Skip to content

Commit c2e6b76

Browse files
t0mmylamt0mmylam
authored
feat: add DeploymentPolicy validation and defaults with tests (#100)
* feat: add DeploymentPolicy validation and defaults with tests * create deployment policy webhook and remove redundant validation logic * add e2e test
1 parent ca12b9d commit c2e6b76

18 files changed

+812
-56
lines changed

‎chart/templates/deploymentpolicy-crd.yaml‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,22 @@
1-
# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2-
# SPDX-License-Identifier: Apache-2.0
3-
#
4-
#
5-
# Licensed under the Apache License, Version 2.0 (the "License");
6-
# you may not use this file except in compliance with the License.
7-
# You may obtain a copy of the License at
8-
#
9-
# http://www.apache.org/licenses/LICENSE-2.0
10-
#
11-
# Unless required by applicable law or agreed to in writing, software
12-
# distributed under the License is distributed on an "AS IS" BASIS,
13-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14-
# See the License for the specific language governing permissions and
15-
# limitations under the License.
16-
17-
---
181
apiVersion: apiextensions.k8s.io/v1
192
kind: CustomResourceDefinition
203
metadata:
4+
name: deploymentpolicies.skyhook.nvidia.com
215
annotations:
226
controller-gen.kubebuilder.io/version: v0.18.0
23-
name: deploymentpolicies.skyhook.nvidia.com
7+
labels:
8+
{{- include "chart.labels" . | nindent 4 }}
249
spec:
10+
conversion:
11+
strategy: Webhook
12+
webhook:
13+
clientConfig:
14+
service:
15+
name: skyhook-operator-webhook-service
16+
namespace: '{{ .Release.Namespace }}'
17+
path: /convert
18+
conversionReviewVersions:
19+
- v1
2520
group: skyhook.nvidia.com
2621
names:
2722
kind: DeploymentPolicy
@@ -269,6 +264,8 @@ spec:
269264
type: integer
270265
type: object
271266
type: object
267+
required:
268+
- strategy
272269
type: object
273270
required:
274271
- default

‎chart/templates/mutating-webhook.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,32 @@ webhooks:
3232
scope: '*'
3333
sideEffects: None
3434
timeoutSeconds: 10
35+
- admissionReviewVersions:
36+
- v1
37+
clientConfig:
38+
caBundle: ""
39+
service:
40+
name: skyhook-operator-webhook-service
41+
namespace: {{ .Release.Namespace }}
42+
path: /mutate-skyhook-nvidia-com-v1alpha1-deploymentpolicy
43+
port: 443
44+
failurePolicy: Fail
45+
matchPolicy: Equivalent
46+
name: mutate-deploymentpolicy.nvidia.com
47+
namespaceSelector: {}
48+
objectSelector: {}
49+
reinvocationPolicy: Never
50+
rules:
51+
- apiGroups:
52+
- skyhook.nvidia.com
53+
apiVersions:
54+
- v1alpha1
55+
operations:
56+
- CREATE
57+
- UPDATE
58+
resources:
59+
- deploymentpolicies
60+
scope: '*'
61+
sideEffects: None
62+
timeoutSeconds: 10
3563
{{- end }}

‎chart/templates/validating-webhook.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,31 @@ webhooks:
3131
scope: '*'
3232
sideEffects: None
3333
timeoutSeconds: 10
34+
- admissionReviewVersions:
35+
- v1
36+
clientConfig:
37+
caBundle: ""
38+
service:
39+
name: skyhook-operator-webhook-service
40+
namespace: {{ .Release.Namespace }}
41+
path: /validate-skyhook-nvidia-com-v1alpha1-deploymentpolicy
42+
port: 443
43+
failurePolicy: Fail
44+
matchPolicy: Equivalent
45+
name: validate-deploymentpolicy.nvidia.com
46+
namespaceSelector: {}
47+
objectSelector: {}
48+
rules:
49+
- apiGroups:
50+
- skyhook.nvidia.com
51+
apiVersions:
52+
- v1alpha1
53+
operations:
54+
- CREATE
55+
- UPDATE
56+
resources:
57+
- deploymentpolicies
58+
scope: '*'
59+
sideEffects: None
60+
timeoutSeconds: 10
3461
{{- end }}

‎k8s-tests/chainsaw/helm/helm-webhook-test/chainsaw-test.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ kind: Test
2020
metadata:
2121
name: helm-chart-webhook
2222
spec:
23-
description: This test asserts that the helm chart is working as expected. Specifically it asserts that webhooks work as expected. Validating an invalid skyhook should fail.
23+
description: This test asserts that the helm chart is working as expected. Specifically it asserts that webhooks work as expected. Validating an invalid skyhook should fail. Validating an invalid deployment policy should fail.
2424
concurrent: false
2525
timeouts:
2626
assert: 180s
@@ -48,6 +48,21 @@ spec:
4848
cat err.txt
4949
exit 1
5050
fi
51+
- script:
52+
content: |
53+
## Create invalid DeploymentPolicy
54+
kubectl apply -f invalid-deploymentpolicy.yaml 2>err.txt
55+
ec=$?
56+
cat err.txt
57+
if [ $ec -eq 0 ]; then
58+
echo "ERROR: invalid DeploymentPolicy was accepted"
59+
exit 1
60+
fi
61+
if ! grep -q "admission webhook \"validate-deploymentpolicy.nvidia.com\" denied the request" err.txt; then
62+
echo "ERROR: Did not get expected DeploymentPolicy webhook validation error"
63+
cat err.txt
64+
exit 1
65+
fi
5166
- assert:
5267
file: assert-webhook.yaml
5368
- script:

‎k8s-tests/chainsaw/helm/helm-webhook-test/invalid-deploymentpolicy.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
#
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
apiVersion: skyhook.nvidia.com/v1alpha1
18+
kind: DeploymentPolicy
19+
metadata:
20+
labels:
21+
app.kubernetes.io/part-of: skyhook-operator
22+
app.kubernetes.io/created-by: skyhook-operator
23+
name: invalid-deploymentpolicy
24+
spec:
25+
default:
26+
budget:
27+
percent: 50
28+
strategy:
29+
fixed:
30+
initialBatch: 5
31+
compartments:
32+
- name: duplicate-name
33+
selector:
34+
matchLabels:
35+
zone: us-west-1
36+
budget:
37+
count: 10
38+
- name: duplicate-name # Invalid: duplicate compartment name
39+
selector:
40+
matchLabels:
41+
zone: us-east-1
42+
budget:
43+
count: 5

‎k8s-tests/chainsaw/helm/helm-webhook-test/values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ controllerManager:
2020
# for more info refer to the README
2121
image:
2222
repository: ghcr.io/nvidia/skyhook/operator
23-
tag: v0.7.6-1ec0890 ## TODO: update this to latest onces this is merged
23+
tag: v0.9.0-76cb952
2424
digest: ""
2525
webhook:
2626
enable: true

0 commit comments

Comments
 (0)