pepr 0.36.0 → 0.37.0

package/src/lib/validate-processor.ts

@@ -5,12 +5,15 @@ import { kind } from "kubernetes-fluent-client";
 
 import { Capability } from "./capability";
 import { shouldSkipRequest } from "./filter";
-import { AdmissionRequest, ValidateResponse } from "./k8s";
+import { ValidateResponse } from "./k8s";
+import { AdmissionRequest } from "./types";
 import Log from "./logger";
 import { convertFromBase64Map } from "./utils";
 import { PeprValidateRequest } from "./validate-request";
+import { ModuleConfig } from "./module";
 
 export async function validateProcessor(
+  config: ModuleConfig,
   capabilities: Capability[],
   req: AdmissionRequest,
   reqMetadata: Record<string, string>,
@@ -41,7 +44,7 @@ export async function validateProcessor(
       };
 
       // Continue to the next action without doing anything if this one should be skipped
-      if (shouldSkipRequest(action, req, namespaces)) {
+      if (shouldSkipRequest(action, req, namespaces, config?.alwaysIgnore?.namespaces)) {
         continue;
       }
 

package/src/lib/validate-request.test.ts

@@ -3,11 +3,8 @@
 
 import { beforeEach, describe, expect, it } from "@jest/globals";
 import { KubernetesObject } from "kubernetes-fluent-client";
-
-import { Operation, AdmissionRequest } from "./k8s";
-import { ValidateActionResponse } from "./types";
+import { ValidateActionResponse, AdmissionRequest, Operation } from "./types";
 import { PeprValidateRequest } from "./validate-request";
-
 describe("PeprValidateRequest", () => {
   let mockRequest: AdmissionRequest<KubernetesObject>;
 

package/src/lib/validate-request.ts

@@ -6,7 +6,7 @@
 import { KubernetesObject } from "kubernetes-fluent-client";
 
 import { clone } from "ramda";
-import { Operation, AdmissionRequest } from "./k8s";
+import { AdmissionRequest, Operation } from "./types";
 import { ValidateActionResponse } from "./types";
 
 /**

package/src/lib/watch-processor.ts

@@ -4,6 +4,7 @@ import { K8s, KubernetesObject, WatchCfg, WatchEvent } from "kubernetes-fluent-c
 import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/types";
 import { Capability } from "./capability";
 import { filterNoMatchReason } from "./helpers";
+import { removeFinalizer } from "./finalizer";
 import Log from "./logger";
 import { Queue } from "./queue";
 import { Binding, Event } from "./types";
@@ -72,11 +73,11 @@ const eventToPhaseMap = {
  *
  * @param capabilities The capabilities to load watches for
  */
-export function setupWatch(capabilities: Capability[]) {
+export function setupWatch(capabilities: Capability[], ignoredNamespaces?: string[]) {
   capabilities.map(capability =>
     capability.bindings
       .filter(binding => binding.isWatch)
-      .forEach(bindingElement => runBinding(bindingElement, capability.namespaces)),
+      .forEach(bindingElement => runBinding(bindingElement, capability.namespaces, ignoredNamespaces)),
   );
 }
 
@@ -86,7 +87,7 @@ export function setupWatch(capabilities: Capability[]) {
  * @param binding the binding to watch
  * @param capabilityNamespaces list of namespaces to filter on
  */
-async function runBinding(binding: Binding, capabilityNamespaces: string[]) {
+async function runBinding(binding: Binding, capabilityNamespaces: string[], ignoredNamespaces?: string[]) {
   // Get the phases to match, fallback to any
   const phaseMatch: WatchPhase[] = eventToPhaseMap[binding.event] || eventToPhaseMap[Event.Any];
 
@@ -98,9 +99,22 @@ async function runBinding(binding: Binding, capabilityNamespaces: string[]) {
     if (phaseMatch.includes(phase)) {
       try {
         // Then, check if the object matches the filter
-        const filterMatch = filterNoMatchReason(binding, obj, capabilityNamespaces);
+        const filterMatch = filterNoMatchReason(binding, obj, capabilityNamespaces, ignoredNamespaces);
         if (filterMatch === "") {
-          await binding.watchCallback?.(obj, phase);
+          if (binding.isFinalize) {
+            if (!obj.metadata?.deletionTimestamp) {
+              return;
+            }
+            try {
+              await binding.finalizeCallback?.(obj);
+
+              // irrespective of callback success / failure, remove pepr finalizer
+            } finally {
+              await removeFinalizer(binding, obj);
+            }
+          } else {
+            await binding.watchCallback?.(obj, phase);
+          }
         } else {
           Log.debug(filterMatch);
         }