Skip to content

Commit b62d5fe

Browse files
TeddyAndrieuxTeddyAndrieux
committed
chore: Add raw validation webhook
```shell operator-sdk create webhook --group crl-operator --version v1alpha1 --kind ManagedCRL --programmatic-validation ``` Signed-off-by: Teddy Andrieux <teddy.andrieux@scality.com>
1 parent bf1469a commit b62d5fe

20 files changed

+700
-135
lines changed

‎PROJECT‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,7 @@ resources:
2020
kind: ManagedCRL
2121
path: github.com/scality/crl-operator/api/v1alpha1
2222
version: v1alpha1
23+
webhooks:
24+
validation: true
25+
webhookVersion: v1
2326
version: "3"

‎cmd/main.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ import (
4343

4444
crloperatorv1alpha1 "github.com/scality/crl-operator/api/v1alpha1"
4545
"github.com/scality/crl-operator/internal/controller"
46+
webhookv1alpha1 "github.com/scality/crl-operator/internal/webhook/v1alpha1"
4647
// +kubebuilder:scaffold:imports
4748
)
4849

@@ -218,6 +219,13 @@ func main() {
218219
setupLog.Error(err, "unable to create controller", "controller", "ManagedCRL")
219220
os.Exit(1)
220221
}
222+
// nolint:goconst
223+
if os.Getenv("ENABLE_WEBHOOKS") != "false" {
224+
if err := webhookv1alpha1.SetupManagedCRLWebhookWithManager(mgr); err != nil {
225+
setupLog.Error(err, "unable to create webhook", "webhook", "ManagedCRL")
226+
os.Exit(1)
227+
}
228+
}
221229
// +kubebuilder:scaffold:builder
222230

223231
// Create a field index for ClusterIssuer, Issuer and Secret references

‎config/certmanager/certificate-metrics.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a metrics certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: crl-operator
8+
app.kubernetes.io/managed-by: kustomize
9+
name: metrics-certs # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
dnsNames:
13+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
14+
# replacements in the config/default/kustomization.yaml file.
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: metrics-server-cert

‎config/certmanager/certificate-webhook.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: crl-operator
8+
app.kubernetes.io/managed-by: kustomize
9+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
13+
# replacements in the config/default/kustomization.yaml file.
14+
dnsNames:
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: webhook-server-cert

‎config/certmanager/issuer.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# The following manifest contains a self-signed issuer CR.
2+
# More information can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: crl-operator
9+
app.kubernetes.io/managed-by: kustomize
10+
name: selfsigned-issuer
11+
namespace: system
12+
spec:
13+
selfSigned: {}

‎config/certmanager/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resources:
2+
- issuer.yaml
3+
- certificate-webhook.yaml
4+
- certificate-metrics.yaml
5+
6+
configurations:
7+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This configuration is for teaching kustomize how to update name ref substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name

‎config/default/kustomization.yaml‎

Lines changed: 134 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ resources:
2020
- ../manager
2121
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2222
# crd/kustomization.yaml
23-
#- ../webhook
23+
- ../webhook
2424
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
25-
#- ../certmanager
25+
- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
2828
# [METRICS] Expose the controller manager metrics service.
@@ -50,141 +50,141 @@ patches:
5050

5151
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
5252
# crd/kustomization.yaml
53-
#- path: manager_webhook_patch.yaml
54-
# target:
55-
# kind: Deployment
53+
- path: manager_webhook_patch.yaml
54+
target:
55+
kind: Deployment
5656

5757
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
5858
# Uncomment the following replacements to add the cert-manager CA injection annotations
59-
#replacements:
60-
# - source: # Uncomment the following block to enable certificates for metrics
61-
# kind: Service
62-
# version: v1
63-
# name: controller-manager-metrics-service
64-
# fieldPath: metadata.name
65-
# targets:
66-
# - select:
67-
# kind: Certificate
68-
# group: cert-manager.io
69-
# version: v1
70-
# name: metrics-certs
71-
# fieldPaths:
72-
# - spec.dnsNames.0
73-
# - spec.dnsNames.1
74-
# options:
75-
# delimiter: '.'
76-
# index: 0
77-
# create: true
78-
# - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
79-
# kind: ServiceMonitor
80-
# group: monitoring.coreos.com
81-
# version: v1
82-
# name: controller-manager-metrics-monitor
83-
# fieldPaths:
84-
# - spec.endpoints.0.tlsConfig.serverName
85-
# options:
86-
# delimiter: '.'
87-
# index: 0
88-
# create: true
89-
#
90-
# - source:
91-
# kind: Service
92-
# version: v1
93-
# name: controller-manager-metrics-service
94-
# fieldPath: metadata.namespace
95-
# targets:
96-
# - select:
97-
# kind: Certificate
98-
# group: cert-manager.io
99-
# version: v1
100-
# name: metrics-certs
101-
# fieldPaths:
102-
# - spec.dnsNames.0
103-
# - spec.dnsNames.1
104-
# options:
105-
# delimiter: '.'
106-
# index: 1
107-
# create: true
108-
# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
109-
# kind: ServiceMonitor
110-
# group: monitoring.coreos.com
111-
# version: v1
112-
# name: controller-manager-metrics-monitor
113-
# fieldPaths:
114-
# - spec.endpoints.0.tlsConfig.serverName
115-
# options:
116-
# delimiter: '.'
117-
# index: 1
118-
# create: true
119-
#
120-
# - source: # Uncomment the following block if you have any webhook
121-
# kind: Service
122-
# version: v1
123-
# name: webhook-service
124-
# fieldPath: .metadata.name # Name of the service
125-
# targets:
126-
# - select:
127-
# kind: Certificate
128-
# group: cert-manager.io
129-
# version: v1
130-
# name: serving-cert
131-
# fieldPaths:
132-
# - .spec.dnsNames.0
133-
# - .spec.dnsNames.1
134-
# options:
135-
# delimiter: '.'
136-
# index: 0
137-
# create: true
138-
# - source:
139-
# kind: Service
140-
# version: v1
141-
# name: webhook-service
142-
# fieldPath: .metadata.namespace # Namespace of the service
143-
# targets:
144-
# - select:
145-
# kind: Certificate
146-
# group: cert-manager.io
147-
# version: v1
148-
# name: serving-cert
149-
# fieldPaths:
150-
# - .spec.dnsNames.0
151-
# - .spec.dnsNames.1
152-
# options:
153-
# delimiter: '.'
154-
# index: 1
155-
# create: true
156-
#
157-
# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation)
158-
# kind: Certificate
159-
# group: cert-manager.io
160-
# version: v1
161-
# name: serving-cert # This name should match the one in certificate.yaml
162-
# fieldPath: .metadata.namespace # Namespace of the certificate CR
163-
# targets:
164-
# - select:
165-
# kind: ValidatingWebhookConfiguration
166-
# fieldPaths:
167-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
168-
# options:
169-
# delimiter: '/'
170-
# index: 0
171-
# create: true
172-
# - source:
173-
# kind: Certificate
174-
# group: cert-manager.io
175-
# version: v1
176-
# name: serving-cert
177-
# fieldPath: .metadata.name
178-
# targets:
179-
# - select:
180-
# kind: ValidatingWebhookConfiguration
181-
# fieldPaths:
182-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
183-
# options:
184-
# delimiter: '/'
185-
# index: 1
186-
# create: true
187-
#
59+
replacements:
60+
- source: # Uncomment the following block to enable certificates for metrics
61+
kind: Service
62+
version: v1
63+
name: controller-manager-metrics-service
64+
fieldPath: metadata.name
65+
targets:
66+
- select:
67+
kind: Certificate
68+
group: cert-manager.io
69+
version: v1
70+
name: metrics-certs
71+
fieldPaths:
72+
- spec.dnsNames.0
73+
- spec.dnsNames.1
74+
options:
75+
delimiter: '.'
76+
index: 0
77+
create: true
78+
- select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
79+
kind: ServiceMonitor
80+
group: monitoring.coreos.com
81+
version: v1
82+
name: controller-manager-metrics-monitor
83+
fieldPaths:
84+
- spec.endpoints.0.tlsConfig.serverName
85+
options:
86+
delimiter: '.'
87+
index: 0
88+
create: true
89+
90+
- source:
91+
kind: Service
92+
version: v1
93+
name: controller-manager-metrics-service
94+
fieldPath: metadata.namespace
95+
targets:
96+
- select:
97+
kind: Certificate
98+
group: cert-manager.io
99+
version: v1
100+
name: metrics-certs
101+
fieldPaths:
102+
- spec.dnsNames.0
103+
- spec.dnsNames.1
104+
options:
105+
delimiter: '.'
106+
index: 1
107+
create: true
108+
- select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
109+
kind: ServiceMonitor
110+
group: monitoring.coreos.com
111+
version: v1
112+
name: controller-manager-metrics-monitor
113+
fieldPaths:
114+
- spec.endpoints.0.tlsConfig.serverName
115+
options:
116+
delimiter: '.'
117+
index: 1
118+
create: true
119+
120+
- source: # Uncomment the following block if you have any webhook
121+
kind: Service
122+
version: v1
123+
name: webhook-service
124+
fieldPath: .metadata.name # Name of the service
125+
targets:
126+
- select:
127+
kind: Certificate
128+
group: cert-manager.io
129+
version: v1
130+
name: serving-cert
131+
fieldPaths:
132+
- .spec.dnsNames.0
133+
- .spec.dnsNames.1
134+
options:
135+
delimiter: '.'
136+
index: 0
137+
create: true
138+
- source:
139+
kind: Service
140+
version: v1
141+
name: webhook-service
142+
fieldPath: .metadata.namespace # Namespace of the service
143+
targets:
144+
- select:
145+
kind: Certificate
146+
group: cert-manager.io
147+
version: v1
148+
name: serving-cert
149+
fieldPaths:
150+
- .spec.dnsNames.0
151+
- .spec.dnsNames.1
152+
options:
153+
delimiter: '.'
154+
index: 1
155+
create: true
156+
157+
- source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation)
158+
kind: Certificate
159+
group: cert-manager.io
160+
version: v1
161+
name: serving-cert # This name should match the one in certificate.yaml
162+
fieldPath: .metadata.namespace # Namespace of the certificate CR
163+
targets:
164+
- select:
165+
kind: ValidatingWebhookConfiguration
166+
fieldPaths:
167+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
168+
options:
169+
delimiter: '/'
170+
index: 0
171+
create: true
172+
- source:
173+
kind: Certificate
174+
group: cert-manager.io
175+
version: v1
176+
name: serving-cert
177+
fieldPath: .metadata.name
178+
targets:
179+
- select:
180+
kind: ValidatingWebhookConfiguration
181+
fieldPaths:
182+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
183+
options:
184+
delimiter: '/'
185+
index: 1
186+
create: true
187+
188188
# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting )
189189
# kind: Certificate
190190
# group: cert-manager.io

0 commit comments

Comments
 (0)