multiValidating and multiMutating handlers implement DecoderInjector

pkg/webhook/admission/multi.go

@@ -77,6 +77,16 @@ func (hs multiMutating) InjectFunc(f inject.Func) error {
 	return nil
 }
 
+// InjectDecoder injects the decoder into the handlers.
+func (hs multiMutating) InjectDecoder(d *Decoder) error {
+	for _, handler := range hs {
+		if _, err := InjectDecoderInto(d, handler); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // MultiMutatingHandler combines multiple mutating webhook handlers into a single
 // mutating webhook handler.  Handlers are called in sequential order, and the first
 // `allowed: false`	response may short-circuit the rest.  Users must take care to
@@ -125,3 +135,13 @@ func (hs multiValidating) InjectFunc(f inject.Func) error {
 
 	return nil
 }
+
+// InjectDecoder injects the decoder into the handlers.
+func (hs multiValidating) InjectDecoder(d *Decoder) error {
+	for _, handler := range hs {
+		if _, err := InjectDecoderInto(d, handler); err != nil {
+			return err
+		}
+	}
+	return nil
+}

pkg/webhook/webhook_integration_test.go

@@ -84,6 +84,29 @@ var _ = Describe("Webhook", func() {
 				return errors.ReasonForError(err) == metav1.StatusReason("Always denied")
 			}, 1*time.Second).Should(BeTrue())
 
+			cancel()
+			close(done)
+		})
+		It("should reject create request for multi-webhook that rejects all requests", func(done Done) {
+			m, err := manager.New(cfg, manager.Options{
+				Port:    testenv.WebhookInstallOptions.LocalServingPort,
+				Host:    testenv.WebhookInstallOptions.LocalServingHost,
+				CertDir: testenv.WebhookInstallOptions.LocalServingCertDir,
+			}) // we need manager here just to leverage manager.SetFields
+			Expect(err).NotTo(HaveOccurred())
+			server := m.GetWebhookServer()
+			server.Register("/failing", &webhook.Admission{Handler: admission.MultiValidatingHandler(&rejectingValidator{})})
+
+			ctx, cancel := context.WithCancel(context.Background())
+			go func() {
+				_ = server.Start(ctx)
+			}()
+
+			Eventually(func() bool {
+				err = c.Create(context.TODO(), obj)
+				return errors.ReasonForError(err) == metav1.StatusReason("Always denied")
+			}, 1*time.Second).Should(BeTrue())
+
 			cancel()
 			close(done)
 		})
@@ -170,8 +193,18 @@ var _ = Describe("Webhook", func() {
 })
 
 type rejectingValidator struct {
+	d *admission.Decoder
+}
+
+func (v *rejectingValidator) InjectDecoder(d *admission.Decoder) error {
+	v.d = d
+	return nil
 }
 
 func (v *rejectingValidator) Handle(ctx context.Context, req admission.Request) admission.Response {
+	var obj appsv1.Deployment
+	if err := v.d.Decode(req, &obj); err != nil {
+		return admission.Denied(err.Error())
+	}
 	return admission.Denied(fmt.Sprint("Always denied"))
 }