{"id":18293060,"url":"https://github.com/kubesphere/storageclass-accessor","last_synced_at":"2025-04-05T11:30:45.091Z","repository":{"id":41207208,"uuid":"420866122","full_name":"kubesphere/storageclass-accessor","owner":"kubesphere","description":"The storageclass-accessor webhook is an HTTP callback which responds to admission requests.","archived":false,"fork":false,"pushed_at":"2024-01-27T15:38:57.000Z","size":41,"stargazers_count":9,"open_issues_count":1,"forks_count":11,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-04-13T21:43:20.444Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kubesphere.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-10-25T03:30:45.000Z","updated_at":"2023-10-17T14:12:04.000Z","dependencies_parsed_at":"2024-01-23T03:42:20.488Z","dependency_job_id":"2c6ce294-10c1-4ab4-8ec1-f0e4859f1558","html_url":"https://github.com/kubesphere/storageclass-accessor","commit_stats":{"total_commits":14,"total_committers":3,"mean_commits":4.666666666666667,"dds":0.4285714285714286,"last_synced_commit":"2f39c69db301912e52cb5544a78326f7f4db441b"},"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubesphere%2Fstorageclass-accessor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubesphere%2Fstorageclass-accessor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubesphere%2Fstorageclass-accessor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubesphere%2Fstorageclass-accessor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kubesphere","download_url":"https://codeload.github.com/kubesphere/storageclass-accessor/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247330401,"owners_count":20921622,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T14:21:43.744Z","updated_at":"2025-04-05T11:30:45.072Z","avatar_url":"https://github.com/kubesphere.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# storageclass-accessor\n\n\n## Contents\n- [Contents](#contents)\n- [Introduction](#introduction)\n- [Installation](#installation)\n    - [Installation by helm-charts](#installation-by-helm-charts)\n    - [Quick Start](#quick-start)\n    - [Accessor CR](#accessor-cr)\n- [Examples](#examples)\n    - [Only fieldSelector](#only-fieldselector)\n    - [Only labelSelector](#only-labelselector)\n    - [Both fieldSelector and labelSelector](#both-fieldselector-and-labelselector)\n- [Notice](#notice)\n\n# Introduction\n\nThe storageclass-accessor webhook is an HTTP callback which responds to admission requests.\n\nWhen creating PVC, it will take out the accessor related to this storage class, and the request will be allowed only when all accessors pass the verification.\n\nUsers can create accessors and set `namespaceSelector` to achieve **namespace-level** management and/or set `workspaceSelector` to achieve **workspace-level** management on the storage class which provisions the PVC.\n\n# Installation\n\n## Installation by helm-charts\n```shell\nhelm install --create-namespace --namespace storageclass-accessor storageclass-accessor main/storageclass-accessor\n```\n\nSee the Chart [README.md](https://github.com/kubesphere/helm-charts/tree/master/src/main/storageclass-accessor) for detailed documentation on the Helm Chart\n## Quick start\n\nThe guide describes how to deploy a storageclass-accessor webhook to a cluster and provides an example accessor based on csi-qingcloud.\n### 1. Install CRD and CR\n```shell\nkubectl create -f  client/config/crds\n```\n\n### 2. Prepare deployment\n```bash\n./deploy/prepare.sh --namespace xyz\n```\n\n### 3. Deploy\n```shell\nkubectl apply -f ./deploy\n```\n\n### 4. Write a CR\nCreate your accessor according to your needs by referring to [Accessor CR](#accessor-cr) and [Examples](#Examples).\n\n### 5. Apply CR\nUse the `kubectl apply` command to make the accessor you created operational.\n\n### 6. Test\nNow you can try to create a PVC. If it is created in a namespace that is not allowed, the following error will be output:\n\n\u003e Error from server: error when creating \"PVC.yaml\": admission webhook \"pvc-accessor.storage.kubesphere.io\" denied the request: The storageClass: **StorageClassName** does not allowed CREATE persistentVolumeClaim **PVC-NAME** in the namespace: **TARGET-NS**\n\n## Accessor CR\n\nA complete accessor should have the following fields:\n\n\n- `spec.storageClassName`\n\n  The accessor knows the effective sc according to this field.\n\n\n- `spec.namespaceSelector`\n\n  This field is used to fill in the limit of nameSpace, Including **labelSelector** and **fieldSelector**.\n\n\n- `spec.namespaceSelector.fieldSelector`\n\n  It is an **array of fieldExpressions** that manages whether nameSpace is available through the label of nameSpace.\n\n\n- `fieldExpressions`\n\n  It is an **array of fieldRule**. Every rule in the array needs to be verified.\n\n  `labelRule` has the following fields:\n\n      1.field: String. Required. Currently supports selection through the \"Name\" and \"Status\" fields.\n      2.operator: String. Required. Currently supports selection through the \"In\" and \"NotIn\" fields.\n      2.values: []String. Required. \n\n- `spec.namespaceSelector.labelSelector`\n\n  It is an **array of matchExpressions** that manages whether nameSpace is available through the label of nameSpace.\n\n\n- `spec.namespaceSelector.labelSelector.matchExpressions`\n\n  It is an **array of labelRule**. Every rule in the array needs to be verified.\n\n  `labelRule` has the following fields:\n\n      1.key: String. Required. Currently supports selection through the \"Name\" and \"Status\" fields.\n      2.operator: String. Required. Currently supports selection through the \"In\" and \"NotIn\" fields.\n      2.values: []String. Required. \n\n\n# Examples\n\nThe following few examples of yaml may be helpful for you to design your own accessor.\n### Only fieldSelector\n\n- Only one `fieldExpression`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: onlyFieldSelector-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    fieldSelector:\n      - fieldExpressions:\n          - field: \"Name\"\n            operator: \"In\"\n            values: [\"NS1\"]\n```\nAfter applying this accessor, you can create the PVC of csi-qingcloud only in namespace.name which in this array :[\"NS1\"].\n\n\nMore than one fieldExpressions are allowed in a `fieldSelector`.\n\nAnd multiple rules are also allowed in `fieldExpressions`.\n\n- Multiple `fieldExpressions`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: multipleFieldExpressions-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    fieldSelector:\n      - fieldExpressions:\n          - field: \"Name\"\n            operator: \"In\"\n            values: [\"NS1\"]\n      - fieldExpressions:\n          - field: \"Name\"\n            operator: \"In\"\n            values: [\"NS2\", \"NS3\"]\n```\nYou can create the PVC of csi-qingcloud in the following namespace: (nameSpace.Name in [\"NS1\"]) **or** (nameSpace.Name in [\"NS2\", \"NS3\"]).\n\n- Multiple rules in one `fieldExpressions`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: multipleFieldExpressions-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    fieldSelector:\n      - fieldExpressions:\n          - field: \"Name\"\n            operator: \"NotIn\"\n            values: [\"NS1\", \"NS2\"]\n          - field: \"Status\"\n            operator: \"In\"\n            values: [\"Active\"]\n```\nYou can create the PVC of csi-qingcloud only in the following namespace: (nameSpace.Name NotIn [\"NS1\", \"NS2\"]) **and** (nameSpace.Status.Status in [\"Active\"])\n\nIt means that the rules in `fieldExpressions` must be followed at the same time.\n\n### Only labelSelector\n\n- Only one `matchExpressions`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: csi-qingcloud-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    labelSelector:\n      - matchExpressions:\n          - key: \"app\"\n            operator: \"In\"\n            values: [\"app1\", \"app2\"]\n```\nThis requires nameSpace to have the key \"app\" label and the value in this array: [\"app1\", \"app2\"].\n\n\n- Multiple `matchExpressions`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: multipleFieldExpressions-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    labelSelector:\n      - matchExpressions:\n          - key: \"app\"\n            operator: \"In\"\n            values: [\"app1\", \"app2\"]\n      - matchExpressions:\n          - key: \"owner\"\n            operator: \"In\"\n            values: [\"owner1\", \"owner2\"]\n```\nYou can create the PVC of csi-qingcloud in the following namespace: (have the key \"app\" label and the value in [\"app1\", \"app2\"]) **or** (have the key \"owner\" label and the value in [\"owner1\", \"owner2\"]).\n\n- Multiple rule in one `FieldExpressions`\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: multipleFieldExpressions-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    labelSelector:\n      - matchExpressions:\n          - key: \"app\"\n            operator: \"In\"\n            values: [\"app1\"]\n          - key: \"role\"\n            operator: \"In\"\n            values: [\"owner1\", \"owner2\"]\n```\nYou can create the PVC of csi-qingcloud in the following namespace: (have the key \"app\" label and in the value in [\"app1\"]) **and** (have the key \"owner\" label and the value in [\"owner1\", \"owner2\"]).\n\n### Both fieldSelector and labelSelector\n\n```yaml\napiVersion: storage.kubesphere.io/v1alpha1\nkind: Accessor\nmetadata:\n  name: csi-qingcloud-accessor\nspec:\n  storageClassName: \"csi-qingcloud\"\n  namespaceSelector:\n    fieldSelector:\n      - fieldExpressions:\n          - field: \"Name\"\n            operator: \"In\"\n            values: [\"NS1\", \"NS2\"]\n      - fieldExpressions:\n          - field: \"Status\"\n            operator: \"In\"\n            values: [\"Active\"]\n    labelSelector:\n      - matchExpressions:\n          - key: \"app\"\n            operator: \"In\"\n            values: [\"app1\"]\n          - key: \"owner\"\n            operator: \"In\"\n            values: [\"owner1\", \"owner2\"]\n      - matchExpressions:\n          - key: \"app\"\n            operator: \"In\"\n            values: [\"app2\", \"app3\"]\n```\nIt is allowed to create PVC in a namespace that meets one of the following conditions:\n- (name in [\"NS1\", \"NS2\"]) **and** (have the key \"app\" label and in the value in [\"app1\"]) **and** (have the key \"owner\" label and the value in [\"owner1\", \"owner2\"])\n- (name in [\"NS1\", \"NS2\"]) **and** (have the key \"app\" label and in the value in [\"app2\", \"app3\"])\n- (status.Status in [\"Active\"]) **and** (have the key \"app\" label and in the value in [\"app1\"]) **and** (have the key \"owner\" label and the value in [\"owner1\", \"owner2\"])\n- (status.Status in [\"Active\"]) **and** (have the key \"app\" label and in the value in [\"app2\", \"app3\"])\n\n# Notice\n\n:warning: **Warning**: Too many accessors may cause unexpected errors in your webhook. It is recommended that one storage class should correspond to one accessor.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubesphere%2Fstorageclass-accessor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkubesphere%2Fstorageclass-accessor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubesphere%2Fstorageclass-accessor/lists"}