kubus 0.6.0

Derive based kubernetes operator framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

//! Validating admission webhook example
//!
//! This example demonstrates a validating admission webhook that enforces
//! security policies by rejecting Pods that attempt to run as root.

use kube::Client;
use kubus::{HandlerError, Operator};

#[tokio::main]
async fn main() -> Result<(), kubus::Error> {
    tracing_subscriber::fmt().init();

    let client = Client::try_default().await?;

    Operator::builder()
        .with_context(client)
        .validator(validate_security)
        .run()
        .await
}

/// Validating admission webhook: ensures pods don't run as root
#[kubus::admission(validating)]
async fn validate_security(
    req: &kube::core::admission::AdmissionRequest<kube::api::DynamicObject>,
) -> Result<kube::core::admission::AdmissionResponse, HandlerError> {
    // Only validate Pod resources
    if let Some(obj) = &req.object {
        let kind = obj.types.as_ref().map(|t| t.kind.as_str()).unwrap_or("");
        if kind != "Pod" {
            return Ok(kube::core::admission::AdmissionResponse::from(req));
        }

        // Check if any container runs as root (runAsUser = 0)
        if let Some(spec) = obj.data.get("spec") {
            if let Some(security_context) = spec.get("securityContext") {
                if let Some(run_as_user) = security_context.get("runAsUser") {
                    if run_as_user.as_u64() == Some(0) {
                        return Ok(kube::core::admission::AdmissionResponse::from(req)
                            .deny("Pods cannot run as root (runAsUser=0)"));
                    }
                }
            }

            // Check containers
            if let Some(containers) = spec.get("containers").and_then(|c| c.as_array()) {
                for container in containers {
                    if let Some(security_context) = container.get("securityContext") {
                        if let Some(run_as_user) = security_context.get("runAsUser") {
                            if run_as_user.as_u64() == Some(0) {
                                return Ok(kube::core::admission::AdmissionResponse::from(req)
                                    .deny("Containers cannot run as root (runAsUser=0)"));
                            }
                        }
                    }
                }
            }
        }
    }

    Ok(kube::core::admission::AdmissionResponse::from(req))
}