From ed93d60004a24bb00f29aa71f1f73fa251fcac63 Mon Sep 17 00:00:00 2001
From: ginuerzh <ginuerzh@gmail.com>
Date: Fri, 22 May 2026 15:58:24 +0800
Subject: [PATCH] fix(admission): use client network, fail-open on nil gRPC
 client, close http resources

- Use client address network instead of listener network in admission wrapper
- Return true (allow) when gRPC admission plugin client is nil to fail-open
- Add Close() to httpPlugin to close idle HTTP connections
- Close httpLoader in localAdmission.Close()
- Remove dead commented-out code in periodReload
---
 admission/admission.go        | 4 +++-
 admission/plugin/grpc.go      | 2 +-
 admission/plugin/http.go      | 7 +++++++
 admission/wrapper/listener.go | 2 +-
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/admission/admission.go b/admission/admission.go
index ba67a33d..1503c2e3 100644
--- a/admission/admission.go
+++ b/admission/admission.go
@@ -145,7 +145,6 @@ func (p *localAdmission) periodReload(ctx context.Context) error {
 		case <-ticker.C:
 			if err := p.reload(ctx); err != nil {
 				p.logger.Warnf("reload: %v", err)
-				// return err
 			}
 		case <-ctx.Done():
 			return ctx.Err()
@@ -279,6 +278,9 @@ func (p *localAdmission) Close() error {
 	if p.options.redisLoader != nil {
 		p.options.redisLoader.Close()
 	}
+	if p.options.httpLoader != nil {
+		p.options.httpLoader.Close()
+	}
 	return nil
 }
 
diff --git a/admission/plugin/grpc.go b/admission/plugin/grpc.go
index 287ac85a..63a3f791 100644
--- a/admission/plugin/grpc.go
+++ b/admission/plugin/grpc.go
@@ -45,7 +45,7 @@ func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Ad
 
 func (p *grpcPlugin) Admit(ctx context.Context, network, addr string, opts ...admission.Option) bool {
 	if p.client == nil {
-		return false
+		return true
 	}
 
 	var options admission.Options
diff --git a/admission/plugin/http.go b/admission/plugin/http.go
index b22cc341..f17b0542 100644
--- a/admission/plugin/http.go
+++ b/admission/plugin/http.go
@@ -91,3 +91,10 @@ func (p *httpPlugin) Admit(ctx context.Context, network, addr string, opts ...ad
 	}
 	return res.OK
 }
+
+func (p *httpPlugin) Close() error {
+	if p.client != nil {
+		p.client.CloseIdleConnections()
+	}
+	return nil
+}
diff --git a/admission/wrapper/listener.go b/admission/wrapper/listener.go
index eaca3428..d47610ca 100644
--- a/admission/wrapper/listener.go
+++ b/admission/wrapper/listener.go
@@ -47,7 +47,7 @@ func (ln *listener) Accept() (net.Conn, error) {
 		}
 
 		if ln.admission != nil &&
-			!ln.admission.Admit(ctx, ln.Addr().Network(), clientAddr.String(), admission.WithService(ln.service)) {
+			!ln.admission.Admit(ctx, clientAddr.Network(), clientAddr.String(), admission.WithService(ln.service)) {
 			c.Close()
 			continue
 		}