fix(admission): use client network, fail-open on nil gRPC client, close http resources

- Use client address network instead of listener network in admission wrapper
- Return true (allow) when gRPC admission plugin client is nil to fail-open
- Add Close() to httpPlugin to close idle HTTP connections
- Close httpLoader in localAdmission.Close()
- Remove dead commented-out code in periodReload

admission/admission.go

@@ -145,7 +145,6 @@ func (p *localAdmission) periodReload(ctx context.Context) error {
 		case <-ticker.C:
 			if err := p.reload(ctx); err != nil {
 				p.logger.Warnf("reload: %v", err)
-				// return err
 			}
 		case <-ctx.Done():
 			return ctx.Err()
@@ -279,6 +278,9 @@ func (p *localAdmission) Close() error {
 	if p.options.redisLoader != nil {
 		p.options.redisLoader.Close()
 	}
+	if p.options.httpLoader != nil {
+		p.options.httpLoader.Close()
+	}
 	return nil
 }
 

admission/plugin/grpc.go

@@ -45,7 +45,7 @@ func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Ad
 
 func (p *grpcPlugin) Admit(ctx context.Context, network, addr string, opts ...admission.Option) bool {
 	if p.client == nil {
-		return false
+		return true
 	}
 
 	var options admission.Options

admission/plugin/http.go

@@ -91,3 +91,10 @@ func (p *httpPlugin) Admit(ctx context.Context, network, addr string, opts ...ad
 	}
 	return res.OK
 }
+
+func (p *httpPlugin) Close() error {
+	if p.client != nil {
+		p.client.CloseIdleConnections()
+	}
+	return nil
+}

admission/wrapper/listener.go

@@ -47,7 +47,7 @@ func (ln *listener) Accept() (net.Conn, error) {
 		}
 
 		if ln.admission != nil &&
-			!ln.admission.Admit(ctx, ln.Addr().Network(), clientAddr.String(), admission.WithService(ln.service)) {
+			!ln.admission.Admit(ctx, clientAddr.Network(), clientAddr.String(), admission.WithService(ln.service)) {
 			c.Close()
 			continue
 		}