Skip to content

Commit 4788d0f

Browse files
duhminickmovence
duhminick
authored and
movence
committed
Add ability to configure operator webhooks (#238)
* Add ability to configure operator webhooks * Reduce if statements on namespaceSelector * Do not specify default value for webhook create * Fix comment * Use helper function for namespaceSelector(s) * Fix null namespaceSelector override * Add admission webhooks integration tests * Operator webhook with cert manager uses helper * Address comment for variable name
1 parent 41300cb commit 4788d0f

15 files changed

Lines changed: 498 additions & 117 deletions

File tree

‎.github/workflows/amazon-cloudwatch-observability-integration-test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,4 +213,4 @@ jobs:
213213
retry_wait_seconds: 5
214214
command: |
215215
cd integration-tests/amazon-cloudwatch-observability/terraform/eks/windows
216-
terraform destroy --auto-approve
216+
terraform destroy --auto-approve

‎charts/amazon-cloudwatch-observability/templates/_helpers.tpl‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,3 +320,56 @@ Define the default service name
320320
{{- define "amazon-cloudwatch-observability.webhookServiceName" -}}
321321
{{- default (printf "%s-webhook-service" (include "amazon-cloudwatch-observability.name" .)) .Values.manager.service.name }}
322322
{{- end -}}
323+
324+
{{/*
325+
Check if a specific admission webhook is enabled
326+
*/}}
327+
{{- define "amazon-cloudwatch-observability.isWebhookEnabled" -}}
328+
{{- $ctx := index . 0 -}}
329+
{{- $webhook := index . 1 -}}
330+
{{- $webhookConfig := index $ctx.Values.admissionWebhooks $webhook -}}
331+
{{- if hasKey $webhookConfig "create" -}}
332+
{{- if $webhookConfig.create }}true{{- end -}}
333+
{{- else -}}
334+
{{- if $ctx.Values.admissionWebhooks.create }}true{{- end -}}
335+
{{- end -}}
336+
{{- end -}}
337+
338+
{{/*
339+
Check if any admission webhook is enabled
340+
*/}}
341+
{{- define "amazon-cloudwatch-observability.webhookEnabled" -}}
342+
{{- $webhooks := list "agents" "instrumentations" "pods" "workloads" "namespaces" -}}
343+
{{- range $webhook := $webhooks -}}
344+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list $ $webhook) -}}
345+
true
346+
{{- break -}}
347+
{{- end -}}
348+
{{- end -}}
349+
{{- end -}}
350+
351+
{{/*
352+
Get namespaceSelector value for admission webhooks
353+
*/}}
354+
{{- define "amazon-cloudwatch-observability.namespaceSelector" -}}
355+
{{- $ctx := index . 0 -}}
356+
{{- $webhook := index . 1 -}}
357+
{{- $webhookConfig := index $ctx.Values.admissionWebhooks $webhook -}}
358+
{{- if and (hasKey $webhookConfig "namespaceSelector") (ne $webhookConfig.namespaceSelector nil) -}}
359+
{{- $selector := $webhookConfig.namespaceSelector -}}
360+
{{- if $selector -}}
361+
{{- toYaml $selector | nindent 4 -}}
362+
{{- else -}}
363+
{}
364+
{{- end -}}
365+
{{- else -}}
366+
{{- $selector := $ctx.Values.admissionWebhooks.namespaceSelector -}}
367+
{{- if $selector -}}
368+
{{- toYaml $selector | nindent 4 -}}
369+
{{- else -}}
370+
{}
371+
{{- end -}}
372+
{{- end -}}
373+
{{- end -}}
374+
375+

‎charts/amazon-cloudwatch-observability/templates/admission-webhooks/operator-webhook-with-cert-manager.yaml‎

Lines changed: 62 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and (.Values.admissionWebhooks.create) (.Values.admissionWebhooks.certManager.enabled) }}
1+
{{- if and (.Values.admissionWebhooks.certManager.enabled) (include "amazon-cloudwatch-observability.webhookEnabled" .) }}
22
apiVersion: admissionregistration.k8s.io/v1
33
kind: MutatingWebhookConfiguration
44
metadata:
@@ -8,23 +8,21 @@ metadata:
88
{{- include "amazon-cloudwatch-observability.labels" . | nindent 4}}
99
name: {{ template "amazon-cloudwatch-observability.name" . }}-mutating-webhook-configuration
1010
webhooks:
11+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
1112
- admissionReviewVersions:
1213
- v1
1314
clientConfig:
1415
service:
1516
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
1617
namespace: {{ .Release.Namespace }}
1718
path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
18-
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
19+
failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
1920
name: minstrumentation.kb.io
20-
{{- if .Values.admissionWebhooks.namespaceSelector }}
21-
namespaceSelector:
22-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
23-
{{- end }}
24-
{{- if .Values.admissionWebhooks.objectSelector }}
21+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
22+
{{- if .Values.admissionWebhooks.objectSelector }}
2523
objectSelector:
26-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
27-
{{- end }}
24+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
25+
{{- end }}
2826
rules:
2927
- apiGroups:
3028
- cloudwatch.aws.amazon.com
@@ -37,23 +35,22 @@ webhooks:
3735
- instrumentations
3836
sideEffects: None
3937
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
38+
{{- end }}
39+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
4040
- admissionReviewVersions:
4141
- v1
4242
clientConfig:
4343
service:
4444
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
4545
namespace: {{ .Release.Namespace }}
4646
path: /mutate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
47-
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
47+
failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
4848
name: mamazoncloudwatchagent.kb.io
49-
{{- if .Values.admissionWebhooks.namespaceSelector }}
50-
namespaceSelector:
51-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
52-
{{- end }}
53-
{{- if .Values.admissionWebhooks.objectSelector }}
49+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
50+
{{- if .Values.admissionWebhooks.objectSelector }}
5451
objectSelector:
55-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
56-
{{- end }}
52+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
53+
{{- end }}
5754
rules:
5855
- apiGroups:
5956
- cloudwatch.aws.amazon.com
@@ -66,23 +63,22 @@ webhooks:
6663
- amazoncloudwatchagents
6764
sideEffects: None
6865
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
66+
{{- end }}
67+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "pods") }}
6968
- admissionReviewVersions:
7069
- v1
7170
clientConfig:
7271
service:
7372
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
7473
namespace: {{ .Release.Namespace }}
7574
path: /mutate-v1-pod
76-
failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
75+
failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
7776
name: mpod.kb.io
78-
{{- if .Values.admissionWebhooks.namespaceSelector }}
79-
namespaceSelector:
80-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
81-
{{- end }}
82-
{{- if .Values.admissionWebhooks.objectSelector }}
77+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "pods") }}
78+
{{- if .Values.admissionWebhooks.objectSelector }}
8379
objectSelector:
84-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
85-
{{- end }}
80+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
81+
{{- end }}
8682
rules:
8783
- apiGroups:
8884
- ""
@@ -95,23 +91,22 @@ webhooks:
9591
- pods
9692
sideEffects: None
9793
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
94+
{{- end }}
95+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "namespaces") }}
9896
- admissionReviewVersions:
9997
- v1
10098
clientConfig:
10199
service:
102100
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
103101
namespace: {{ .Release.Namespace }}
104102
path: /mutate-v1-namespace
105-
failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
103+
failurePolicy: {{ .Values.admissionWebhooks.namespaces.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
106104
name: mnamespace.kb.io
107-
{{- if .Values.admissionWebhooks.namespaceSelector }}
108-
namespaceSelector:
109-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
110-
{{- end }}
111-
{{- if .Values.admissionWebhooks.objectSelector }}
105+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "namespaces") }}
106+
{{- if .Values.admissionWebhooks.objectSelector }}
112107
objectSelector:
113-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
114-
{{- end }}
108+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
109+
{{- end }}
115110
rules:
116111
- apiGroups:
117112
- ""
@@ -124,23 +119,22 @@ webhooks:
124119
- namespaces
125120
sideEffects: None
126121
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
122+
{{- end }}
123+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "workloads") }}
127124
- admissionReviewVersions:
128125
- v1
129126
clientConfig:
130127
service:
131128
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
132129
namespace: {{ .Release.Namespace }}
133130
path: /mutate-v1-workload
134-
failurePolicy: {{ .Values.admissionWebhooks.pods.failurePolicy }}
131+
failurePolicy: {{ .Values.admissionWebhooks.workloads.failurePolicy | default .Values.admissionWebhooks.pods.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
135132
name: mworkload.kb.io
136-
{{- if .Values.admissionWebhooks.namespaceSelector }}
137-
namespaceSelector:
138-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
139-
{{- end }}
140-
{{- if .Values.admissionWebhooks.objectSelector }}
133+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "workloads") }}
134+
{{- if .Values.admissionWebhooks.objectSelector }}
141135
objectSelector:
142-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
143-
{{- end }}
136+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
137+
{{- end }}
144138
rules:
145139
- apiGroups:
146140
- apps
@@ -155,6 +149,7 @@ webhooks:
155149
- statefulsets
156150
sideEffects: None
157151
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
152+
{{- end }}
158153
---
159154
apiVersion: admissionregistration.k8s.io/v1
160155
kind: ValidatingWebhookConfiguration
@@ -165,23 +160,21 @@ metadata:
165160
{{- include "amazon-cloudwatch-observability.labels" . | nindent 4}}
166161
name: {{ template "amazon-cloudwatch-observability.name" . }}-validating-webhook-configuration
167162
webhooks:
163+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
168164
- admissionReviewVersions:
169165
- v1
170166
clientConfig:
171167
service:
172168
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
173169
namespace: {{ .Release.Namespace }}
174170
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
175-
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
171+
failurePolicy: {{ .Values.admissionWebhooks.instrumentations.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
176172
name: vinstrumentationcreateupdate.kb.io
177-
{{- if .Values.admissionWebhooks.namespaceSelector }}
178-
namespaceSelector:
179-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
180-
{{- end }}
181-
{{- if .Values.admissionWebhooks.objectSelector }}
173+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
174+
{{- if .Values.admissionWebhooks.objectSelector }}
182175
objectSelector:
183-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
184-
{{- end }}
176+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
177+
{{- end }}
185178
rules:
186179
- apiGroups:
187180
- cloudwatch.aws.amazon.com
@@ -194,6 +187,8 @@ webhooks:
194187
- instrumentations
195188
sideEffects: None
196189
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
190+
{{- end }}
191+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "instrumentations") }}
197192
- admissionReviewVersions:
198193
- v1
199194
clientConfig:
@@ -203,14 +198,11 @@ webhooks:
203198
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-instrumentation
204199
failurePolicy: Ignore
205200
name: vinstrumentationdelete.kb.io
206-
{{- if .Values.admissionWebhooks.namespaceSelector }}
207-
namespaceSelector:
208-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
209-
{{- end }}
210-
{{- if .Values.admissionWebhooks.objectSelector }}
201+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "instrumentations") }}
202+
{{- if .Values.admissionWebhooks.objectSelector }}
211203
objectSelector:
212-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
213-
{{- end }}
204+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
205+
{{- end }}
214206
rules:
215207
- apiGroups:
216208
- cloudwatch.aws.amazon.com
@@ -222,23 +214,22 @@ webhooks:
222214
- instrumentations
223215
sideEffects: None
224216
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
217+
{{- end }}
218+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
225219
- admissionReviewVersions:
226220
- v1
227221
clientConfig:
228222
service:
229223
name: {{ template "amazon-cloudwatch-observability.webhookServiceName" . }}
230224
namespace: {{ .Release.Namespace }}
231225
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
232-
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
226+
failurePolicy: {{ .Values.admissionWebhooks.agents.failurePolicy | default .Values.admissionWebhooks.failurePolicy }}
233227
name: vamazoncloudwatchagentcreateupdate.kb.io
234-
{{- if .Values.admissionWebhooks.namespaceSelector }}
235-
namespaceSelector:
236-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
237-
{{- end }}
238-
{{- if .Values.admissionWebhooks.objectSelector }}
228+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
229+
{{- if .Values.admissionWebhooks.objectSelector }}
239230
objectSelector:
240-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
241-
{{- end }}
231+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
232+
{{- end }}
242233
rules:
243234
- apiGroups:
244235
- cloudwatch.aws.amazon.com
@@ -251,6 +242,8 @@ webhooks:
251242
- amazoncloudwatchagents
252243
sideEffects: None
253244
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
245+
{{- end }}
246+
{{- if include "amazon-cloudwatch-observability.isWebhookEnabled" (list . "agents") }}
254247
- admissionReviewVersions:
255248
- v1
256249
clientConfig:
@@ -260,14 +253,11 @@ webhooks:
260253
path: /validate-cloudwatch-aws-amazon-com-v1alpha1-amazoncloudwatchagent
261254
failurePolicy: Ignore
262255
name: vamazoncloudwatchagentdelete.kb.io
263-
{{- if .Values.admissionWebhooks.namespaceSelector }}
264-
namespaceSelector:
265-
{{- toYaml .Values.admissionWebhooks.namespaceSelector | nindent 6 }}
266-
{{- end }}
267-
{{- if .Values.admissionWebhooks.objectSelector }}
256+
namespaceSelector: {{ include "amazon-cloudwatch-observability.namespaceSelector" (list . "agents") }}
257+
{{- if .Values.admissionWebhooks.objectSelector }}
268258
objectSelector:
269-
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
270-
{{- end }}
259+
{{- toYaml .Values.admissionWebhooks.objectSelector | nindent 6 }}
260+
{{- end }}
271261
rules:
272262
- apiGroups:
273263
- cloudwatch.aws.amazon.com
@@ -280,3 +270,4 @@ webhooks:
280270
sideEffects: None
281271
timeoutSeconds: {{ .Values.admissionWebhooks.timeoutSeconds }}
282272
{{- end }}
273+
{{- end }}

0 commit comments

Comments
 (0)