Skip to content

Commit 662860d

Browse files
dspodspo
committed
Add webhook support for GatewayClass validation
This commit introduces a validating webhook for GatewayClass resources, preventing deletion when in use by Gateways. It adds the necessary configuration files, including service definitions, kustomization files, and RBAC rules. The implementation includes both create/update/delete validation logic and corresponding unit tests using Ginkgo. Additionally, it sets up cert-manager configurations for webhook certificates and updates the Makefile to deploy webhook configurations during installation.
1 parent 7548a22 commit 662860d

22 files changed

+697
-5
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,7 @@ uninstall-gateway-api: ## Uninstall Gateway API CRDs from the K8s cluster specif
253253
.PHONY: install
254254
install: manifests kustomize install-gateway-api ## Install CRDs into the K8s cluster specified in ~/.kube/config.
255255
$(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f -
256+
$(KUSTOMIZE) build config/webhook | $(KUBECTL) apply -f -
256257

257258
.PHONY: uninstall
258259
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.

‎PROJECT‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,12 @@ resources:
3434
kind: HTTPRoutePolicy
3535
path: github.com/api7/api7-ingress-controller/api/v1alpha1
3636
version: v1alpha1
37+
- external: true
38+
group: gateway.networking.k8s.io
39+
kind: GatewayClass
40+
path: sigs.k8s.io/gateway-api/apis/v1
41+
version: v1
42+
webhooks:
43+
validation: true
44+
webhookVersion: v1
3745
version: "3"

‎config/certmanager/certificate-metrics.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a metrics certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: api7-ingress-controller
8+
app.kubernetes.io/managed-by: kustomize
9+
name: metrics-certs # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
dnsNames:
13+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
14+
# replacements in the config/default/kustomization.yaml file.
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: metrics-server-cert

‎config/certmanager/certificate-webhook.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: api7-ingress-controller
8+
app.kubernetes.io/managed-by: kustomize
9+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
10+
namespace: system
11+
spec:
12+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
13+
# replacements in the config/default/kustomization.yaml file.
14+
dnsNames:
15+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
16+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
17+
issuerRef:
18+
kind: Issuer
19+
name: selfsigned-issuer
20+
secretName: webhook-server-cert

‎config/certmanager/issuer.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# The following manifest contains a self-signed issuer CR.
2+
# More information can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: api7-ingress-controller
9+
app.kubernetes.io/managed-by: kustomize
10+
name: selfsigned-issuer
11+
namespace: system
12+
spec:
13+
selfSigned: {}

‎config/certmanager/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resources:
2+
- issuer.yaml
3+
- certificate-webhook.yaml
4+
- certificate-metrics.yaml
5+
6+
configurations:
7+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This configuration is for teaching kustomize how to update name ref substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name

‎config/default/kustomization.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ resources:
2020
- ../manager
2121
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2222
# crd/kustomization.yaml
23-
#- ../webhook
23+
- ../webhook
2424
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
2525
#- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
@@ -30,7 +30,7 @@ resources:
3030
- ../samples
3131

3232
# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
33-
#patches:
33+
patches:
3434
# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
3535
# More info: https://book.kubebuilder.io/reference/metrics
3636
#- path: manager_patch.yaml

‎config/default/manager_webhook_patch.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# This patch ensures the webhook certificates are properly mounted in the manager container.
2+
# It configures the necessary arguments, volumes, volume mounts, and container ports.
3+
4+
# Add the --webhook-cert-path argument for configuring the webhook certificate path
5+
- op: add
6+
path: /spec/template/spec/containers/0/args/-
7+
value: --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
8+
9+
# Add the volumeMount for the webhook certificates
10+
- op: add
11+
path: /spec/template/spec/containers/0/volumeMounts/-
12+
value:
13+
mountPath: /tmp/k8s-webhook-server/serving-certs
14+
name: webhook-certs
15+
readOnly: true
16+
17+
# Add the port configuration for the webhook server
18+
- op: add
19+
path: /spec/template/spec/containers/0/ports/-
20+
value:
21+
containerPort: 9443
22+
name: webhook-server
23+
protocol: TCP
24+
25+
# Add the volume configuration for the webhook certificates
26+
- op: add
27+
path: /spec/template/spec/volumes/-
28+
value:
29+
name: webhook-certs
30+
secret:
31+
secretName: webhook-server-cert

‎config/network-policy/allow-webhook-traffic.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This NetworkPolicy allows ingress traffic to your webhook server running
2+
# as part of the controller-manager from specific namespaces and pods. CR(s) which uses webhooks
3+
# will only work when applied in namespaces labeled with 'webhook: enabled'
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: api7-ingress-controller
9+
app.kubernetes.io/managed-by: kustomize
10+
name: allow-webhook-traffic
11+
namespace: system
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
control-plane: controller-manager
16+
app.kubernetes.io/name: api7-ingress-controller
17+
policyTypes:
18+
- Ingress
19+
ingress:
20+
# This allows ingress traffic from any namespace with the label webhook: enabled
21+
- from:
22+
- namespaceSelector:
23+
matchLabels:
24+
webhook: enabled # Only from namespaces with this label
25+
ports:
26+
- port: 443
27+
protocol: TCP

0 commit comments

Comments
 (0)