21561672726

Committed 01 Feb 2026 10:59AM UTC coverage: 73.866% (-0.07%) from 73.935%

Build # 21561672726

Build Type

Pull #229

github

Committed by

web-flow

Commit Message

Merge 815b1f125 into 622108658

Pull Request Pull Request #229: fix(deps): update sigs.k8s.io/controller-runtime to v0.23.1

Run Details

1 of 2 new or added lines in 2 files covered. (50.0%)

1 existing line in 1 file now uncovered.

1173 of 1588 relevant lines covered (73.87%)

11.24 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.74

/pkg/upgrade-controller/controller/validatingwebhook.go

package controller

import (
        "context"
        "fmt"
        "log/slog"

        "github.com/heathcliff26/kube-upgrade/pkg/apis/kubeupgrade/v1alpha3"
        api "github.com/heathcliff26/kube-upgrade/pkg/apis/kubeupgrade/v1alpha3"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
)

// +kubebuilder:webhook:path=/validate-kubeupgrade-heathcliff-eu-v1alpha3-kubeupgradeplan,mutating=false,failurePolicy=fail,groups=kubeupgrade.heathcliff.eu,resources=kubeupgradeplans,verbs=create;update,versions=v1alpha3,name=kubeupgrade.heathcliff.eu,admissionReviewVersions=v1,sideEffects=None

// planValidatingHook validates the plan
type planValidatingHook struct {
        client.Client
}

// Validate all values of the plan and check if they are sensible
func (*planValidatingHook) validate(plan *v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {
        err := api.ValidateObject_KubeUpgradePlan(plan)
        if err != nil {
                return nil, err
        }

        var warnings []string
        if plan.Spec.AllowDowngrade {
                warnings = append(warnings, "AllowDowngrade is set to true, downgrading a cluster is not supported by upstream Kubernetes and likely will cause issues. Use at your own risk.")
        }

        allowUnsignedOstreeImages := plan.Spec.Upgraded.AllowUnsignedOstreeImages
        for _, group := range plan.Spec.Groups {
                if group.Upgraded != nil && group.Upgraded.AllowUnsignedOstreeImages {
                        allowUnsignedOstreeImages = true
                        break
                }
        }
        if allowUnsignedOstreeImages {
                warnings = append(warnings, "AllowUnsignedOstreeImages is set to true, this lowers security. Consider signing your custom images with cosign.")
        }

        return warnings, nil
}

// ValidateCreate validates the object on creation.
// The optional warnings will be added to the response as warning messages.
// Return an error if the object is invalid.
func (p *planValidatingHook) ValidateCreate(ctx context.Context, plan *v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {
        if p.Client == nil {
                return nil, fmt.Errorf("no client provided for validating webhook, please report a bug")
        }

        planList := &api.KubeUpgradePlanList{}
        err := p.List(ctx, planList)
        if err != nil {
                return nil, fmt.Errorf("failed to list KubeUpgradePlans: %v", err)
        }
        if len(planList.Items) > 0 {
                slog.With("existing-plan", planList.Items[0].Name).Warn("Attempted to create a KubeUpgradePlan, but one already exists")
                return nil, fmt.Errorf("KubeUpgradePlan already exists")
        }

        return p.validate(plan)
}

// ValidateUpdate validates the object on update.
// The optional warnings will be added to the response as warning messages.
// Return an error if the object is invalid.
func (p *planValidatingHook) ValidateUpdate(_ context.Context, _ *v1alpha3.KubeUpgradePlan, newPlan *v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {
        return p.validate(newPlan)
}

// ValidateDelete validates the object on deletion.
// The optional warnings will be added to the response as warning messages.
// Return an error if the object is invalid.
func (*planValidatingHook) ValidateDelete(_ context.Context, _ *v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {
        return nil, nil
}

1	package controller
2
3	import (
4	"context"
5	"fmt"
6	"log/slog"
7
8	"github.com/heathcliff26/kube-upgrade/pkg/apis/kubeupgrade/v1alpha3"
9	api "github.com/heathcliff26/kube-upgrade/pkg/apis/kubeupgrade/v1alpha3"
10	"sigs.k8s.io/controller-runtime/pkg/client"
11	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
12	)
13
14	// +kubebuilder:webhook:path=/validate-kubeupgrade-heathcliff-eu-v1alpha3-kubeupgradeplan,mutating=false,failurePolicy=fail,groups=kubeupgrade.heathcliff.eu,resources=kubeupgradeplans,verbs=create;update,versions=v1alpha3,name=kubeupgrade.heathcliff.eu,admissionReviewVersions=v1,sideEffects=None
15
16	// planValidatingHook validates the plan
17	type planValidatingHook struct {
18	client.Client
19	}
20
21	// Validate all values of the plan and check if they are sensible
22	func (planValidatingHook) validate(plan v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {	24✔
23	err := api.ValidateObject_KubeUpgradePlan(plan)	24✔
24	if err != nil {	39✔
25	return nil, err	15✔
26	}	15✔
27
28	var warnings []string	9✔
29	if plan.Spec.AllowDowngrade {	10✔
30	warnings = append(warnings, "AllowDowngrade is set to true, downgrading a cluster is not supported by upstream Kubernetes and likely will cause issues. Use at your own risk.")	1✔
31	}	1✔
32
33	allowUnsignedOstreeImages := plan.Spec.Upgraded.AllowUnsignedOstreeImages	9✔
34	for _, group := range plan.Spec.Groups {	20✔
35	if group.Upgraded != nil && group.Upgraded.AllowUnsignedOstreeImages {	12✔
36	allowUnsignedOstreeImages = true	1✔
37	break	1✔
38	}
39	}
40	if allowUnsignedOstreeImages {	11✔
41	warnings = append(warnings, "AllowUnsignedOstreeImages is set to true, this lowers security. Consider signing your custom images with cosign.")	2✔
42	}	2✔
43
44	return warnings, nil	9✔
45	}
46
47	// ValidateCreate validates the object on creation.
48	// The optional warnings will be added to the response as warning messages.
49	// Return an error if the object is invalid.
50	func (p planValidatingHook) ValidateCreate(ctx context.Context, plan v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {	4✔
51	if p.Client == nil {	5✔
52	return nil, fmt.Errorf("no client provided for validating webhook, please report a bug")	1✔
53	}	1✔
54
55	planList := &api.KubeUpgradePlanList{}	3✔
56	err := p.List(ctx, planList)	3✔
57	if err != nil {	3✔
58	return nil, fmt.Errorf("failed to list KubeUpgradePlans: %v", err)	×
UNCOV 59	}	×
60	if len(planList.Items) > 0 {	4✔
61	slog.With("existing-plan", planList.Items[0].Name).Warn("Attempted to create a KubeUpgradePlan, but one already exists")	1✔
62	return nil, fmt.Errorf("KubeUpgradePlan already exists")	1✔
63	}	1✔
64
65	return p.validate(plan)	2✔
66	}
67
68	// ValidateUpdate validates the object on update.
69	// The optional warnings will be added to the response as warning messages.
70	// Return an error if the object is invalid.
71	func (p planValidatingHook) ValidateUpdate(_ context.Context, _ v1alpha3.KubeUpgradePlan, newPlan *v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {	2✔
72	return p.validate(newPlan)	2✔
73	}	2✔
74
75	// ValidateDelete validates the object on deletion.
76	// The optional warnings will be added to the response as warning messages.
77	// Return an error if the object is invalid.
78	func (planValidatingHook) ValidateDelete(_ context.Context, _ v1alpha3.KubeUpgradePlan) (admission.Warnings, error) {	1✔
79	return nil, nil	1✔
80	}	1✔

heathcliff26 / kube-upgrade / 21561672726

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous