Skip to content

Commit 0b61007

Browse files
killianmuldoonkillianmuldoon
committed
Replace webhook resource injector with MutatingAdmissionPolicy
- Add MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding templates - Remove webhook-based resource injector (deployment, RBAC, certificates) - Add envtest-based tests for admission policy - Update Makefile with test helpers (TESTPKG, TESTARGS, helm install) - Simplify values.yaml to just enabled and resourceName options
1 parent f073927 commit 0b61007

File tree

27 files changed

+629
-1224
lines changed

27 files changed

+629
-1224
lines changed

‎Makefile‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,14 +80,42 @@ docker-push-dpf-utils: ## Push DPF utilities image to registry
8080
##@ DPF Utils Targets
8181

8282
DPF_UTILS_DIR = dpf-utils
83+
ENVTEST_K8S_VERSION ?= 1.33.0
84+
ENVTEST ?= $(TOOLSDIR)/setup-envtest
8385

8486
.PHONY: lint
8587
lint: golangci-lint ## Run linter for DPF utilities
8688
cd $(DPF_UTILS_DIR) && $(GOLANGCI_LINT) run --timeout=5m ./...
8789

90+
.PHONY: generate-test-policy
91+
generate-test-policy: helm ## Generate admission policy testdata from helm chart
92+
@mkdir -p $(DPF_UTILS_DIR)/internal/admissionpolicy/testdata
93+
@$(HELM) template test-release $(HELM_CHART_DIR) \
94+
--set ovn-kubernetes-resource-injector.enabled=true \
95+
--skip-crds \
96+
-n test-namespace \
97+
-s templates/mutating-admission-policy.yaml \
98+
-s templates/mutating-admission-policy-binding.yaml \
99+
> $(DPF_UTILS_DIR)/internal/admissionpolicy/testdata/policy.yaml
100+
101+
# Test arguments (use: make test TESTARGS="-run TestAdmissionPolicy")
102+
# Test package (use: make test TESTPKG="./internal/admissionpolicy/...")
103+
TESTARGS ?=
104+
TESTPKG ?= ./...
105+
88106
.PHONY: test
89-
test: ## Run tests for DPF utilities
90-
cd $(DPF_UTILS_DIR) && go test -v -coverprofile=coverage.out -covermode=atomic ./...
107+
test: envtest ## Run tests for DPF utilities (including envtest)
108+
cd $(DPF_UTILS_DIR) && KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLSDIR) -p path)" \
109+
go test -v -coverprofile=coverage.out -covermode=atomic $(TESTPKG) $(TESTARGS)
110+
111+
.PHONY: envtest
112+
envtest: $(ENVTEST) ## Download setup-envtest and k8s binaries locally if necessary
113+
@echo "Ensuring k8s $(ENVTEST_K8S_VERSION) binaries are available..."
114+
@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLSDIR) -p path > /dev/null
115+
116+
$(ENVTEST): | $(TOOLSDIR)
117+
@echo "Installing setup-envtest..."
118+
GOBIN=$(TOOLSDIR) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
91119

92120
##@ Helm Chart Targets
93121

@@ -98,8 +126,6 @@ HELM_OUTPUT_DIR ?= _output/helm
98126
helm-build: yq
99127
@mkdir -p $(HELM_OUTPUT_DIR)
100128
@cp $(HELM_CHART_DIR)/values.yaml.tmpl $(HELM_CHART_DIR)/values.yaml
101-
@$(YQ) eval -i '.ovn-kubernetes-resource-injector.controllerManager.webhook.image.repository = "$(DPF_UTILS_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
102-
@$(YQ) eval -i '.ovn-kubernetes-resource-injector.controllerManager.webhook.image.tag = "$(TAG)"' $(HELM_CHART_DIR)/values.yaml
103129
@$(YQ) eval -i '.nodeWithDPUManifests.image.repository = "$(OVNKUBERNETES_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
104130
@$(YQ) eval -i '.nodeWithDPUManifests.image.tag = "$(TAG)"' $(HELM_CHART_DIR)/values.yaml
105131
@$(YQ) eval -i '.nodeWithoutDPUManifests.image.repository = "$(OVNKUBERNETES_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
@@ -131,6 +157,8 @@ YQ_VERSION ?= v4.45.1
131157
export YQ ?= $(TOOLSDIR)/yq-$(YQ_VERSION)
132158
GOLANGCI_LINT_VERSION ?= v1.62.2
133159
export GOLANGCI_LINT ?= $(TOOLSDIR)/golangci-lint-$(GOLANGCI_LINT_VERSION)
160+
HELM_VERSION ?= v3.16.3
161+
export HELM ?= $(TOOLSDIR)/helm-$(HELM_VERSION)
134162

135163
define go-install-tool
136164
@[ -f $(1) ] || { \
@@ -153,4 +181,11 @@ $(YQ): | $(TOOLSDIR)
153181
.PHONY: golangci-lint
154182
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary
155183
$(GOLANGCI_LINT): | $(TOOLSDIR)
156-
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
184+
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
185+
186+
.PHONY: helm
187+
helm: $(HELM) ## Download helm locally if necessary
188+
$(HELM): | $(TOOLSDIR)
189+
@echo "Installing helm $(HELM_VERSION)..."
190+
@curl -fsSL https://get.helm.sh/helm-$(HELM_VERSION)-$(OS)-$(ARCH).tar.gz | tar xz -C $(TOOLSDIR) --strip-components=1 $(OS)-$(ARCH)/helm
191+
@mv $(TOOLSDIR)/helm $(HELM)

‎dpf-utils/Dockerfile‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,6 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
3232
-gcflags="${gcflags}" \
3333
-o dpucniprovisioner ./cmd/dpucniprovisioner
3434

35-
RUN --mount=type=cache,target=/root/.cache/go-build \
36-
--mount=type=cache,target=/go/pkg/mod \
37-
CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
38-
go build -trimpath \
39-
-ldflags="${ldflags}" \
40-
-gcflags="${gcflags}" \
41-
-o ovnkubernetesresourceinjector ./cmd/ovnkubernetesresourceinjector
42-
4335
# Create source code archive excluding .gocache, and test files.
4436
# Skipping `.gocache` since it contains pre-compiled versions of packages and other build artifacts for speeding up subsequent builds
4537
RUN mkdir src && \
@@ -80,7 +72,6 @@ RUN mkdir -p /var/run/openvswitch
8072
RUN mkdir -p /usr/libexec/cni/
8173
COPY --from=builder /workspace/ipallocator /ipallocator
8274
COPY --from=builder /workspace/dpucniprovisioner /cniprovisioner
83-
COPY --from=builder /workspace/ovnkubernetesresourceinjector /ovnkubernetesresourceinjector
8475

8576
# Get all the source code
8677
RUN mkdir -p /src

‎dpf-utils/cmd/ovnkubernetesresourceinjector/main.go‎

Lines changed: 0 additions & 158 deletions
This file was deleted.

‎dpf-utils/go.mod‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,10 @@ require (
1818
)
1919

2020
require (
21-
github.com/beorn7/perks v1.0.1 // indirect
22-
github.com/cespare/xxhash/v2 v2.3.0 // indirect
21+
github.com/blang/semver/v4 v4.0.0 // indirect
2322
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
2423
github.com/emicklei/go-restful/v3 v3.12.1 // indirect
2524
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
26-
github.com/fsnotify/fsnotify v1.8.0 // indirect
2725
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
2826
github.com/go-logr/logr v1.4.2 // indirect
2927
github.com/go-logr/zapr v1.3.0 // indirect
@@ -32,7 +30,6 @@ require (
3230
github.com/go-openapi/swag v0.23.0 // indirect
3331
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
3432
github.com/gogo/protobuf v1.3.2 // indirect
35-
github.com/google/btree v1.1.3 // indirect
3633
github.com/google/gnostic-models v0.6.9 // indirect
3734
github.com/google/go-cmp v0.7.0 // indirect
3835
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
@@ -44,10 +41,6 @@ require (
4441
github.com/modern-go/reflect2 v1.0.2 // indirect
4542
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
4643
github.com/pkg/errors v0.9.1 // indirect
47-
github.com/prometheus/client_golang v1.22.0 // indirect
48-
github.com/prometheus/client_model v0.6.1 // indirect
49-
github.com/prometheus/common v0.62.0 // indirect
50-
github.com/prometheus/procfs v0.15.1 // indirect
5144
github.com/spf13/pflag v1.0.6-0.20201009195203-85dd5c8bc61c // indirect
5245
github.com/vishvananda/netns v0.0.5 // indirect
5346
github.com/x448/float16 v0.8.4 // indirect
@@ -56,13 +49,11 @@ require (
5649
go.uber.org/zap v1.27.0 // indirect
5750
golang.org/x/net v0.38.0 // indirect
5851
golang.org/x/oauth2 v0.27.0 // indirect
59-
golang.org/x/sync v0.12.0 // indirect
6052
golang.org/x/sys v0.32.0 // indirect
6153
golang.org/x/term v0.30.0 // indirect
6254
golang.org/x/text v0.23.0 // indirect
6355
golang.org/x/time v0.9.0 // indirect
6456
golang.org/x/tools v0.31.0 // indirect
65-
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
6657
google.golang.org/protobuf v1.36.5 // indirect
6758
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
6859
gopkg.in/inf.v0 v0.9.1 // indirect

‎dpf-utils/go.sum‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
1212
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1313
github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
1414
github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
15-
github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
16-
github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1715
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
1816
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
1917
github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
@@ -34,16 +32,12 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
3432
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
3533
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
3634
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
37-
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
38-
github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
3935
github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
4036
github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
4137
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
4238
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
4339
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
4440
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
45-
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
46-
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
4741
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
4842
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
4943
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -54,14 +48,10 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
5448
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
5549
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
5650
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
57-
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
58-
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
5951
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
6052
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
6153
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
6254
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
63-
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
64-
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
6555
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
6656
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
6757
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -137,8 +127,6 @@ golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT
137127
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
138128
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
139129
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
140-
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
141-
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
142130
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
143131
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
144132
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

0 commit comments

Comments
 (0)