Admission webhooks vol add #13127

arjunbnair97 · 2025-03-30T20:41:57Z

What this PR does / why we need it:

This change helps add extraVolumes and extraVolumeMounts for the AdmissionsWebhooks Job-Patch createSecret and patchwebhook Jobs. Currently if automountServiceAccountToken is set to false in both the jobs, the jobs will fail. That was our initial issue. By merging the current PR, it provides an approach to manually add extraVolumes and extraVolumeMounts so that the jobs run smoothly.

This PR helps resolve Issue: #13031.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
CVE Report (Scanner found CVE and adding report)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation only

Which issue/s this PR fixes

How Has This Been Tested?

We had tested this in our local and dev Kubernetes clusters. We manually downloaded the latest HELM charts and applied these changes and tested.

We had tested this in our local and dev K8s cluster environments.

Currently if automountServiceAccountToken is set to false in both the jobs, the jobs will fail. That was our initial issue. By merging the current PR, it provides an approach to manually add extraVolumes and extraVolumeMounts so that the jobs run smoothly.

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added unit and/or e2e tests to cover my changes.
[ ] All new and existing tests passed.

linux-foundation-easycla · 2025-03-30T20:42:01Z

The committers listed above are authorized under a signed CLA.

✅ login: arjunbnair97 (0942cce, a68eacb, 65918a3, d140560, 36c7e0a, 27547a4, cda5f8e, 1f8d357, 98b9f5d, ff273eb, f8e321e, 90c3e6d, 2ca8e08, 2c28c57, 573e885, eb23e90, 32b51b1, ff79a01)

k8s-ci-robot · 2025-03-30T20:42:04Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: arjunbnair97
Once this PR has been reviewed and has the lgtm label, please assign strongjz for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-03-30T20:42:06Z

Welcome @arjunbnair97!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-03-30T20:42:07Z

Hi @arjunbnair97. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

netlify · 2025-03-30T20:42:16Z

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Name	Link
🔨 Latest commit	`573e885`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-ingress-nginx/deploys/67ebd3e4f9c50f000835a080

Gacko

/triage accepted
/kind feature
/priority backlog
/hold

Please see my comments, re-generate the README.md by running helm-docs and implement unit tests in the tests/ directory. Also please make yourself familiar with how to setup volumes and volume mounts in Kubernetes first.

Thank you!

Gacko · 2025-03-31T10:01:15Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -65,6 +65,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.createSecretJob.extraVolumeMounts }}
+          extraVolumeMount: {{- toYaml .Values.controller.admissionWebhooks.createSecretJob.extraVolumeMounts | nindent 12 }}


There's no such thing as extraVolumeMount in Pods.

Gacko · 2025-03-31T10:01:26Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -77,4 +80,8 @@ spec:
    {{- if .Values.controller.admissionWebhooks.patch.securityContext }}
      securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }}
    {{- end }}
+    {{- if .Values.controller.admissionWebhooks.createSecretJob.extraVolumes }}
+      extraVolumes: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.extraVolumes | nindent 8 }}


And neither is extraVolumes.

Gacko · 2025-03-31T10:01:38Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

+    {{- if .Values.controller.admissionWebhooks.createSecretJob.extraVolumes }}
+      extraVolumes: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.extraVolumes | nindent 8 }}
+    {{- end }}
+


Please remove this newline.

Gacko · 2025-03-31T10:01:45Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -67,6 +67,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.extraVolumeMounts }}
+          extraVolumeMount: {{- toYaml .Values.controller.admissionWebhooks.patchWebhookJob.extraVolumeMounts | nindent 12 }}


Same here as above.

Gacko · 2025-03-31T10:01:50Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -79,4 +82,7 @@ spec:
    {{- if .Values.controller.admissionWebhooks.patch.securityContext }}
      securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }}
    {{- end }}
+    {{- if .Values.controller.admissionWebhooks.patchWebhookJob.extraVolumes }}
+      extraVolumes: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.extraVolumes | nindent 8 }}


Same here as above.

Gacko · 2025-03-31T10:02:46Z

charts/ingress-nginx/values.yaml

+      extraVolumeMounts: []
+      ## Additional volumeMounts to the AdmissionsWebhook createSecretJob.
+      #  - name: kube-api-access
+      #    mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      #    readOnly: true
+      extraVolumes: []
+      ## Additional volume to the AdmissionsWebhook createSecretJob.
+      #  - name: kube-api-access
+      #    emptyDir: {}


Please put the comment before the actual property and use # -- notation for documentation.

Gacko · 2025-03-31T10:02:56Z

charts/ingress-nginx/values.yaml

+      extraVolumeMounts: []
+      ## Additional volumeMounts to the AdmissionsWebhook patchWebhookJob.
+      #  - name: kube-api-access
+      #    mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      #    readOnly: true
+      extraVolumes: []
+      ## Additional volume to the AdmissionsWebhook patchWebhookJob.
+      #  - name: kube-api-access
+      #    emptyDir: {}


Please put the comment before the actual property and use # -- notation for documentation.

Gacko · 2025-04-01T10:09:08Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -65,6 +65,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.createSecretJob.volumeMounts }}


Please keep using extraVolumeMounts here.

Gacko · 2025-04-01T10:09:55Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -65,6 +65,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.createSecretJob.volumeMounts }}
+          volumeMount: {{- toYaml .Values.controller.admissionWebhooks.createSecretJob.volumeMounts | nindent 12 }}


The property is called volumeMounts. Please read the following documentation for reference: https://kubernetes.io/docs/concepts/storage/volumes

Gacko · 2025-04-01T10:10:27Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -67,6 +67,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.volumeMounts }}


Please keep using extraVolumeMounts here.

Gacko · 2025-04-01T10:10:37Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -67,6 +67,9 @@ spec:
          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
          resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.admissionWebhooks.patchWebhookJob.volumeMounts }}
+          volumeMount: {{- toYaml .Values.controller.admissionWebhooks.patchWebhookJob.volumeMounts | nindent 12 }}


The property is called volumeMounts. Please read the following documentation for reference: https://kubernetes.io/docs/concepts/storage/volumes

Gacko · 2025-04-01T10:11:03Z

charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -77,4 +80,7 @@ spec:
    {{- if .Values.controller.admissionWebhooks.patch.securityContext }}
      securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }}
    {{- end }}
+    {{- if .Values.controller.admissionWebhooks.createSecretJob.volumes }}


Please keep using extraVolumes here.

charts/ingress-nginx/values.yaml

Gacko · 2025-04-01T10:14:34Z

charts/ingress-nginx/values.yaml

+      #      mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      #      readOnly: true
+      volumeMounts: []
+      # -- volume to the AdmissionsWebhook createSecretJob.


Suggested change

# -- volume to the AdmissionsWebhook createSecretJob.

# -- Extra volumes for secret creation pods

charts/ingress-nginx/values.yaml

Gacko · 2025-04-01T10:15:08Z

charts/ingress-nginx/values.yaml

+      # -- volumeMounts to the AdmissionsWebhook patchWebhookJob.
+      #    Example:
+      #    - name: kube-api-access
+      #      mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      #      readOnly: true
+      volumeMounts: []
+      # -- volume to the AdmissionsWebhook patchWebhookJob.
+      #  - name: kube-api-access
+      #    emptyDir: {}
+      volumes: []


Adapt from above suggestions.

arjunbnair97 · 2025-04-02T06:14:29Z

@Gacko Could you please review?

Gacko · 2025-04-02T11:43:22Z

Your changes are currently breaking tests. Please see the details of the failed checks for why.

arjunbnair97 added 4 commits March 31, 2025 01:54

Update job-createSecret.yaml

36c7e0a

Update job-createSecret.yaml

a68eacb

Update job-patchWebhook.yaml

cda5f8e

Update values.yaml

ff273eb

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Mar 30, 2025

k8s-ci-robot requested review from Gacko and tao12345666333 March 30, 2025 20:42

k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. area/helm Issues or PRs related to helm charts labels Mar 30, 2025

k8s-ci-robot added needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 30, 2025

k8s-ci-robot added needs-priority size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 30, 2025

arjunbnair97 mentioned this pull request Mar 30, 2025

Update the template to support extraVolumes & extraVolumeMounts field for AdmissionWebhooks Job Manifest #13031

Open

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 30, 2025

arjunbnair97 added 6 commits March 31, 2025 04:07

Update values.yaml

0942cce

Update values.yaml

f8e321e

Update README.md

1f8d357

Update README.md

65918a3

Update README.md

ff79a01

Update README.md

2ca8e08

Gacko requested changes Mar 31, 2025

View reviewed changes

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. triage/accepted Indicates an issue or PR is ready to be actively worked on. labels Mar 31, 2025

arjunbnair97 added 4 commits April 1, 2025 14:43

Update values.yaml

27547a4

Update job-patchWebhook.yaml

d140560

Update job-patchWebhook.yaml

32b51b1

Update job-createSecret.yaml

98b9f5d

Gacko requested changes Apr 1, 2025

View reviewed changes

arjunbnair97 and others added 2 commits April 1, 2025 10:27

Updated charts/ingress-nginx/README.md

90c3e6d

Update values.yaml

2c28c57

arjunbnair97 requested a review from Gacko April 1, 2025 11:10

arjunbnair97 and others added 2 commits April 1, 2025 17:22

Updated charts/ingress-nginx/README.md

eb23e90

Updated charts/ingress-nginx/README.md

573e885

Gacko closed this Apr 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Admission webhooks vol add #13127

Admission webhooks vol add #13127

arjunbnair97 commented Mar 30, 2025

linux-foundation-easycla bot commented Mar 30, 2025 •

edited

Loading

k8s-ci-robot commented Mar 30, 2025

k8s-ci-robot commented Mar 30, 2025

k8s-ci-robot commented Mar 30, 2025

netlify bot commented Mar 30, 2025 •

edited

Loading

Gacko left a comment

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Mar 31, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

Gacko Apr 1, 2025

arjunbnair97 commented Apr 2, 2025

Gacko commented Apr 2, 2025

	# -- volume to the AdmissionsWebhook createSecretJob.
	# -- Extra volumes for secret creation pods

Admission webhooks vol add #13127

Admission webhooks vol add #13127

Conversation

arjunbnair97 commented Mar 30, 2025

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

linux-foundation-easycla bot commented Mar 30, 2025 • edited Loading

k8s-ci-robot commented Mar 30, 2025

k8s-ci-robot commented Mar 30, 2025

k8s-ci-robot commented Mar 30, 2025

netlify bot commented Mar 30, 2025 • edited Loading

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Gacko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

arjunbnair97 commented Apr 2, 2025

Gacko commented Apr 2, 2025

linux-foundation-easycla bot commented Mar 30, 2025 •

edited

Loading

netlify bot commented Mar 30, 2025 •

edited

Loading