Skip to content

Commit 944079c

Browse files
killianmuldoonkillianmuldoon
committed
Replace webhook resource injector with MutatingAdmissionPolicy
- Add MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding templates - Remove webhook-based resource injector (deployment, RBAC, certificates) - Add envtest-based tests for admission policy - Update Makefile with test helpers (TESTPKG, TESTARGS, helm install) - Simplify values.yaml to just enabled and resourceName options
1 parent f073927 commit 944079c

File tree

27 files changed

+544
-1224
lines changed

27 files changed

+544
-1224
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ charts/*.tgz
5858
*.tgz
5959
requirements.lock
6060

61+
# Generated testdata
62+
dpf-utils/internal/admissionpolicy/testdata/
63+
6164
# Temporary files
6265
tmp/
6366
temp/

‎Makefile‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,14 +80,41 @@ docker-push-dpf-utils: ## Push DPF utilities image to registry
8080
##@ DPF Utils Targets
8181

8282
DPF_UTILS_DIR = dpf-utils
83+
ENVTEST_K8S_VERSION ?= 1.33.0
84+
ENVTEST ?= $(TOOLSDIR)/setup-envtest
8385

8486
.PHONY: lint
8587
lint: golangci-lint ## Run linter for DPF utilities
8688
cd $(DPF_UTILS_DIR) && $(GOLANGCI_LINT) run --timeout=5m ./...
8789

90+
.PHONY: generate-test-policy
91+
generate-test-policy: ## Generate admission policy testdata from helm chart
92+
@mkdir -p $(DPF_UTILS_DIR)/internal/admissionpolicy/testdata
93+
@helm template test-release $(HELM_CHART_DIR) \
94+
--set ovn-kubernetes-resource-injector.enabled=true \
95+
-n test-namespace \
96+
-s templates/mutating-admission-policy.yaml \
97+
-s templates/mutating-admission-policy-binding.yaml \
98+
> $(DPF_UTILS_DIR)/internal/admissionpolicy/testdata/policy.yaml
99+
100+
# Test arguments (use: make test TESTARGS="-run TestAdmissionPolicy")
101+
# Test package (use: make test TESTPKG="./internal/admissionpolicy/...")
102+
TESTARGS ?=
103+
TESTPKG ?= ./...
104+
88105
.PHONY: test
89-
test: ## Run tests for DPF utilities
90-
cd $(DPF_UTILS_DIR) && go test -v -coverprofile=coverage.out -covermode=atomic ./...
106+
test: envtest generate-test-policy ## Run tests for DPF utilities (including envtest)
107+
cd $(DPF_UTILS_DIR) && KUBEBUILDER_ASSETS="$$($(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLSDIR) -p path)" \
108+
go test -v -coverprofile=coverage.out -covermode=atomic $(TESTPKG) -args -ginkgo.v $(TESTARGS)
109+
110+
.PHONY: envtest
111+
envtest: $(ENVTEST) ## Download setup-envtest and k8s binaries locally if necessary
112+
@echo "Ensuring k8s $(ENVTEST_K8S_VERSION) binaries are available..."
113+
@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLSDIR) -p path > /dev/null
114+
115+
$(ENVTEST): | $(TOOLSDIR)
116+
@echo "Installing setup-envtest..."
117+
GOBIN=$(TOOLSDIR) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
91118

92119
##@ Helm Chart Targets
93120

@@ -98,8 +125,6 @@ HELM_OUTPUT_DIR ?= _output/helm
98125
helm-build: yq
99126
@mkdir -p $(HELM_OUTPUT_DIR)
100127
@cp $(HELM_CHART_DIR)/values.yaml.tmpl $(HELM_CHART_DIR)/values.yaml
101-
@$(YQ) eval -i '.ovn-kubernetes-resource-injector.controllerManager.webhook.image.repository = "$(DPF_UTILS_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
102-
@$(YQ) eval -i '.ovn-kubernetes-resource-injector.controllerManager.webhook.image.tag = "$(TAG)"' $(HELM_CHART_DIR)/values.yaml
103128
@$(YQ) eval -i '.nodeWithDPUManifests.image.repository = "$(OVNKUBERNETES_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
104129
@$(YQ) eval -i '.nodeWithDPUManifests.image.tag = "$(TAG)"' $(HELM_CHART_DIR)/values.yaml
105130
@$(YQ) eval -i '.nodeWithoutDPUManifests.image.repository = "$(OVNKUBERNETES_IMAGE)"' $(HELM_CHART_DIR)/values.yaml
@@ -131,6 +156,8 @@ YQ_VERSION ?= v4.45.1
131156
export YQ ?= $(TOOLSDIR)/yq-$(YQ_VERSION)
132157
GOLANGCI_LINT_VERSION ?= v1.62.2
133158
export GOLANGCI_LINT ?= $(TOOLSDIR)/golangci-lint-$(GOLANGCI_LINT_VERSION)
159+
HELM_VERSION ?= v3.16.3
160+
export HELM ?= $(TOOLSDIR)/helm-$(HELM_VERSION)
134161

135162
define go-install-tool
136163
@[ -f $(1) ] || { \
@@ -153,4 +180,11 @@ $(YQ): | $(TOOLSDIR)
153180
.PHONY: golangci-lint
154181
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary
155182
$(GOLANGCI_LINT): | $(TOOLSDIR)
156-
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
183+
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
184+
185+
.PHONY: helm
186+
helm: $(HELM) ## Download helm locally if necessary
187+
$(HELM): | $(TOOLSDIR)
188+
@echo "Installing helm $(HELM_VERSION)..."
189+
@curl -fsSL https://get.helm.sh/helm-$(HELM_VERSION)-$(OS)-$(ARCH).tar.gz | tar xz -C $(TOOLSDIR) --strip-components=1 $(OS)-$(ARCH)/helm
190+
@mv $(TOOLSDIR)/helm $(HELM)

‎dpf-utils/Dockerfile‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,6 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
3232
-gcflags="${gcflags}" \
3333
-o dpucniprovisioner ./cmd/dpucniprovisioner
3434

35-
RUN --mount=type=cache,target=/root/.cache/go-build \
36-
--mount=type=cache,target=/go/pkg/mod \
37-
CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
38-
go build -trimpath \
39-
-ldflags="${ldflags}" \
40-
-gcflags="${gcflags}" \
41-
-o ovnkubernetesresourceinjector ./cmd/ovnkubernetesresourceinjector
42-
4335
# Create source code archive excluding .gocache, and test files.
4436
# Skipping `.gocache` since it contains pre-compiled versions of packages and other build artifacts for speeding up subsequent builds
4537
RUN mkdir src && \
@@ -80,7 +72,6 @@ RUN mkdir -p /var/run/openvswitch
8072
RUN mkdir -p /usr/libexec/cni/
8173
COPY --from=builder /workspace/ipallocator /ipallocator
8274
COPY --from=builder /workspace/dpucniprovisioner /cniprovisioner
83-
COPY --from=builder /workspace/ovnkubernetesresourceinjector /ovnkubernetesresourceinjector
8475

8576
# Get all the source code
8677
RUN mkdir -p /src

‎dpf-utils/cmd/ovnkubernetesresourceinjector/main.go‎

Lines changed: 0 additions & 158 deletions
This file was deleted.

‎dpf-utils/go.mod‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,10 @@ require (
1818
)
1919

2020
require (
21-
github.com/beorn7/perks v1.0.1 // indirect
22-
github.com/cespare/xxhash/v2 v2.3.0 // indirect
21+
github.com/blang/semver/v4 v4.0.0 // indirect
2322
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
2423
github.com/emicklei/go-restful/v3 v3.12.1 // indirect
2524
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
26-
github.com/fsnotify/fsnotify v1.8.0 // indirect
2725
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
2826
github.com/go-logr/logr v1.4.2 // indirect
2927
github.com/go-logr/zapr v1.3.0 // indirect
@@ -32,7 +30,6 @@ require (
3230
github.com/go-openapi/swag v0.23.0 // indirect
3331
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
3432
github.com/gogo/protobuf v1.3.2 // indirect
35-
github.com/google/btree v1.1.3 // indirect
3633
github.com/google/gnostic-models v0.6.9 // indirect
3734
github.com/google/go-cmp v0.7.0 // indirect
3835
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
@@ -44,10 +41,6 @@ require (
4441
github.com/modern-go/reflect2 v1.0.2 // indirect
4542
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
4643
github.com/pkg/errors v0.9.1 // indirect
47-
github.com/prometheus/client_golang v1.22.0 // indirect
48-
github.com/prometheus/client_model v0.6.1 // indirect
49-
github.com/prometheus/common v0.62.0 // indirect
50-
github.com/prometheus/procfs v0.15.1 // indirect
5144
github.com/spf13/pflag v1.0.6-0.20201009195203-85dd5c8bc61c // indirect
5245
github.com/vishvananda/netns v0.0.5 // indirect
5346
github.com/x448/float16 v0.8.4 // indirect
@@ -56,13 +49,11 @@ require (
5649
go.uber.org/zap v1.27.0 // indirect
5750
golang.org/x/net v0.38.0 // indirect
5851
golang.org/x/oauth2 v0.27.0 // indirect
59-
golang.org/x/sync v0.12.0 // indirect
6052
golang.org/x/sys v0.32.0 // indirect
6153
golang.org/x/term v0.30.0 // indirect
6254
golang.org/x/text v0.23.0 // indirect
6355
golang.org/x/time v0.9.0 // indirect
6456
golang.org/x/tools v0.31.0 // indirect
65-
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
6657
google.golang.org/protobuf v1.36.5 // indirect
6758
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
6859
gopkg.in/inf.v0 v0.9.1 // indirect

‎dpf-utils/go.sum‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
1212
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1313
github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
1414
github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
15-
github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
16-
github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1715
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
1816
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
1917
github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
@@ -34,16 +32,12 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
3432
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
3533
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
3634
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
37-
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
38-
github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
3935
github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
4036
github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
4137
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
4238
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
4339
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
4440
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
45-
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
46-
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
4741
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
4842
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
4943
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -54,14 +48,10 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
5448
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
5549
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
5650
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
57-
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
58-
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
5951
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
6052
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
6153
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
6254
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
63-
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
64-
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
6555
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
6656
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
6757
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -137,8 +127,6 @@ golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT
137127
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
138128
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
139129
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
140-
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
141-
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
142130
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
143131
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
144132
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

0 commit comments

Comments
 (0)