Skip to content

Commit f4aa50b

Browse files
kimwnasptdkimwnasptd
authored
fix: use replacements for poddefaults Certificate (#160)
* fix: use replacements for poddefaults Certificate Signed-off-by: Kimonas Sotirchos <[email protected]> * fix: remove false substitution in CI scripts Signed-off-by: Kimonas Sotirchos <[email protected]> * review: add name prefix to Issuer Signed-off-by: Kimonas Sotirchos <[email protected]> * review: modify deploy_component.sh Signed-off-by: Kimonas Sotirchos <[email protected]> * fixup: update Issuer for updated Certificate Signed-off-by: Kimonas Sotirchos <[email protected]> --------- Signed-off-by: Kimonas Sotirchos <[email protected]>
1 parent d8e5000 commit f4aa50b

File tree

8 files changed

+83
-66
lines changed

8 files changed

+83
-66
lines changed

‎components/poddefaults-webhooks/manifests/base/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,5 @@ spec:
3030
volumes:
3131
- name: webhook-cert
3232
secret:
33-
secretName: webhook-certs
33+
secretName: poddefaults-webhook-certs
3434
serviceAccountName: service-account

‎components/poddefaults-webhooks/manifests/base/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ images:
1313
newName: ghcr.io/kubeflow/dashboard/poddefaults-webhook
1414
newTag: latest
1515
namespace: kubeflow
16+
namePrefix: poddefaults-webhook-
1617
generatorOptions:
1718
disableNameSuffixHash: true
1819
configurations:

‎components/poddefaults-webhooks/manifests/base/params.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,3 @@
1-
varReference:
2-
- path: webhooks/clientConfig/service/namespace
3-
kind: MutatingWebhookConfiguration
4-
- path: webhooks/clientConfig/service/name
5-
kind: MutatingWebhookConfiguration
6-
- path: webhooks/name
7-
kind: MutatingWebhookConfiguration
81
nameReference:
92
- kind: Service
103
version: v1

‎components/poddefaults-webhooks/manifests/overlays/cert-manager/certificate.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
apiVersion: cert-manager.io/v1
22
kind: Certificate
33
metadata:
4-
name: cert
4+
name: poddefaults-webhook-cert
55
spec:
66
isCA: true
7-
commonName: $(podDefaultsServiceName).$(podDefaultsNamespace).svc
7+
commonName: REPLACEMENT-SVC-NAME.SVC-NAMESPACE.svc
88
dnsNames:
9-
- $(podDefaultsServiceName).$(podDefaultsNamespace).svc
10-
- $(podDefaultsServiceName).$(podDefaultsNamespace).svc.cluster.local
9+
- REPLACEMENT-SVC-NAME.REPLACEMENT-SVC-NAMESPACE.svc
10+
- REPLACEMENT-SVC-NAME.SVC-NAMESPACE.svc.cluster.local
1111
issuerRef:
1212
kind: Issuer
13-
name: selfsigned-issuer
14-
secretName: webhook-certs
13+
name: poddefaults-webhook-selfsigned-issuer
14+
secretName: poddefaults-webhook-certs
1515

1616
---
1717

1818
apiVersion: cert-manager.io/v1
1919
kind: Issuer
2020
metadata:
21-
name: selfsigned-issuer
21+
name: poddefaults-webhook-selfsigned-issuer
2222
spec:
2323
selfSigned: {}

‎components/poddefaults-webhooks/manifests/overlays/cert-manager/kustomization.yaml‎

Lines changed: 65 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ resources:
1212

1313
namespace: kubeflow
1414

15-
namePrefix: poddefaults-webhook-
16-
1715
commonLabels:
1816
app: poddefaults
1917
kustomize.component: poddefaults
@@ -27,21 +25,74 @@ patchesStrategicMerge:
2725
generatorOptions:
2826
disableNameSuffixHash: true
2927

30-
vars:
31-
# These vars are used to substitute in the namespace, service name and
32-
# deployment name into the mutating WebHookConfiguration.
33-
# Since its a CR kustomize isn't aware of those fields and won't
34-
# transform them.
35-
# We need the var names to be relatively unique so that when we
36-
# compose with other applications they won't conflict.
37-
- name: podDefaultsCertName
38-
objref:
28+
replacements:
29+
# Replacements for the Certificate
30+
- source:
31+
fieldPath: metadata.name
32+
kind: Service
33+
name: service
34+
version: v1
35+
targets:
36+
- fieldPaths:
37+
- spec.commonName
38+
- spec.dnsNames.0
39+
- spec.dnsNames.1
40+
options:
41+
delimiter: .
42+
index: 0
43+
select:
44+
group: cert-manager.io
3945
kind: Certificate
46+
version: v1
47+
- source:
48+
fieldPath: metadata.namespace
49+
kind: Service
50+
name: service
51+
version: v1
52+
targets:
53+
- fieldPaths:
54+
- spec.commonName
55+
- spec.dnsNames.0
56+
- spec.dnsNames.1
57+
options:
58+
delimiter: .
59+
index: 1
60+
select:
4061
group: cert-manager.io
62+
kind: Certificate
63+
version: v1
64+
65+
# Replacements for the MutatingWebhookCOnfiguration
66+
- source:
67+
fieldPath: metadata.namespace
68+
group: cert-manager.io
69+
kind: Certificate
70+
version: v1
71+
targets:
72+
- fieldPaths:
73+
- metadata.annotations.[cert-manager.io/inject-ca-from]
74+
options:
75+
delimiter: /
76+
index: 0
77+
select:
78+
group: admissionregistration.k8s.io
79+
kind: MutatingWebhookConfiguration
80+
version: v1
81+
- source:
82+
fieldPath: metadata.name
83+
group: cert-manager.io
84+
kind: Certificate
85+
version: v1
86+
targets:
87+
- fieldPaths:
88+
- metadata.annotations.[cert-manager.io/inject-ca-from]
89+
options:
90+
delimiter: /
91+
index: 1
92+
select:
93+
group: admissionregistration.k8s.io
94+
kind: MutatingWebhookConfiguration
4195
version: v1
42-
name: cert
43-
fieldref:
44-
fieldpath: metadata.name
4596

4697
configurations:
4798
- params.yaml

‎components/poddefaults-webhooks/manifests/overlays/cert-manager/mutating-webhook-configuration.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,4 @@ kind: MutatingWebhookConfiguration
33
metadata:
44
name: mutating-webhook-configuration
55
annotations:
6-
cert-manager.io/inject-ca-from: $(podDefaultsNamespace)/$(podDefaultsCertName)
7-
6+
cert-manager.io/inject-ca-from: REPLACEMENT-NAMESPACE/REPLACEMENT-CERT-NAME

‎components/poddefaults-webhooks/manifests/overlays/cert-manager/params.yaml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,3 @@
1-
varReference:
2-
- path: spec/commonName
3-
kind: Certificate
4-
- path: spec/dnsNames
5-
kind: Certificate
6-
- path: spec/issuerRef/name
7-
kind: Certificate
8-
- path: metadata/annotations
9-
kind: MutatingWebhookConfiguration
101
nameReference:
112
- kind: Issuer
123
group: cert-manager.io

‎testing/shared/deploy_component.sh‎

Lines changed: 8 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
set -euo pipefail
44

55
# Script to build and deploy a Kubeflow dashboard component
6-
# Usage: ./deploy_component.sh COMPONENT_NAME COMPONENT_PATH IMAGE_NAME TAG [MANIFESTS_PATH] [OVERLAY]
6+
# Usage: ./deploy_component.sh COMPONENT_PATH IMAGE_NAME TAG [MANIFESTS_PATH] [OVERLAY]
77

88
COMPONENT_PATH="$1"
99
IMAGE_NAME="$2"
@@ -38,29 +38,11 @@ export PR_IMAGE="${IMAGE_NAME}:${TAG}"
3838
export CURRENT_IMAGE_ESCAPED=$(echo "$CURRENT_IMAGE" | sed 's|\.|\\.|g')
3939
export PR_IMAGE_ESCAPED=$(echo "$PR_IMAGE" | sed 's|\.|\\.|g')
4040

41-
for overlay_path in "${OVERLAY}" "overlays/kserve" "overlays/cert-manager"; do
42-
if [ -d "$overlay_path" ]; then
43-
if [ "$overlay_path" = "overlays/cert-manager" ]; then
44-
kustomize build "$overlay_path" \
45-
| sed "s|${CURRENT_IMAGE_ESCAPED}:[a-zA-Z0-9_.-]*|${PR_IMAGE_ESCAPED}|g" \
46-
| sed 's/$(podDefaultsServiceName)/poddefaults-webhook-service/g' \
47-
| sed 's/$(podDefaultsNamespace)/kubeflow/g' \
48-
| sed "s|\$(CD_NAMESPACE)|${CD_NAMESPACE:-kubeflow}|g" \
49-
| sed "s|\$(CD_CLUSTER_DOMAIN)|${CD_CLUSTER_DOMAIN:-cluster.local}|g" \
50-
| sed "s|CD_NAMESPACE_PLACEHOLDER|${CD_NAMESPACE_PLACEHOLDER:-kubeflow}|g" \
51-
| sed "s|CD_CLUSTER_DOMAIN_PLACEHOLDER|${CD_CLUSTER_DOMAIN_PLACEHOLDER:-cluster.local}|g" \
52-
| kubectl apply -f -
53-
else
54-
kustomize build "$overlay_path" \
55-
| sed "s|${CURRENT_IMAGE_ESCAPED}:[a-zA-Z0-9_.-]*|${PR_IMAGE_ESCAPED}|g" \
56-
| sed "s|\$(CD_NAMESPACE)|${CD_NAMESPACE:-kubeflow}|g" \
57-
| sed "s|\$(CD_CLUSTER_DOMAIN)|${CD_CLUSTER_DOMAIN:-cluster.local}|g" \
58-
| sed "s|CD_NAMESPACE_PLACEHOLDER|${CD_NAMESPACE_PLACEHOLDER:-kubeflow}|g" \
59-
| sed "s|CD_CLUSTER_DOMAIN_PLACEHOLDER|${CD_CLUSTER_DOMAIN_PLACEHOLDER:-cluster.local}|g" \
60-
| kubectl apply -f -
61-
fi
62-
exit 0
63-
fi
64-
done
6541

66-
exit 1
42+
kustomize build "$OVERLAY" \
43+
| sed "s|${CURRENT_IMAGE_ESCAPED}:[a-zA-Z0-9_.-]*|${PR_IMAGE_ESCAPED}|g" \
44+
| sed "s|\$(CD_NAMESPACE)|${CD_NAMESPACE:-kubeflow}|g" \
45+
| sed "s|\$(CD_CLUSTER_DOMAIN)|${CD_CLUSTER_DOMAIN:-cluster.local}|g" \
46+
| sed "s|CD_NAMESPACE_PLACEHOLDER|${CD_NAMESPACE_PLACEHOLDER:-kubeflow}|g" \
47+
| sed "s|CD_CLUSTER_DOMAIN_PLACEHOLDER|${CD_CLUSTER_DOMAIN_PLACEHOLDER:-cluster.local}|g" \
48+
| kubectl apply -f -

0 commit comments

Comments
 (0)