Skip to content

Commit 756de76

Browse files
ronethingronething
authored
feat: support webhook server for ingress (#213)
Signed-off-by: Ashing Zheng <[email protected]>
1 parent 44e1fe8 commit 756de76

File tree

7 files changed

+313
-17
lines changed

7 files changed

+313
-17
lines changed

‎charts/ingress-controller/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,4 +59,9 @@ Ingress Controller for API7
5959
| podDisruptionBudget.enabled | bool | `false` | Enable or disable podDisruptionBudget |
6060
| podDisruptionBudget.maxUnavailable | int | `1` | Set the maxUnavailable of podDisruptionBudget |
6161
| podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details |
62+
| webhook.certificate.provided | bool | `false` | Set to true if you want to provide your own certificate |
63+
| webhook.enabled | bool | `true` | Enable or disable admission webhook |
64+
| webhook.failurePolicy | string | `"Fail"` | Failure policy for the webhook (Fail or Ignore) |
65+
| webhook.port | int | `9443` | The port for the webhook server to listen on |
66+
| webhook.timeoutSeconds | int | `10` | Timeout in seconds for the webhook |
6267

‎charts/ingress-controller/templates/_helpers.tpl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,23 @@ app.kubernetes.io/name: {{ include "api7-ingress-controller-manager.name" . }}
5050
app.kubernetes.io/instance: {{ .Release.Name }}
5151
{{- end }}
5252
{{- end }}
53+
54+
{{/*
55+
Webhook service name - ensure it stays within 63 character limit
56+
*/}}
57+
{{- define "api7-ingress-controller-manager.webhook.serviceName" -}}
58+
{{- $suffix := "-webhook-svc" -}}
59+
{{- $maxLen := sub 63 (len $suffix) | int -}}
60+
{{- $baseName := include "api7-ingress-controller-manager.name.fullname" . | trunc $maxLen | trimSuffix "-" -}}
61+
{{- printf "%s%s" $baseName $suffix -}}
62+
{{- end }}
63+
64+
{{/*
65+
Webhook secret name - ensure it stays within 63 character limit
66+
*/}}
67+
{{- define "api7-ingress-controller-manager.webhook.secretName" -}}
68+
{{- $suffix := "-webhook-cert" -}}
69+
{{- $maxLen := sub 63 (len $suffix) | int -}}
70+
{{- $baseName := include "api7-ingress-controller-manager.name.fullname" . | trunc $maxLen | trimSuffix "-" -}}
71+
{{- printf "%s%s" $baseName $suffix -}}
72+
{{- end }}

‎charts/ingress-controller/templates/cluster_role.yaml‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ rules:
1717
- pods
1818
- secrets
1919
- services
20-
- endpoints
2120
verbs:
2221
- get
2322
- list
@@ -79,7 +78,6 @@ rules:
7978
- gateway.networking.k8s.io
8079
resources:
8180
- gatewayclasses
82-
- gateways
8381
verbs:
8482
- get
8583
- list
@@ -90,6 +88,7 @@ rules:
9088
resources:
9189
- gatewayclasses/status
9290
- gateways/status
91+
- grpcroutes/status
9392
- httproutes/status
9493
- referencegrants/status
9594
verbs:
@@ -98,44 +97,38 @@ rules:
9897
- apiGroups:
9998
- gateway.networking.k8s.io
10099
resources:
100+
- gateways
101+
- grpcroutes
101102
- httproutes
102-
verbs:
103-
- get
104-
- list
105-
- watch
106-
- apiGroups:
107-
- gateway.networking.k8s.io
108-
resources:
109103
- referencegrants
110104
verbs:
105+
- get
111106
- list
112-
- update
113107
- watch
114108
- apiGroups:
115109
- networking.k8s.io
116110
resources:
117111
- ingressclasses
112+
- ingresses
118113
verbs:
119114
- get
120115
- list
121116
- watch
122117
- apiGroups:
123118
- networking.k8s.io
124119
resources:
125-
- ingresses
120+
- ingresses/status
126121
verbs:
127122
- get
128-
- list
129123
- update
130-
- watch
131124
- apiGroups:
132-
- networking.k8s.io
125+
- ""
133126
resources:
134-
- ingresses/status
127+
- endpoints
135128
verbs:
136129
- get
137-
- update
138-
130+
- list
131+
- watch
139132
---
140133
apiVersion: rbac.authorization.k8s.io/v1
141134
kind: ClusterRole

‎charts/ingress-controller/templates/configmap.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,11 @@ data:
2222
type: {{ .Values.config.provider.type | default "api7ee" }}
2323
sync_period: {{ .Values.config.provider.syncPeriod | default "0s" }}
2424
init_sync_delay: {{ .Values.config.provider.initSyncDelay | default "20m" }}
25+
{{- if .Values.webhook.enabled }}
26+
webhook:
27+
enable: true
28+
port: {{ .Values.webhook.port }}
29+
tls_cert_file: "tls.crt"
30+
tls_key_file: "tls.key"
31+
tls_cert_dir: "/certs"
32+
{{- end }}

‎charts/ingress-controller/templates/deployment.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,15 @@ spec:
4141
- name: {{ .Release.Name }}-ingress-config
4242
mountPath: /app/conf/config.yaml
4343
subPath: config.yaml
44+
{{- if .Values.webhook.enabled }}
45+
- name: webhook-certs
46+
mountPath: /certs
47+
readOnly: true
48+
{{- end }}
49+
ports:
50+
- name: webhook
51+
containerPort: {{ .Values.webhook.port }}
52+
protocol: TCP
4453
livenessProbe:
4554
httpGet:
4655
path: /healthz
@@ -112,6 +121,11 @@ spec:
112121
- name: {{ .Release.Name }}-ingress-config
113122
configMap:
114123
name: {{ .Release.Name }}-ingress-config
124+
{{- if .Values.webhook.enabled }}
125+
- name: webhook-certs
126+
secret:
127+
secretName: {{ include "api7-ingress-controller-manager.webhook.secretName" . }}
128+
{{- end }}
115129
securityContext:
116130
runAsNonRoot: false
117131
serviceAccountName: {{ .Release.Name }}

‎charts/ingress-controller/templates/webhook.yaml‎

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
{{- if .Values.webhook.enabled }}
2+
{{- $certCert := "" -}}
3+
{{- $certKey := "" -}}
4+
{{- $caCert := "" -}}
5+
{{- if not .Values.webhook.certificate.provided }}
6+
{{- $cn := printf "%s.%s.svc" (include "api7-ingress-controller-manager.webhook.serviceName" .) .Release.Namespace -}}
7+
{{- $ca := genCA "api7-ingress-webhook-ca" 3650 -}}
8+
{{- $cert := genSignedCert $cn nil (list $cn) 3650 $ca -}}
9+
{{- $certCert = $cert.Cert -}}
10+
{{- $certKey = $cert.Key -}}
11+
{{- $caCert = $ca.Cert -}}
12+
13+
{{- $certSecret := (lookup "v1" "Secret" .Release.Namespace (include "api7-ingress-controller-manager.webhook.secretName" .)) -}}
14+
{{- if $certSecret }}
15+
{{- $certCert = (b64dec (get $certSecret.data "tls.crt")) -}}
16+
{{- $certKey = (b64dec (get $certSecret.data "tls.key")) -}}
17+
{{- $caCert = (b64dec (get $certSecret.data "ca.crt")) -}}
18+
{{- end }}
19+
{{- end }}
20+
21+
---
22+
apiVersion: admissionregistration.k8s.io/v1
23+
kind: ValidatingWebhookConfiguration
24+
metadata:
25+
name: {{ include "api7-ingress-controller-manager.name.fullname" . }}-webhook
26+
labels:
27+
{{- include "api7-ingress-controller-manager.labels" . | nindent 4 }}
28+
webhooks:
29+
- name: vapisixroute-v2.kb.io
30+
admissionReviewVersions: ["v1"]
31+
clientConfig:
32+
{{- if not .Values.webhook.certificate.provided }}
33+
caBundle: {{ b64enc $caCert }}
34+
{{- else }}
35+
caBundle: {{ .Values.webhook.certificate.caBundle }}
36+
{{- end }}
37+
service:
38+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
39+
namespace: {{ .Release.Namespace }}
40+
path: /validate-apisix-apache-org-v2-apisixroute
41+
failurePolicy: {{ .Values.webhook.failurePolicy }}
42+
{{- with .Values.webhook.timeoutSeconds }}
43+
timeoutSeconds: {{ . }}
44+
{{- end }}
45+
sideEffects: None
46+
rules:
47+
- operations: ["CREATE", "UPDATE"]
48+
apiGroups: ["apisix.apache.org"]
49+
apiVersions: ["v2"]
50+
resources: ["apisixroutes"]
51+
- name: vapisixconsumer-v2.kb.io
52+
admissionReviewVersions: ["v1"]
53+
clientConfig:
54+
{{- if not .Values.webhook.certificate.provided }}
55+
caBundle: {{ b64enc $caCert }}
56+
{{- else }}
57+
caBundle: {{ .Values.webhook.certificate.caBundle }}
58+
{{- end }}
59+
service:
60+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
61+
namespace: {{ .Release.Namespace }}
62+
path: /validate-apisix-apache-org-v2-apisixconsumer
63+
failurePolicy: {{ .Values.webhook.failurePolicy }}
64+
{{- with .Values.webhook.timeoutSeconds }}
65+
timeoutSeconds: {{ . }}
66+
{{- end }}
67+
sideEffects: None
68+
rules:
69+
- operations: ["CREATE", "UPDATE"]
70+
apiGroups: ["apisix.apache.org"]
71+
apiVersions: ["v2"]
72+
resources: ["apisixconsumers"]
73+
- name: vapisixtls-v2.kb.io
74+
admissionReviewVersions: ["v1"]
75+
clientConfig:
76+
{{- if not .Values.webhook.certificate.provided }}
77+
caBundle: {{ b64enc $caCert }}
78+
{{- else }}
79+
caBundle: {{ .Values.webhook.certificate.caBundle }}
80+
{{- end }}
81+
service:
82+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
83+
namespace: {{ .Release.Namespace }}
84+
path: /validate-apisix-apache-org-v2-apisixtls
85+
failurePolicy: {{ .Values.webhook.failurePolicy }}
86+
{{- with .Values.webhook.timeoutSeconds }}
87+
timeoutSeconds: {{ . }}
88+
{{- end }}
89+
sideEffects: None
90+
rules:
91+
- operations: ["CREATE", "UPDATE"]
92+
apiGroups: ["apisix.apache.org"]
93+
apiVersions: ["v2"]
94+
resources: ["apisixtlses"]
95+
- name: vconsumer-v1alpha1.kb.io
96+
admissionReviewVersions: ["v1"]
97+
clientConfig:
98+
{{- if not .Values.webhook.certificate.provided }}
99+
caBundle: {{ b64enc $caCert }}
100+
{{- else }}
101+
caBundle: {{ .Values.webhook.certificate.caBundle }}
102+
{{- end }}
103+
service:
104+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
105+
namespace: {{ .Release.Namespace }}
106+
path: /validate-apisix-apache-org-v1alpha1-consumer
107+
failurePolicy: {{ .Values.webhook.failurePolicy }}
108+
{{- with .Values.webhook.timeoutSeconds }}
109+
timeoutSeconds: {{ . }}
110+
{{- end }}
111+
sideEffects: None
112+
rules:
113+
- operations: ["CREATE", "UPDATE"]
114+
apiGroups: ["apisix.apache.org"]
115+
apiVersions: ["v1alpha1"]
116+
resources: ["consumers"]
117+
- name: vgatewayproxy-v1alpha1.kb.io
118+
admissionReviewVersions: ["v1"]
119+
clientConfig:
120+
{{- if not .Values.webhook.certificate.provided }}
121+
caBundle: {{ b64enc $caCert }}
122+
{{- else }}
123+
caBundle: {{ .Values.webhook.certificate.caBundle }}
124+
{{- end }}
125+
service:
126+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
127+
namespace: {{ .Release.Namespace }}
128+
path: /validate-apisix-apache-org-v1alpha1-gatewayproxy
129+
failurePolicy: {{ .Values.webhook.failurePolicy }}
130+
{{- with .Values.webhook.timeoutSeconds }}
131+
timeoutSeconds: {{ . }}
132+
{{- end }}
133+
sideEffects: None
134+
rules:
135+
- operations: ["CREATE", "UPDATE"]
136+
apiGroups: ["apisix.apache.org"]
137+
apiVersions: ["v1alpha1"]
138+
resources: ["gatewayproxies"]
139+
- name: vingress-v1.kb.io
140+
admissionReviewVersions: ["v1"]
141+
clientConfig:
142+
{{- if not .Values.webhook.certificate.provided }}
143+
caBundle: {{ b64enc $caCert }}
144+
{{- else }}
145+
caBundle: {{ .Values.webhook.certificate.caBundle }}
146+
{{- end }}
147+
service:
148+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
149+
namespace: {{ .Release.Namespace }}
150+
path: /validate-networking-k8s-io-v1-ingress
151+
failurePolicy: {{ .Values.webhook.failurePolicy }}
152+
{{- with .Values.webhook.timeoutSeconds }}
153+
timeoutSeconds: {{ . }}
154+
{{- end }}
155+
sideEffects: None
156+
rules:
157+
- operations: ["CREATE", "UPDATE"]
158+
apiGroups: ["networking.k8s.io"]
159+
apiVersions: ["v1"]
160+
resources: ["ingresses"]
161+
- name: vingressclass-v1.kb.io
162+
admissionReviewVersions: ["v1"]
163+
clientConfig:
164+
{{- if not .Values.webhook.certificate.provided }}
165+
caBundle: {{ b64enc $caCert }}
166+
{{- else }}
167+
caBundle: {{ .Values.webhook.certificate.caBundle }}
168+
{{- end }}
169+
service:
170+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
171+
namespace: {{ .Release.Namespace }}
172+
path: /validate-networking-k8s-io-v1-ingressclass
173+
failurePolicy: {{ .Values.webhook.failurePolicy }}
174+
{{- with .Values.webhook.timeoutSeconds }}
175+
timeoutSeconds: {{ . }}
176+
{{- end }}
177+
sideEffects: None
178+
rules:
179+
- operations: ["CREATE", "UPDATE"]
180+
apiGroups: ["networking.k8s.io"]
181+
apiVersions: ["v1"]
182+
resources: ["ingressclasses"]
183+
- name: vgateway-v1.kb.io
184+
admissionReviewVersions: ["v1"]
185+
clientConfig:
186+
{{- if not .Values.webhook.certificate.provided }}
187+
caBundle: {{ b64enc $caCert }}
188+
{{- else }}
189+
caBundle: {{ .Values.webhook.certificate.caBundle }}
190+
{{- end }}
191+
service:
192+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
193+
namespace: {{ .Release.Namespace }}
194+
path: /validate-gateway-networking-k8s-io-v1-gateway
195+
failurePolicy: {{ .Values.webhook.failurePolicy }}
196+
{{- with .Values.webhook.timeoutSeconds }}
197+
timeoutSeconds: {{ . }}
198+
{{- end }}
199+
sideEffects: None
200+
rules:
201+
- operations: ["CREATE", "UPDATE"]
202+
apiGroups: ["gateway.networking.k8s.io"]
203+
apiVersions: ["v1"]
204+
resources: ["gateways"]
205+
206+
---
207+
apiVersion: v1
208+
kind: Service
209+
metadata:
210+
name: {{ include "api7-ingress-controller-manager.webhook.serviceName" . }}
211+
namespace: {{ .Release.Namespace }}
212+
labels:
213+
{{- include "api7-ingress-controller-manager.labels" . | nindent 4 }}
214+
spec:
215+
ports:
216+
- name: webhook
217+
port: 443
218+
protocol: TCP
219+
targetPort: webhook
220+
selector:
221+
{{- include "api7-ingress-controller-manager.selectorLabels" . | nindent 4 }}
222+
223+
{{- if not .Values.webhook.certificate.provided }}
224+
---
225+
apiVersion: v1
226+
kind: Secret
227+
metadata:
228+
name: {{ include "api7-ingress-controller-manager.webhook.secretName" . }}
229+
namespace: {{ .Release.Namespace }}
230+
labels:
231+
{{- include "api7-ingress-controller-manager.labels" . | nindent 4 }}
232+
type: kubernetes.io/tls
233+
data:
234+
tls.crt: {{ b64enc $certCert }}
235+
tls.key: {{ b64enc $certKey }}
236+
ca.crt: {{ b64enc $caCert }}
237+
{{- end }}
238+
{{- end }}

0 commit comments

Comments
 (0)