diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml index bfdb91400..e2e81d381 100644 --- a/.github/workflows/golangci-lint.yaml +++ b/.github/workflows/golangci-lint.yaml @@ -23,10 +23,10 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-go@v5 with: - go-version: '1.24.x' + go-version: '1.27.x' cache-dependency-path: k8s/migration/go.sum - name: golangci-lint uses: golangci/golangci-lint-action@v7 with: - version: v2.1.6 + version: v2.13.2 working-directory: k8s/migration diff --git a/deploy/00crds.yaml b/deploy/00crds.yaml index e631f95f5..18bb4c373 100644 --- a/deploy/00crds.yaml +++ b/deploy/00crds.yaml @@ -11,6 +11,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: arraycreds.vjailbreak.k8s.pf9.io spec: @@ -256,6 +257,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: arraycredsmappings.vjailbreak.k8s.pf9.io spec: @@ -348,6 +350,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: bmconfigs.vjailbreak.k8s.pf9.io spec: @@ -461,6 +464,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: clustermigrations.vjailbreak.k8s.pf9.io spec: @@ -607,6 +611,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: esximigrations.vjailbreak.k8s.pf9.io spec: @@ -730,6 +735,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: esxisshcreds.vjailbreak.k8s.pf9.io spec: @@ -880,6 +886,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationblueprints.vjailbreak.k8s.pf9.io spec: @@ -1230,6 +1237,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationplans.vjailbreak.k8s.pf9.io spec: @@ -1486,6 +1494,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrations.vjailbreak.k8s.pf9.io spec: @@ -1727,6 +1736,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationtemplates.vjailbreak.k8s.pf9.io spec: @@ -1864,6 +1874,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: networkmappings.vjailbreak.k8s.pf9.io spec: @@ -1956,6 +1967,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: openstackcreds.vjailbreak.k8s.pf9.io spec: @@ -2254,6 +2266,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: pcdclusters.vjailbreak.k8s.pf9.io spec: @@ -2346,6 +2359,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: pcdhosts.vjailbreak.k8s.pf9.io spec: @@ -2443,6 +2457,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: proxyvms.vjailbreak.k8s.pf9.io spec: @@ -2571,6 +2586,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: rdmdisks.vjailbreak.k8s.pf9.io spec: @@ -2724,6 +2740,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: rollingmigrationplans.vjailbreak.k8s.pf9.io spec: @@ -3071,6 +3088,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: storagemappings.vjailbreak.k8s.pf9.io spec: @@ -3165,6 +3183,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vjailbreaknodes.vjailbreak.k8s.pf9.io spec: @@ -3332,6 +3351,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwareclusters.vjailbreak.k8s.pf9.io spec: @@ -3398,6 +3418,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwarecreds.vjailbreak.k8s.pf9.io spec: @@ -3520,6 +3541,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwarehosts.vjailbreak.k8s.pf9.io spec: @@ -3611,6 +3633,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwaremachines.vjailbreak.k8s.pf9.io spec: @@ -3833,6 +3856,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: volumeimageprofiles.vjailbreak.k8s.pf9.io spec: @@ -5177,6 +5201,54 @@ spec: app: vpwned-sdk type: ClusterIP --- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: migration + name: migration-webhook-service + namespace: migration-system +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 9443 + selector: + control-plane: controller-manager +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: certificate + app.kubernetes.io/created-by: migration + app.kubernetes.io/instance: serving-cert + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: certificate + app.kubernetes.io/part-of: migration + name: migration-serving-cert + namespace: migration-system +spec: + dnsNames: + - migration-webhook-service.migration-system.svc + - migration-webhook-service.migration-system.svc.cluster.local + issuerRef: + kind: Issuer + name: migration-selfsigned-issuer + secretName: webhook-server-cert +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: migration + name: migration-selfsigned-issuer + namespace: migration-system +spec: + selfSigned: {} +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -5204,6 +5276,41 @@ spec: number: 80 path: /dev-api/sdk/(.*) pathType: ImplementationSpecific +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/created-by: migration + app.kubernetes.io/instance: validating-webhook-configuration + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: validatingwebhookconfiguration + app.kubernetes.io/part-of: migration + name: migration-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: migration-webhook-service + namespace: migration-system + path: /validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds + failurePolicy: Fail + name: vopenstackcreds.kb.io + rules: + - apiGroups: + - vjailbreak.k8s.pf9.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - openstackcreds + sideEffects: None --- apiVersion: v1 diff --git a/deploy/05controller-deployment.yaml b/deploy/05controller-deployment.yaml index 78dbe2b8e..4e996a058 100644 --- a/deploy/05controller-deployment.yaml +++ b/deploy/05controller-deployment.yaml @@ -42,7 +42,7 @@ spec: - configMapRef: name: pf9-env optional: true - image: quay.io/platform9/vjailbreak-controller:main + image: quay.io/platform9/vjailbreak-controller:0.1.13 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -58,6 +58,10 @@ spec: initialDelaySeconds: 15 periodSeconds: 20 name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP readinessProbe: httpGet: path: /readyz @@ -69,6 +73,9 @@ spec: cpu: 200m memory: 256Mi volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true - mountPath: /etc/pf9/k3s name: master-token - mountPath: /home/ubuntu @@ -91,6 +98,10 @@ spec: serviceAccountName: migration-controller-manager terminationGracePeriodSeconds: 30 volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert - hostPath: path: /var/lib/rancher/k3s/server type: Directory diff --git a/deploy/installer.yaml b/deploy/installer.yaml index 03bf1871b..2bf4238d8 100644 --- a/deploy/installer.yaml +++ b/deploy/installer.yaml @@ -11,6 +11,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: arraycreds.vjailbreak.k8s.pf9.io spec: @@ -256,6 +257,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: arraycredsmappings.vjailbreak.k8s.pf9.io spec: @@ -348,6 +350,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: bmconfigs.vjailbreak.k8s.pf9.io spec: @@ -461,6 +464,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: clustermigrations.vjailbreak.k8s.pf9.io spec: @@ -607,6 +611,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: esximigrations.vjailbreak.k8s.pf9.io spec: @@ -730,6 +735,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: esxisshcreds.vjailbreak.k8s.pf9.io spec: @@ -880,6 +886,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationblueprints.vjailbreak.k8s.pf9.io spec: @@ -1230,6 +1237,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationplans.vjailbreak.k8s.pf9.io spec: @@ -1486,6 +1494,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrations.vjailbreak.k8s.pf9.io spec: @@ -1727,6 +1736,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: migrationtemplates.vjailbreak.k8s.pf9.io spec: @@ -1864,6 +1874,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: networkmappings.vjailbreak.k8s.pf9.io spec: @@ -1956,6 +1967,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: openstackcreds.vjailbreak.k8s.pf9.io spec: @@ -2254,6 +2266,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: pcdclusters.vjailbreak.k8s.pf9.io spec: @@ -2346,6 +2359,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: pcdhosts.vjailbreak.k8s.pf9.io spec: @@ -2443,6 +2457,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: proxyvms.vjailbreak.k8s.pf9.io spec: @@ -2571,6 +2586,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: rdmdisks.vjailbreak.k8s.pf9.io spec: @@ -2724,6 +2740,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: rollingmigrationplans.vjailbreak.k8s.pf9.io spec: @@ -3071,6 +3088,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: storagemappings.vjailbreak.k8s.pf9.io spec: @@ -3165,6 +3183,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vjailbreaknodes.vjailbreak.k8s.pf9.io spec: @@ -3332,6 +3351,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwareclusters.vjailbreak.k8s.pf9.io spec: @@ -3398,6 +3418,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwarecreds.vjailbreak.k8s.pf9.io spec: @@ -3520,6 +3541,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwarehosts.vjailbreak.k8s.pf9.io spec: @@ -3611,6 +3633,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: vmwaremachines.vjailbreak.k8s.pf9.io spec: @@ -3833,6 +3856,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert controller-gen.kubebuilder.io/version: v0.17.1 name: volumeimageprofiles.vjailbreak.k8s.pf9.io spec: @@ -5177,6 +5201,22 @@ spec: app: vpwned-sdk type: ClusterIP --- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: migration + name: migration-webhook-service + namespace: migration-system +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 9443 + selector: + control-plane: controller-manager +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -5220,7 +5260,7 @@ spec: - configMapRef: name: pf9-env optional: true - image: quay.io/platform9/vjailbreak-controller:main + image: quay.io/platform9/vjailbreak-controller:0.1.13 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -5236,6 +5276,10 @@ spec: initialDelaySeconds: 15 periodSeconds: 20 name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP readinessProbe: httpGet: path: /readyz @@ -5247,6 +5291,9 @@ spec: cpu: 200m memory: 256Mi volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true - mountPath: /etc/pf9/k3s name: master-token - mountPath: /home/ubuntu @@ -5269,6 +5316,10 @@ spec: serviceAccountName: migration-controller-manager terminationGracePeriodSeconds: 30 volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert - hostPath: path: /var/lib/rancher/k3s/server type: Directory @@ -5325,7 +5376,7 @@ spec: - configMapRef: name: pf9-env optional: true - image: quay.io/platform9/vjailbreak-vpwned:main + image: quay.io/platform9/vjailbreak-vpwned:0.1.13 imagePullPolicy: IfNotPresent name: vpwned ports: @@ -5402,6 +5453,38 @@ spec: type: DirectoryOrCreate name: pf9-logs --- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: certificate + app.kubernetes.io/created-by: migration + app.kubernetes.io/instance: serving-cert + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: certificate + app.kubernetes.io/part-of: migration + name: migration-serving-cert + namespace: migration-system +spec: + dnsNames: + - migration-webhook-service.migration-system.svc + - migration-webhook-service.migration-system.svc.cluster.local + issuerRef: + kind: Issuer + name: migration-selfsigned-issuer + secretName: webhook-server-cert +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: migration + name: migration-selfsigned-issuer + namespace: migration-system +spec: + selfSigned: {} +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -5429,6 +5512,41 @@ spec: number: 80 path: /dev-api/sdk/(.*) pathType: ImplementationSpecific +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: migration-system/migration-serving-cert + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/created-by: migration + app.kubernetes.io/instance: validating-webhook-configuration + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: validatingwebhookconfiguration + app.kubernetes.io/part-of: migration + name: migration-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: migration-webhook-service + namespace: migration-system + path: /validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds + failurePolicy: Fail + name: vopenstackcreds.kb.io + rules: + - apiGroups: + - vjailbreak.k8s.pf9.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - openstackcreds + sideEffects: None --- apiVersion: apps/v1 @@ -5456,7 +5574,7 @@ spec: serviceAccountName: ui-manager-sa containers: - name: vjailbreak-ui-container - image: quay.io/platform9/vjailbreak-ui:main + image: quay.io/platform9/vjailbreak-ui:0.1.13 imagePullPolicy: IfNotPresent ports: - containerPort: 80 @@ -5745,7 +5863,7 @@ spec: serviceAccountName: vjailbreak-ai-sa containers: - name: vjailbreak-ai - image: quay.io/platform9/vjailbreak-ai:main + image: quay.io/platform9/vjailbreak-ai:0.1.13 imagePullPolicy: IfNotPresent ports: - containerPort: 8080 diff --git a/k8s/migration/.golangci.yml b/k8s/migration/.golangci.yml index 49429f1d6..5c866d5a2 100644 --- a/k8s/migration/.golangci.yml +++ b/k8s/migration/.golangci.yml @@ -50,6 +50,23 @@ linters: linters: - revive text: "var-naming: avoid meaningless package names" + # Pre-existing: goconst findings surfaced by golangci-lint v2.13.2 upgrade + - path: internal/controller/(migrationplan|openstackcreds)_controller\.go + linters: + - goconst + - path: pkg/(utils|metrics)/ + linters: + - goconst + # Pre-existing: goroutine with background context is intentional here + - path: internal/controller/openstackcreds_controller\.go + linters: + - gosec + text: "G118" + # Pre-existing: ctrl.Result.Requeue deprecation in favour of RequeueAfter + - path: internal/controller/.*_controller\.go + linters: + - staticcheck + text: "SA1019" paths: - test settings: diff --git a/k8s/migration/Makefile b/k8s/migration/Makefile index c02c771cf..cebe11816 100644 --- a/k8s/migration/Makefile +++ b/k8s/migration/Makefile @@ -189,7 +189,7 @@ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION) KUSTOMIZE_VERSION ?= v5.4.1 CONTROLLER_TOOLS_VERSION ?= v0.17.1 ENVTEST_VERSION ?= release-0.18 -GOLANGCI_LINT_VERSION ?= v2.1.6 +GOLANGCI_LINT_VERSION ?= v2.13.2 .PHONY: kustomize kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. diff --git a/k8s/migration/PROJECT b/k8s/migration/PROJECT index 5f81a6abe..ab03b1570 100644 --- a/k8s/migration/PROJECT +++ b/k8s/migration/PROJECT @@ -26,6 +26,9 @@ resources: kind: OpenstackCreds path: github.com/platform9/vjailbreak/k8s/migration/api/v1alpha1 version: v1alpha1 + webhooks: + validation: true + webhookVersion: v1 - api: crdVersion: v1 namespaced: true diff --git a/k8s/migration/api/v1alpha1/openstackcreds_webhook.go b/k8s/migration/api/v1alpha1/openstackcreds_webhook.go new file mode 100644 index 000000000..c178daa5f --- /dev/null +++ b/k8s/migration/api/v1alpha1/openstackcreds_webhook.go @@ -0,0 +1,75 @@ +/* +Copyright 2024. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + "context" + "fmt" + + "k8s.io/apimachinery/pkg/runtime" + ctrl "sigs.k8s.io/controller-runtime" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" +) + +var openstackcredslog = logf.Log.WithName("openstackcreds-resource") + +// SetupWebhookWithManager registers the webhook for OpenstackCreds in the manager. +func (r *OpenstackCreds) SetupWebhookWithManager(mgr ctrl.Manager) error { + return ctrl.NewWebhookManagedBy(mgr). + For(r). + WithValidator(&OpenstackCredsCustomValidator{}). + Complete() +} + +// TODO(user): EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! + +// +kubebuilder:webhook:path=/validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds,mutating=false,failurePolicy=fail,sideEffects=None,groups=vjailbreak.k8s.pf9.io,resources=openstackcreds,verbs=create;update,versions=v1alpha1,name=vopenstackcreds.kb.io,admissionReviewVersions=v1 + +// OpenstackCredsCustomValidator validates OpenstackCreds. +// +kubebuilder:object:generate=false +type OpenstackCredsCustomValidator struct{} + +// ValidateCreate validates OpenstackCreds on creation. +func (v *OpenstackCredsCustomValidator) ValidateCreate(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + creds, ok := obj.(*OpenstackCreds) + if !ok { + return nil, fmt.Errorf("expected OpenstackCreds but got %T", obj) + } + openstackcredslog.Info("validate create", "name", creds.Name) + return nil, nil +} + +// ValidateUpdate validates OpenstackCreds on update. +func (v *OpenstackCredsCustomValidator) ValidateUpdate(_ context.Context, _, newObj runtime.Object) (admission.Warnings, error) { + creds, ok := newObj.(*OpenstackCreds) + if !ok { + return nil, fmt.Errorf("expected OpenstackCreds but got %T", newObj) + } + openstackcredslog.Info("validate update", "name", creds.Name) + return nil, nil +} + +// ValidateDelete validates OpenstackCreds on deletion. +func (v *OpenstackCredsCustomValidator) ValidateDelete(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + creds, ok := obj.(*OpenstackCreds) + if !ok { + return nil, fmt.Errorf("expected OpenstackCreds but got %T", obj) + } + openstackcredslog.Info("validate delete", "name", creds.Name) + return nil, nil +} diff --git a/k8s/migration/api/v1alpha1/openstackcreds_webhook_test.go b/k8s/migration/api/v1alpha1/openstackcreds_webhook_test.go new file mode 100644 index 000000000..9ea660e00 --- /dev/null +++ b/k8s/migration/api/v1alpha1/openstackcreds_webhook_test.go @@ -0,0 +1,98 @@ +/* +Copyright 2024. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + "context" + "testing" + + . "github.com/onsi/ginkgo/v2" + corev1 "k8s.io/api/core/v1" +) + +var _ = Describe("OpenstackCreds Webhook", func() { + + Context("When creating OpenstackCreds under Validating Webhook", func() { + It("Should deny if a required field is empty", func() { + // Validation logic deferred to #2347 + }) + + It("Should admit if all required fields are provided", func() { + // Validation logic deferred to #2347 + }) + }) + +}) + +// TestOpenstackCredsCustomValidator tests the type-assertion logic in the validator. +func TestOpenstackCredsCustomValidator(t *testing.T) { + v := &OpenstackCredsCustomValidator{} + ctx := context.Background() + validObj := &OpenstackCreds{} + wrongObj := &corev1.Pod{} + + tests := []struct { + name string + op string + wantErr bool + }{ + {"ValidateCreate correct type", "create", false}, + {"ValidateUpdate correct type", "update", false}, + {"ValidateDelete correct type", "delete", false}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + var err error + switch tt.op { + case "create": + _, err = v.ValidateCreate(ctx, validObj) + case "update": + _, err = v.ValidateUpdate(ctx, nil, validObj) + case "delete": + _, err = v.ValidateDelete(ctx, validObj) + } + if (err != nil) != tt.wantErr { + t.Errorf("got err=%v, wantErr=%v", err, tt.wantErr) + } + }) + } + + wrongTests := []struct { + name string + op string + }{ + {"ValidateCreate wrong type", "create"}, + {"ValidateUpdate wrong type", "update"}, + {"ValidateDelete wrong type", "delete"}, + } + for _, tt := range wrongTests { + t.Run(tt.name, func(t *testing.T) { + var err error + switch tt.op { + case "create": + _, err = v.ValidateCreate(ctx, wrongObj) + case "update": + _, err = v.ValidateUpdate(ctx, nil, wrongObj) + case "delete": + _, err = v.ValidateDelete(ctx, wrongObj) + } + if err == nil { + t.Errorf("expected error for wrong type, got nil") + } + }) + } +} diff --git a/k8s/migration/api/v1alpha1/webhook_suite_test.go b/k8s/migration/api/v1alpha1/webhook_suite_test.go new file mode 100644 index 000000000..66891fe8b --- /dev/null +++ b/k8s/migration/api/v1alpha1/webhook_suite_test.go @@ -0,0 +1,145 @@ +/* +Copyright 2024. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + "context" + "crypto/tls" + "fmt" + "net" + "path/filepath" + "runtime" + "testing" + "time" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + + admissionv1 "k8s.io/api/admission/v1" + // +kubebuilder:scaffold:imports + apimachineryruntime "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/rest" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/envtest" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/log/zap" + metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" + "sigs.k8s.io/controller-runtime/pkg/webhook" +) + +// These tests use Ginkgo (BDD-style Go testing framework). Refer to +// http://onsi.github.io/ginkgo/ to learn more about Ginkgo. + +var cfg *rest.Config +var k8sClient client.Client +var testEnv *envtest.Environment +var ctx context.Context +var cancel context.CancelFunc + +func TestAPIs(t *testing.T) { + RegisterFailHandler(Fail) + + RunSpecs(t, "Webhook Suite") +} + +var _ = BeforeSuite(func() { + logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) + + ctx, cancel = context.WithCancel(context.TODO()) + + By("bootstrapping test environment") + testEnv = &envtest.Environment{ + CRDDirectoryPaths: []string{filepath.Join("..", "..", "config", "crd", "bases")}, + ErrorIfCRDPathMissing: false, + + // The BinaryAssetsDirectory is only required if you want to run the tests directly + // without call the makefile target test. If not informed it will look for the + // default path defined in controller-runtime which is /usr/local/kubebuilder/. + // Note that you must have the required binaries setup under the bin directory to perform + // the tests directly. When we run make test it will be setup and used automatically. + BinaryAssetsDirectory: filepath.Join("..", "..", "bin", "k8s", + fmt.Sprintf("1.30.0-%s-%s", runtime.GOOS, runtime.GOARCH)), + + WebhookInstallOptions: envtest.WebhookInstallOptions{ + Paths: []string{filepath.Join("..", "..", "config", "webhook")}, + }, + } + + var err error + // cfg is defined in this file globally. + cfg, err = testEnv.Start() + Expect(err).NotTo(HaveOccurred()) + Expect(cfg).NotTo(BeNil()) + + scheme := apimachineryruntime.NewScheme() + err = AddToScheme(scheme) + Expect(err).NotTo(HaveOccurred()) + + err = admissionv1.AddToScheme(scheme) + Expect(err).NotTo(HaveOccurred()) + + // +kubebuilder:scaffold:scheme + + k8sClient, err = client.New(cfg, client.Options{Scheme: scheme}) + Expect(err).NotTo(HaveOccurred()) + Expect(k8sClient).NotTo(BeNil()) + + // start webhook server using Manager + webhookInstallOptions := &testEnv.WebhookInstallOptions + mgr, err := ctrl.NewManager(cfg, ctrl.Options{ + Scheme: scheme, + WebhookServer: webhook.NewServer(webhook.Options{ + Host: webhookInstallOptions.LocalServingHost, + Port: webhookInstallOptions.LocalServingPort, + CertDir: webhookInstallOptions.LocalServingCertDir, + }), + LeaderElection: false, + Metrics: metricsserver.Options{BindAddress: "0"}, + }) + Expect(err).NotTo(HaveOccurred()) + + err = (&OpenstackCreds{}).SetupWebhookWithManager(mgr) + Expect(err).NotTo(HaveOccurred()) + + // +kubebuilder:scaffold:webhook + + go func() { + defer GinkgoRecover() + err = mgr.Start(ctx) + Expect(err).NotTo(HaveOccurred()) + }() + + // wait for the webhook server to get ready + dialer := &net.Dialer{Timeout: time.Second} + addrPort := fmt.Sprintf("%s:%d", webhookInstallOptions.LocalServingHost, webhookInstallOptions.LocalServingPort) + Eventually(func() error { + conn, err := tls.DialWithDialer(dialer, "tcp", addrPort, &tls.Config{InsecureSkipVerify: true}) + if err != nil { + return err + } + return conn.Close() + }).Should(Succeed()) + +}) + +var _ = AfterSuite(func() { + cancel() + By("tearing down the test environment") + err := testEnv.Stop() + Expect(err).NotTo(HaveOccurred()) +}) diff --git a/k8s/migration/api/v1alpha1/zz_generated.deepcopy.go b/k8s/migration/api/v1alpha1/zz_generated.deepcopy.go index 603ff2195..10f9c175d 100644 --- a/k8s/migration/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8s/migration/api/v1alpha1/zz_generated.deepcopy.go @@ -23,7 +23,7 @@ package v1alpha1 import ( "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - runtime "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime" ) // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. diff --git a/k8s/migration/cmd/main.go b/k8s/migration/cmd/main.go index 80a86a1ad..131671669 100644 --- a/k8s/migration/cmd/main.go +++ b/k8s/migration/cmd/main.go @@ -165,6 +165,12 @@ func main() { setupLog.Error(err, "unable to create controller", "controller", "RDMDisk") os.Exit(1) } + if os.Getenv("ENABLE_WEBHOOKS") != "false" { + if err = (&vjailbreakv1alpha1.OpenstackCreds{}).SetupWebhookWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create webhook", "webhook", "OpenstackCreds") + os.Exit(1) + } + } // +kubebuilder:scaffold:builder if err = mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil { diff --git a/k8s/migration/config/certmanager/certificate.yaml b/k8s/migration/config/certmanager/certificate.yaml new file mode 100644 index 000000000..ece62f0a8 --- /dev/null +++ b/k8s/migration/config/certmanager/certificate.yaml @@ -0,0 +1,35 @@ +# The following manifests contain a self-signed issuer CR and a certificate CR. +# More document can be found at https://docs.cert-manager.io +# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/name: migration + app.kubernetes.io/managed-by: kustomize + name: selfsigned-issuer + namespace: system +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/name: certificate + app.kubernetes.io/instance: serving-cert + app.kubernetes.io/component: certificate + app.kubernetes.io/created-by: migration + app.kubernetes.io/part-of: migration + app.kubernetes.io/managed-by: kustomize + name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + dnsNames: + - SERVICE_NAME.SERVICE_NAMESPACE.svc + - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize diff --git a/k8s/migration/config/certmanager/kustomization.yaml b/k8s/migration/config/certmanager/kustomization.yaml new file mode 100644 index 000000000..bebea5a59 --- /dev/null +++ b/k8s/migration/config/certmanager/kustomization.yaml @@ -0,0 +1,5 @@ +resources: +- certificate.yaml + +configurations: +- kustomizeconfig.yaml diff --git a/k8s/migration/config/certmanager/kustomizeconfig.yaml b/k8s/migration/config/certmanager/kustomizeconfig.yaml new file mode 100644 index 000000000..cf6f89e88 --- /dev/null +++ b/k8s/migration/config/certmanager/kustomizeconfig.yaml @@ -0,0 +1,8 @@ +# This configuration is for teaching kustomize how to update name ref substitution +nameReference: +- kind: Issuer + group: cert-manager.io + fieldSpecs: + - kind: Certificate + group: cert-manager.io + path: spec/issuerRef/name diff --git a/k8s/migration/config/crd/kustomization.yaml b/k8s/migration/config/crd/kustomization.yaml index 0bc405e30..2743f5cdd 100644 --- a/k8s/migration/config/crd/kustomization.yaml +++ b/k8s/migration/config/crd/kustomization.yaml @@ -31,6 +31,7 @@ resources: patches: # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD +#- path: patches/webhook_in_openstackcreds.yaml # +kubebuilder:scaffold:crdkustomizewebhookpatch # [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. diff --git a/k8s/migration/config/crd/patches/cainjection_in_openstackcreds.yaml b/k8s/migration/config/crd/patches/cainjection_in_openstackcreds.yaml new file mode 100644 index 000000000..7090bd089 --- /dev/null +++ b/k8s/migration/config/crd/patches/cainjection_in_openstackcreds.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME + name: openstackcreds.vjailbreak.k8s.pf9.io diff --git a/k8s/migration/config/crd/patches/webhook_in_openstackcreds.yaml b/k8s/migration/config/crd/patches/webhook_in_openstackcreds.yaml new file mode 100644 index 000000000..2582df8a7 --- /dev/null +++ b/k8s/migration/config/crd/patches/webhook_in_openstackcreds.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: openstackcreds.vjailbreak.k8s.pf9.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/k8s/migration/config/default/kustomization.yaml b/k8s/migration/config/default/kustomization.yaml index e72ebc0bd..bac78ecba 100644 --- a/k8s/migration/config/default/kustomization.yaml +++ b/k8s/migration/config/default/kustomization.yaml @@ -21,16 +21,15 @@ resources: - ../addons # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in # crd/kustomization.yaml -#- ../webhook +- ../webhook # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. -#- ../certmanager +- ../certmanager # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. #- ../prometheus # [METRICS] To enable the controller manager metrics service, uncomment the following line. #- metrics_service.yaml -# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager -#patches: +patches: # [METRICS] The following patch will enable the metrics endpoint. Ensure that you also protect this endpoint. # More info: https://book.kubebuilder.io/reference/metrics # If you want to expose the metric endpoint of your controller-manager uncomment the following line. @@ -40,109 +39,109 @@ resources: # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in # crd/kustomization.yaml -#- path: manager_webhook_patch.yaml +- path: manager_webhook_patch.yaml # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. # Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks. # 'CERTMANAGER' needs to be enabled to use ca injection -#- path: webhookcainjection_patch.yaml +- path: webhookcainjection_patch.yaml # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. # Uncomment the following replacements to add the cert-manager CA injection annotations -#replacements: -# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -# fieldPath: .metadata.namespace # namespace of the certificate CR -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - source: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -# fieldPath: .metadata.name -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - source: # Add cert-manager annotation to the webhook Service -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.name # namespace of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 0 -# create: true -# - source: -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.namespace # namespace of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 1 -# create: true +replacements: + - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs + kind: Certificate + group: cert-manager.io + version: v1 + name: serving-cert # this name should match the one in certificate.yaml + fieldPath: .metadata.namespace # namespace of the certificate CR + targets: + - select: + kind: ValidatingWebhookConfiguration + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 0 + create: true + - select: + kind: MutatingWebhookConfiguration + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 0 + create: true + - select: + kind: CustomResourceDefinition + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 0 + create: true + - source: + kind: Certificate + group: cert-manager.io + version: v1 + name: serving-cert # this name should match the one in certificate.yaml + fieldPath: .metadata.name + targets: + - select: + kind: ValidatingWebhookConfiguration + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 1 + create: true + - select: + kind: MutatingWebhookConfiguration + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 1 + create: true + - select: + kind: CustomResourceDefinition + fieldPaths: + - .metadata.annotations.[cert-manager.io/inject-ca-from] + options: + delimiter: '/' + index: 1 + create: true + - source: # Add cert-manager annotation to the webhook Service + kind: Service + version: v1 + name: webhook-service + fieldPath: .metadata.name # namespace of the service + targets: + - select: + kind: Certificate + group: cert-manager.io + version: v1 + fieldPaths: + - .spec.dnsNames.0 + - .spec.dnsNames.1 + options: + delimiter: '.' + index: 0 + create: true + - source: + kind: Service + version: v1 + name: webhook-service + fieldPath: .metadata.namespace # namespace of the service + targets: + - select: + kind: Certificate + group: cert-manager.io + version: v1 + fieldPaths: + - .spec.dnsNames.0 + - .spec.dnsNames.1 + options: + delimiter: '.' + index: 1 + create: true diff --git a/k8s/migration/config/default/manager_webhook_patch.yaml b/k8s/migration/config/default/manager_webhook_patch.yaml new file mode 100644 index 000000000..738de350b --- /dev/null +++ b/k8s/migration/config/default/manager_webhook_patch.yaml @@ -0,0 +1,23 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert diff --git a/k8s/migration/config/default/webhookcainjection_patch.yaml b/k8s/migration/config/default/webhookcainjection_patch.yaml new file mode 100644 index 000000000..dc0a0a583 --- /dev/null +++ b/k8s/migration/config/default/webhookcainjection_patch.yaml @@ -0,0 +1,15 @@ +# This patch adds annotation to admission webhook config and +# CERTIFICATE_NAMESPACE and CERTIFICATE_NAME will be substituted by kustomize +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + labels: + app.kubernetes.io/name: validatingwebhookconfiguration + app.kubernetes.io/instance: validating-webhook-configuration + app.kubernetes.io/component: webhook + app.kubernetes.io/created-by: migration + app.kubernetes.io/part-of: migration + app.kubernetes.io/managed-by: kustomize + name: validating-webhook-configuration + annotations: + cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME diff --git a/k8s/migration/config/webhook/kustomization.yaml b/k8s/migration/config/webhook/kustomization.yaml new file mode 100644 index 000000000..9cf26134e --- /dev/null +++ b/k8s/migration/config/webhook/kustomization.yaml @@ -0,0 +1,6 @@ +resources: +- manifests.yaml +- service.yaml + +configurations: +- kustomizeconfig.yaml diff --git a/k8s/migration/config/webhook/kustomizeconfig.yaml b/k8s/migration/config/webhook/kustomizeconfig.yaml new file mode 100644 index 000000000..206316e54 --- /dev/null +++ b/k8s/migration/config/webhook/kustomizeconfig.yaml @@ -0,0 +1,22 @@ +# the following config is for teaching kustomize where to look at when substituting nameReference. +# It requires kustomize v2.1.0 or newer to work properly. +nameReference: +- kind: Service + version: v1 + fieldSpecs: + - kind: MutatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/name + - kind: ValidatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/name + +namespace: +- kind: MutatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/namespace + create: true +- kind: ValidatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/namespace + create: true diff --git a/k8s/migration/config/webhook/manifests.yaml b/k8s/migration/config/webhook/manifests.yaml new file mode 100644 index 000000000..718e9b8f7 --- /dev/null +++ b/k8s/migration/config/webhook/manifests.yaml @@ -0,0 +1,26 @@ +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds + failurePolicy: Fail + name: vopenstackcreds.kb.io + rules: + - apiGroups: + - vjailbreak.k8s.pf9.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - openstackcreds + sideEffects: None diff --git a/k8s/migration/config/webhook/service.yaml b/k8s/migration/config/webhook/service.yaml new file mode 100644 index 000000000..0cdebc07c --- /dev/null +++ b/k8s/migration/config/webhook/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: migration + app.kubernetes.io/managed-by: kustomize + name: webhook-service + namespace: system +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 9443 + selector: + control-plane: controller-manager diff --git a/k8s/migration/go.mod b/k8s/migration/go.mod index 5c663c262..8e4a53913 100644 --- a/k8s/migration/go.mod +++ b/k8s/migration/go.mod @@ -1,6 +1,6 @@ module github.com/platform9/vjailbreak/k8s/migration -go 1.24.10 +go 1.27.0 replace github.com/platform9/vjailbreak/v2v-helper => ../../v2v-helper diff --git a/pkg/vpwned/Dockerfile b/pkg/vpwned/Dockerfile index 69df66ef1..69f8f5564 100644 --- a/pkg/vpwned/Dockerfile +++ b/pkg/vpwned/Dockerfile @@ -1,5 +1,5 @@ # Build stage -FROM golang:1.24-alpine AS builder +FROM golang:1.27-alpine AS builder # Install make and other build dependencies RUN apk add --no-cache make bash git diff --git a/pkg/vpwned/go.mod b/pkg/vpwned/go.mod index 9e922a08c..876fe5c34 100644 --- a/pkg/vpwned/go.mod +++ b/pkg/vpwned/go.mod @@ -1,6 +1,6 @@ module github.com/platform9/vjailbreak/pkg/vpwned -go 1.24.10 +go 1.27.0 require ( github.com/bougou/go-ipmi v0.7.6 @@ -51,7 +51,6 @@ require ( github.com/go-viper/mapstructure/v2 v2.2.1 // indirect github.com/godbus/dbus/v5 v5.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/mock v1.6.0 // indirect github.com/google/btree v1.1.3 // indirect github.com/google/gnostic-models v0.6.9 // indirect github.com/google/go-cmp v0.7.0 // indirect diff --git a/pkg/vpwned/go.sum b/pkg/vpwned/go.sum index 7894013c5..3b181efd0 100644 --- a/pkg/vpwned/go.sum +++ b/pkg/vpwned/go.sum @@ -54,8 +54,6 @@ github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRx github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8= -github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc= -github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg= @@ -285,7 +283,6 @@ github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6 github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ= @@ -325,7 +322,6 @@ golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU= golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= golang.org/x/net v0.0.0-20180406214816-61147c48b25b/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -336,7 +332,6 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200904194848-62affa334b73/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= @@ -347,7 +342,6 @@ golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKl golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -357,9 +351,7 @@ golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -381,7 +373,6 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/v2v-helper/go.mod b/v2v-helper/go.mod index 94fc97e5a..e98452926 100644 --- a/v2v-helper/go.mod +++ b/v2v-helper/go.mod @@ -1,6 +1,6 @@ module github.com/platform9/vjailbreak/v2v-helper -go 1.24.10 +go 1.27.0 require ( github.com/golang/mock v1.6.0 @@ -24,16 +24,20 @@ require ( ) require ( + github.com/beorn7/perks v1.0.1 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/devans10/pugo/flasharray v0.0.0-20241116160615-6bb8c469c9a0 // indirect github.com/emicklei/go-restful/v3 v3.12.2 // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect + github.com/fsnotify/fsnotify v1.8.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect github.com/go-openapi/swag v0.23.1 // indirect github.com/gogo/protobuf v1.3.2 // indirect + github.com/google/btree v1.1.3 // indirect github.com/google/gnostic-models v0.6.9 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/uuid v1.6.0 // indirect @@ -45,6 +49,11 @@ require ( github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect + github.com/prometheus/client_golang v1.22.0 // indirect + github.com/prometheus/client_model v0.6.1 // indirect + github.com/prometheus/common v0.62.0 // indirect + github.com/prometheus/procfs v0.15.1 // indirect + github.com/spf13/pflag v1.0.6 // indirect github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect golang.org/x/net v0.47.0 // indirect @@ -53,10 +62,12 @@ require ( golang.org/x/term v0.37.0 // indirect golang.org/x/text v0.31.0 // indirect golang.org/x/time v0.12.0 // indirect + gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/protobuf v1.36.10 // indirect gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect + k8s.io/apiextensions-apiserver v0.33.0 // indirect k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a // indirect k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect diff --git a/v2v-helper/go.sum b/v2v-helper/go.sum index ccd14baea..d50bbb4aa 100644 --- a/v2v-helper/go.sum +++ b/v2v-helper/go.sum @@ -1,5 +1,9 @@ +github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= +github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= @@ -8,10 +12,14 @@ github.com/devans10/pugo/flasharray v0.0.0-20241116160615-6bb8c469c9a0 h1:iywqp5 github.com/devans10/pugo/flasharray v0.0.0-20241116160615-6bb8c469c9a0/go.mod h1:7dF4rgfqItyj4bkbwZkwp/Ul+bM4lku/CQvS9OIYF4o= github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU= github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k= +github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ= github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU= github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M= +github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= @@ -30,12 +38,16 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc= github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= +github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg= +github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4= github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw= github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= +github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8= github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -54,10 +66,14 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= +github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= +github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4= github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= @@ -82,6 +98,14 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus-community/pro-bing v0.4.1 h1:aMaJwyifHZO0y+h8+icUz0xbToHbia0wdmzdVZ+Kl3w= github.com/prometheus-community/pro-bing v0.4.1/go.mod h1:aLsw+zqCaDoa2RLVVSX3+UiCkBBXTMtZC3c7EkfWnAE= +github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q= +github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0= +github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E= +github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY= +github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io= +github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I= +github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc= +github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o= @@ -101,6 +125,8 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8= @@ -160,6 +186,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw= +gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=