Skip to content

Commit 0bfda26

Browse files
dgrove-ossdgrove-oss
authored
initial port of webook code + configuration and CI scripts (#1)
1 parent 64c083e commit 0bfda26

27 files changed

+1096
-105
lines changed

‎Makefile

+4
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,10 @@ docker-build: ## Build docker image with the manager.
129129
docker-push: ## Push docker image with the manager.
130130
$(CONTAINER_TOOL) push ${IMG}
131131

132+
.PHONY: kind-push
133+
kind-push: ## Push docker image with the manager into a kind cluster
134+
kind load docker-image ${IMG} --name $(shell kind get clusters)
135+
132136
# PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
133137
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
134138
# - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/

‎PROJECT

+4
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,8 @@ resources:
1717
kind: AppWrapper
1818
path: github.com/project-codeflare/appwrapper/api/v1beta2
1919
version: v1beta2
20+
webhooks:
21+
defaulting: true
22+
validation: true
23+
webhookVersion: v1
2024
version: "3"

‎cmd/main.go

+12
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,18 @@ func main() {
143143
setupLog.Error(err, "unable to create controller", "controller", "AppWrapper")
144144
os.Exit(1)
145145
}
146+
if os.Getenv("ENABLE_WEBHOOKS") != "false" {
147+
// TODO: Proper configuration of ManageJobsWithoutQueueName via config file
148+
wh := &controller.AppWrapperWebhook{ManageJobsWithoutQueueName: true}
149+
if err := ctrl.NewWebhookManagedBy(mgr).
150+
For(&workloadv1beta2.AppWrapper{}).
151+
WithDefaulter(wh).
152+
WithValidator(wh).
153+
Complete(); err != nil {
154+
setupLog.Error(err, "unable to create webhook", "webhook", "AppWrapper")
155+
os.Exit(1)
156+
}
157+
}
146158
//+kubebuilder:scaffold:builder
147159

148160
ctx := context.TODO() // TODO

‎config/certmanager/certificate.yaml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: certificate
9+
app.kubernetes.io/instance: serving-cert
10+
app.kubernetes.io/component: certificate
11+
app.kubernetes.io/created-by: appwrapper
12+
app.kubernetes.io/part-of: appwrapper
13+
app.kubernetes.io/managed-by: kustomize
14+
name: selfsigned-issuer
15+
namespace: system
16+
spec:
17+
selfSigned: {}
18+
---
19+
apiVersion: cert-manager.io/v1
20+
kind: Certificate
21+
metadata:
22+
labels:
23+
app.kubernetes.io/name: certificate
24+
app.kubernetes.io/instance: serving-cert
25+
app.kubernetes.io/component: certificate
26+
app.kubernetes.io/created-by: appwrapper
27+
app.kubernetes.io/part-of: appwrapper
28+
app.kubernetes.io/managed-by: kustomize
29+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
30+
namespace: system
31+
spec:
32+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
33+
dnsNames:
34+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
35+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
36+
issuerRef:
37+
kind: Issuer
38+
name: selfsigned-issuer
39+
secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

‎config/certmanager/kustomization.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resources:
2+
- certificate.yaml
3+
4+
configurations:
5+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This configuration is for teaching kustomize how to update name ref substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name

‎config/crd/kustomization.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,16 @@ resources:
88
patches:
99
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
11-
#- path: patches/webhook_in_appwrappers.yaml
11+
- path: patches/webhook_in_appwrappers.yaml
1212
#+kubebuilder:scaffold:crdkustomizewebhookpatch
1313

1414
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
1515
# patches here are for enabling the CA injection for each CRD
16-
#- path: patches/cainjection_in_appwrappers.yaml
16+
- path: patches/cainjection_in_appwrappers.yaml
1717
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
1818

1919
# [WEBHOOK] To enable webhook, uncomment the following section
2020
# the following config is for teaching kustomize how to do kustomization for CRDs.
2121

22-
#configurations:
23-
#- kustomizeconfig.yaml
22+
configurations:
23+
- kustomizeconfig.yaml

‎config/crd/patches/cainjection_in_appwrappers.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# The following patch adds a directive for certmanager to inject CA into the CRD
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
7+
name: appwrappers.workload.codeflare.dev

‎config/crd/patches/webhook_in_appwrappers.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# The following patch enables a conversion webhook for the CRD
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
name: appwrappers.workload.codeflare.dev
6+
spec:
7+
conversion:
8+
strategy: Webhook
9+
webhook:
10+
clientConfig:
11+
service:
12+
namespace: system
13+
name: webhook-service
14+
path: /convert
15+
conversionReviewVersions:
16+
- v1

‎config/default/kustomization.yaml

+101-101
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ resources:
2020
- ../manager
2121
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2222
# crd/kustomization.yaml
23-
#- ../webhook
23+
- ../webhook
2424
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
25-
#- ../certmanager
25+
- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
2828

@@ -34,109 +34,109 @@ patches:
3434

3535
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
3636
# crd/kustomization.yaml
37-
#- path: manager_webhook_patch.yaml
37+
- path: manager_webhook_patch.yaml
3838

3939
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
4040
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
4141
# 'CERTMANAGER' needs to be enabled to use ca injection
42-
#- path: webhookcainjection_patch.yaml
42+
- path: webhookcainjection_patch.yaml
4343

4444
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
4545
# Uncomment the following replacements to add the cert-manager CA injection annotations
46-
#replacements:
47-
# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
48-
# kind: Certificate
49-
# group: cert-manager.io
50-
# version: v1
51-
# name: serving-cert # this name should match the one in certificate.yaml
52-
# fieldPath: .metadata.namespace # namespace of the certificate CR
53-
# targets:
54-
# - select:
55-
# kind: ValidatingWebhookConfiguration
56-
# fieldPaths:
57-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
58-
# options:
59-
# delimiter: '/'
60-
# index: 0
61-
# create: true
62-
# - select:
63-
# kind: MutatingWebhookConfiguration
64-
# fieldPaths:
65-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
66-
# options:
67-
# delimiter: '/'
68-
# index: 0
69-
# create: true
70-
# - select:
71-
# kind: CustomResourceDefinition
72-
# fieldPaths:
73-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
74-
# options:
75-
# delimiter: '/'
76-
# index: 0
77-
# create: true
78-
# - source:
79-
# kind: Certificate
80-
# group: cert-manager.io
81-
# version: v1
82-
# name: serving-cert # this name should match the one in certificate.yaml
83-
# fieldPath: .metadata.name
84-
# targets:
85-
# - select:
86-
# kind: ValidatingWebhookConfiguration
87-
# fieldPaths:
88-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
89-
# options:
90-
# delimiter: '/'
91-
# index: 1
92-
# create: true
93-
# - select:
94-
# kind: MutatingWebhookConfiguration
95-
# fieldPaths:
96-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
97-
# options:
98-
# delimiter: '/'
99-
# index: 1
100-
# create: true
101-
# - select:
102-
# kind: CustomResourceDefinition
103-
# fieldPaths:
104-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
105-
# options:
106-
# delimiter: '/'
107-
# index: 1
108-
# create: true
109-
# - source: # Add cert-manager annotation to the webhook Service
110-
# kind: Service
111-
# version: v1
112-
# name: webhook-service
113-
# fieldPath: .metadata.name # namespace of the service
114-
# targets:
115-
# - select:
116-
# kind: Certificate
117-
# group: cert-manager.io
118-
# version: v1
119-
# fieldPaths:
120-
# - .spec.dnsNames.0
121-
# - .spec.dnsNames.1
122-
# options:
123-
# delimiter: '.'
124-
# index: 0
125-
# create: true
126-
# - source:
127-
# kind: Service
128-
# version: v1
129-
# name: webhook-service
130-
# fieldPath: .metadata.namespace # namespace of the service
131-
# targets:
132-
# - select:
133-
# kind: Certificate
134-
# group: cert-manager.io
135-
# version: v1
136-
# fieldPaths:
137-
# - .spec.dnsNames.0
138-
# - .spec.dnsNames.1
139-
# options:
140-
# delimiter: '.'
141-
# index: 1
142-
# create: true
46+
replacements:
47+
- source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
48+
kind: Certificate
49+
group: cert-manager.io
50+
version: v1
51+
name: serving-cert # this name should match the one in certificate.yaml
52+
fieldPath: .metadata.namespace # namespace of the certificate CR
53+
targets:
54+
- select:
55+
kind: ValidatingWebhookConfiguration
56+
fieldPaths:
57+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
58+
options:
59+
delimiter: '/'
60+
index: 0
61+
create: true
62+
- select:
63+
kind: MutatingWebhookConfiguration
64+
fieldPaths:
65+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
66+
options:
67+
delimiter: '/'
68+
index: 0
69+
create: true
70+
- select:
71+
kind: CustomResourceDefinition
72+
fieldPaths:
73+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
74+
options:
75+
delimiter: '/'
76+
index: 0
77+
create: true
78+
- source:
79+
kind: Certificate
80+
group: cert-manager.io
81+
version: v1
82+
name: serving-cert # this name should match the one in certificate.yaml
83+
fieldPath: .metadata.name
84+
targets:
85+
- select:
86+
kind: ValidatingWebhookConfiguration
87+
fieldPaths:
88+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
89+
options:
90+
delimiter: '/'
91+
index: 1
92+
create: true
93+
- select:
94+
kind: MutatingWebhookConfiguration
95+
fieldPaths:
96+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
97+
options:
98+
delimiter: '/'
99+
index: 1
100+
create: true
101+
- select:
102+
kind: CustomResourceDefinition
103+
fieldPaths:
104+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
105+
options:
106+
delimiter: '/'
107+
index: 1
108+
create: true
109+
- source: # Add cert-manager annotation to the webhook Service
110+
kind: Service
111+
version: v1
112+
name: webhook-service
113+
fieldPath: .metadata.name # namespace of the service
114+
targets:
115+
- select:
116+
kind: Certificate
117+
group: cert-manager.io
118+
version: v1
119+
fieldPaths:
120+
- .spec.dnsNames.0
121+
- .spec.dnsNames.1
122+
options:
123+
delimiter: '.'
124+
index: 0
125+
create: true
126+
- source:
127+
kind: Service
128+
version: v1
129+
name: webhook-service
130+
fieldPath: .metadata.namespace # namespace of the service
131+
targets:
132+
- select:
133+
kind: Certificate
134+
group: cert-manager.io
135+
version: v1
136+
fieldPaths:
137+
- .spec.dnsNames.0
138+
- .spec.dnsNames.1
139+
options:
140+
delimiter: '.'
141+
index: 1
142+
create: true

‎config/default/manager_webhook_patch.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager
11+
ports:
12+
- containerPort: 9443
13+
name: webhook-server
14+
protocol: TCP
15+
volumeMounts:
16+
- mountPath: /tmp/k8s-webhook-server/serving-certs
17+
name: cert
18+
readOnly: true
19+
volumes:
20+
- name: cert
21+
secret:
22+
defaultMode: 420
23+
secretName: webhook-server-cert

0 commit comments

Comments
 (0)