Skip to content

Commit 3bbd01d

Browse files
zeroalphatzeroalphat
committed
Migrate to CustomValidator and CustomDefaulter interfaces
Signed-off-by: zeroalphat <taichi-takemura@cybozu.co.jp>
1 parent da5e8ae commit 3bbd01d

19 files changed

+666
-102
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ RUN go mod download
1111
# Copy the go source
1212
COPY cmd/main.go cmd/main.go
1313
COPY api/ api/
14-
COPY internal/controller/ internal/controller/
14+
COPY internal/ internal/
1515

1616
# Build
1717
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go

‎PROJECT‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ resources:
1313
kind: ImagePrefetch
1414
path: github.com/cybozu-go/ofen/api/v1
1515
version: v1
16+
webhooks:
17+
defaulting: true
18+
validation: true
19+
webhookVersion: v1
1620
- api:
1721
crdVersion: v1
1822
controller: true

‎cmd/main.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919

2020
ofenv1 "github.com/cybozu-go/ofen/api/v1"
2121
"github.com/cybozu-go/ofen/internal/controller"
22+
webhookofenv1 "github.com/cybozu-go/ofen/internal/webhook/v1"
2223
// +kubebuilder:scaffold:imports
2324
)
2425

@@ -140,6 +141,13 @@ func main() {
140141
setupLog.Error(err, "unable to create controller", "controller", "NodeImageSet")
141142
os.Exit(1)
142143
}
144+
// nolint:goconst
145+
if os.Getenv("ENABLE_WEBHOOKS") != "false" {
146+
if err = webhookofenv1.SetupImagePrefetchWebhookWithManager(mgr); err != nil {
147+
setupLog.Error(err, "unable to create webhook", "webhook", "ImagePrefetch")
148+
os.Exit(1)
149+
}
150+
}
143151
// +kubebuilder:scaffold:builder
144152

145153
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {

‎config/certmanager/certificate-metrics.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a metrics certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: ofen
8+
app.kubernetes.io/managed-by: kustomize
9+
name: metrics-certs # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
dnsNames:
13+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
14+
# replacements in the config/default/kustomization.yaml file.
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: metrics-server-cert

‎config/certmanager/certificate-webhook.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: ofen
8+
app.kubernetes.io/managed-by: kustomize
9+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
13+
# replacements in the config/default/kustomization.yaml file.
14+
dnsNames:
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: webhook-server-cert

‎config/certmanager/issuer.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# The following manifest contains a self-signed issuer CR.
2+
# More information can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: ofen
9+
app.kubernetes.io/managed-by: kustomize
10+
name: selfsigned-issuer
11+
namespace: system
12+
spec:
13+
selfSigned: {}

‎config/certmanager/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resources:
2+
- issuer.yaml
3+
- certificate-webhook.yaml
4+
- certificate-metrics.yaml
5+
6+
configurations:
7+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This configuration is for teaching kustomize how to update name ref substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name

‎config/default/kustomization.yaml‎

Lines changed: 101 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ resources:
2020
- ../manager
2121
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2222
# crd/kustomization.yaml
23-
#- ../webhook
23+
- ../webhook
2424
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
25-
#- ../certmanager
25+
- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
2828
# [METRICS] Expose the controller manager metrics service.
@@ -43,109 +43,109 @@ patches:
4343

4444
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
4545
# crd/kustomization.yaml
46-
#- path: manager_webhook_patch.yaml
46+
- path: manager_webhook_patch.yaml
4747

4848
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
4949
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
5050
# 'CERTMANAGER' needs to be enabled to use ca injection
51-
#- path: webhookcainjection_patch.yaml
51+
- path: webhookcainjection_patch.yaml
5252

5353
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
5454
# Uncomment the following replacements to add the cert-manager CA injection annotations
55-
#replacements:
56-
# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
57-
# kind: Certificate
58-
# group: cert-manager.io
59-
# version: v1
60-
# name: serving-cert # this name should match the one in certificate.yaml
61-
# fieldPath: .metadata.namespace # namespace of the certificate CR
62-
# targets:
63-
# - select:
64-
# kind: ValidatingWebhookConfiguration
65-
# fieldPaths:
66-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
67-
# options:
68-
# delimiter: '/'
69-
# index: 0
70-
# create: true
71-
# - select:
72-
# kind: MutatingWebhookConfiguration
73-
# fieldPaths:
74-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
75-
# options:
76-
# delimiter: '/'
77-
# index: 0
78-
# create: true
79-
# - select:
80-
# kind: CustomResourceDefinition
81-
# fieldPaths:
82-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
83-
# options:
84-
# delimiter: '/'
85-
# index: 0
86-
# create: true
87-
# - source:
88-
# kind: Certificate
89-
# group: cert-manager.io
90-
# version: v1
91-
# name: serving-cert # this name should match the one in certificate.yaml
92-
# fieldPath: .metadata.name
93-
# targets:
94-
# - select:
95-
# kind: ValidatingWebhookConfiguration
96-
# fieldPaths:
97-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
98-
# options:
99-
# delimiter: '/'
100-
# index: 1
101-
# create: true
102-
# - select:
103-
# kind: MutatingWebhookConfiguration
104-
# fieldPaths:
105-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
106-
# options:
107-
# delimiter: '/'
108-
# index: 1
109-
# create: true
110-
# - select:
111-
# kind: CustomResourceDefinition
112-
# fieldPaths:
113-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
114-
# options:
115-
# delimiter: '/'
116-
# index: 1
117-
# create: true
118-
# - source: # Add cert-manager annotation to the webhook Service
119-
# kind: Service
120-
# version: v1
121-
# name: webhook-service
122-
# fieldPath: .metadata.name # namespace of the service
123-
# targets:
124-
# - select:
125-
# kind: Certificate
126-
# group: cert-manager.io
127-
# version: v1
128-
# fieldPaths:
129-
# - .spec.dnsNames.0
130-
# - .spec.dnsNames.1
131-
# options:
132-
# delimiter: '.'
133-
# index: 0
134-
# create: true
135-
# - source:
136-
# kind: Service
137-
# version: v1
138-
# name: webhook-service
139-
# fieldPath: .metadata.namespace # namespace of the service
140-
# targets:
141-
# - select:
142-
# kind: Certificate
143-
# group: cert-manager.io
144-
# version: v1
145-
# fieldPaths:
146-
# - .spec.dnsNames.0
147-
# - .spec.dnsNames.1
148-
# options:
149-
# delimiter: '.'
150-
# index: 1
151-
# create: true
55+
replacements:
56+
- source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
57+
kind: Certificate
58+
group: cert-manager.io
59+
version: v1
60+
name: serving-cert # this name should match the one in certificate.yaml
61+
fieldPath: .metadata.namespace # namespace of the certificate CR
62+
targets:
63+
- select:
64+
kind: ValidatingWebhookConfiguration
65+
fieldPaths:
66+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
67+
options:
68+
delimiter: '/'
69+
index: 0
70+
create: true
71+
- select:
72+
kind: MutatingWebhookConfiguration
73+
fieldPaths:
74+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
75+
options:
76+
delimiter: '/'
77+
index: 0
78+
create: true
79+
- select:
80+
kind: CustomResourceDefinition
81+
fieldPaths:
82+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
83+
options:
84+
delimiter: '/'
85+
index: 0
86+
create: true
87+
- source:
88+
kind: Certificate
89+
group: cert-manager.io
90+
version: v1
91+
name: serving-cert # this name should match the one in certificate.yaml
92+
fieldPath: .metadata.name
93+
targets:
94+
- select:
95+
kind: ValidatingWebhookConfiguration
96+
fieldPaths:
97+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
98+
options:
99+
delimiter: '/'
100+
index: 1
101+
create: true
102+
- select:
103+
kind: MutatingWebhookConfiguration
104+
fieldPaths:
105+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
106+
options:
107+
delimiter: '/'
108+
index: 1
109+
create: true
110+
- select:
111+
kind: CustomResourceDefinition
112+
fieldPaths:
113+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
114+
options:
115+
delimiter: '/'
116+
index: 1
117+
create: true
118+
- source: # Add cert-manager annotation to the webhook Service
119+
kind: Service
120+
version: v1
121+
name: webhook-service
122+
fieldPath: .metadata.name # namespace of the service
123+
targets:
124+
- select:
125+
kind: Certificate
126+
group: cert-manager.io
127+
version: v1
128+
fieldPaths:
129+
- .spec.dnsNames.0
130+
- .spec.dnsNames.1
131+
options:
132+
delimiter: '.'
133+
index: 0
134+
create: true
135+
- source:
136+
kind: Service
137+
version: v1
138+
name: webhook-service
139+
fieldPath: .metadata.namespace # namespace of the service
140+
targets:
141+
- select:
142+
kind: Certificate
143+
group: cert-manager.io
144+
version: v1
145+
fieldPaths:
146+
- .spec.dnsNames.0
147+
- .spec.dnsNames.1
148+
options:
149+
delimiter: '.'
150+
index: 1
151+
create: true

‎config/default/manager_webhook_patch.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# This patch ensures the webhook certificates are properly mounted in the manager container.
2+
# It configures the necessary arguments, volumes, volume mounts, and container ports.
3+
4+
# Add the --webhook-cert-path argument for configuring the webhook certificate path
5+
- op: add
6+
path: /spec/template/spec/containers/0/args/-
7+
value: --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
8+
9+
# Add the volumeMount for the webhook certificates
10+
- op: add
11+
path: /spec/template/spec/containers/0/volumeMounts/-
12+
value:
13+
mountPath: /tmp/k8s-webhook-server/serving-certs
14+
name: webhook-certs
15+
readOnly: true
16+
17+
# Add the port configuration for the webhook server
18+
- op: add
19+
path: /spec/template/spec/containers/0/ports/-
20+
value:
21+
containerPort: 9443
22+
name: webhook-server
23+
protocol: TCP
24+
25+
# Add the volume configuration for the webhook certificates
26+
- op: add
27+
path: /spec/template/spec/volumes/-
28+
value:
29+
name: webhook-certs
30+
secret:
31+
secretName: webhook-server-cert

0 commit comments

Comments
 (0)