		true,
+
+		// Extra validating callbacks to be applied to resources.
+		callbacks,
+	)
+}
+
+func NewGitLabBindingWebhook(opts ...psbinding.ReconcilerOption) injection.ControllerConstructor {
+	return func(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
+		return psbinding.NewAdmissionController(ctx,
+
+			// Name of the resource webhook.
+			"gitlabbindings.webhook.gitlab.sources.knative.dev",
+
+			// The path on which to serve the webhook.
+			"/gitlabbindings",
+
+			// How to get all the Bindables for configuring the mutating webhook.
+			binding.ListAll,
+
+			// A function that infuses the context passed to Validate/SetDefaults with custom metadata.
+			func(ctx context.Context, _ psbinding.Bindable) (context.Context, error) {
+				// Here is where you would infuse the context with state
+				// (e.g. attach a store with configmap data)
+				return ctx, nil
+			},
+			opts...,
+		)
+	}
+}
+
+func main() {
+	ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
+		ServiceName: "gitlab-source-webhook",
+		Port:        8443,
+		SecretName:  "gitlabsource-webhook-certs",
+	})
+
+	glbSelector := psbinding.WithSelector(psbinding.ExclusionSelector)
+	if os.Getenv("GITLAB_BINDING_SELECTION_MODE") == "inclusion" {
+		glbSelector = psbinding.WithSelector(psbinding.InclusionSelector)
+	}
+
+	sharedmain.WebhookMainWithContext(ctx, logconfig.WebhookName(),
+		certificates.NewController,
+		NewDefaultingAdmissionController,
+		NewValidationAdmissionController,
+
+		binding.NewController, NewGitLabBindingWebhook(glbSelector),
+	)
+}

gitlab/config/200-serviceaccount.yaml

@@ -19,3 +19,13 @@ metadata:
   namespace: knative-sources
   labels:
     contrib.eventing.knative.dev/release: devel
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitlab-webhook
+  namespace: knative-sources
+  labels:
+    contrib.eventing.knative.dev/release: devel

gitlab/config/201-clusterrole.yaml

@@ -65,20 +65,19 @@ rules:
   # Webhook controller needs it to update certs in secret
   - update
 
-# Events admin
+# Deployments admin
 - apiGroups:
-  - ""
+  - apps
   resources:
-  - events
-  - configmaps
+  - deployments
   verbs: *everything
 
-  # For actually registering our webhook.
+# Events admin
 - apiGroups:
-  - admissionregistration.k8s.io
+  - ""
   resources:
-  - mutatingwebhookconfigurations
-  - validatingwebhookconfigurations
+  - events
+  - configmaps
   verbs: *everything
 
 ---

gitlab/config/202-clusterrolebinding.yaml

@@ -28,6 +28,7 @@ subjects:
   namespace: knative-sources
 
 ---
+
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -44,3 +45,20 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: addressable-resolver
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eventing-sources-gitlab-webhook
+  labels:
+    contrib.eventing.knative.dev/release: devel
+subjects:
+- kind: ServiceAccount
+  name: gitlab-webhook
+  namespace: knative-sources
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gitlab-webhook