Skip to content

Commit 2a32d2d

Browse files
stefanprodanstefanprodan
committed
Init with kubebuilder
1 parent edd8bd7 commit 2a32d2d

29 files changed

+1262
-3
lines changed

‎.gitignore‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
# Test binary, built with `go test -c`
99
*.test
1010

11-
# Output of the go coverage tool, specifically when used with LiteIDE
11+
# Output of the go coverage tool
1212
*.out
1313

14-
# Dependency directories (remove the comment below to include it)
15-
# vendor/
14+
# Local build output dir
15+
bin/

‎Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Build the manager binary
2+
FROM golang:1.13 as builder
3+
4+
WORKDIR /workspace
5+
# Copy the Go Modules manifests
6+
COPY go.mod go.mod
7+
COPY go.sum go.sum
8+
# cache deps before building and copying source so that we don't need to re-download as much
9+
# and so that source changes don't invalidate our downloaded layer
10+
RUN go mod download
11+
12+
# Copy the go source
13+
COPY main.go main.go
14+
COPY api/ api/
15+
COPY controllers/ controllers/
16+
17+
# Build
18+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager main.go
19+
20+
# Use distroless as minimal base image to package the manager binary
21+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
22+
FROM gcr.io/distroless/static:nonroot
23+
WORKDIR /
24+
COPY --from=builder /workspace/manager .
25+
USER nonroot:nonroot
26+
27+
ENTRYPOINT ["/manager"]

‎Makefile‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
2+
# Image URL to use all building/pushing image targets
3+
IMG ?= controller:latest
4+
# Produce CRDs that work back to Kubernetes 1.13
5+
CRD_OPTIONS ?= "crd"
6+
7+
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
8+
ifeq (,$(shell go env GOBIN))
9+
GOBIN=$(shell go env GOPATH)/bin
10+
else
11+
GOBIN=$(shell go env GOBIN)
12+
endif
13+
14+
all: manager
15+
16+
# Run tests
17+
test: generate fmt vet manifests
18+
go test ./... -coverprofile cover.out
19+
20+
# Build manager binary
21+
manager: generate fmt vet
22+
go build -o bin/manager main.go
23+
24+
# Run against the configured Kubernetes cluster in ~/.kube/config
25+
run: generate fmt vet manifests
26+
go run ./main.go
27+
28+
# Install CRDs into a cluster
29+
install: manifests
30+
kustomize build config/crd | kubectl apply -f -
31+
32+
# Uninstall CRDs from a cluster
33+
uninstall: manifests
34+
kustomize build config/crd | kubectl delete -f -
35+
36+
# Deploy controller in the configured Kubernetes cluster in ~/.kube/config
37+
deploy: manifests
38+
cd config/manager && kustomize edit set image controller=${IMG}
39+
kustomize build config/default | kubectl apply -f -
40+
41+
# Generate manifests e.g. CRD, RBAC etc.
42+
manifests: controller-gen
43+
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
44+
45+
# Run go fmt against code
46+
fmt:
47+
go fmt ./...
48+
49+
# Run go vet against code
50+
vet:
51+
go vet ./...
52+
53+
# Generate code
54+
generate: controller-gen
55+
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
56+
57+
# Build the docker image
58+
docker-build: test
59+
docker build . -t ${IMG}
60+
61+
# Push the docker image
62+
docker-push:
63+
docker push ${IMG}
64+
65+
# find or download controller-gen
66+
# download controller-gen if necessary
67+
controller-gen:
68+
ifeq (, $(shell which controller-gen))
69+
@{ \
70+
set -e ;\
71+
CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
72+
cd $$CONTROLLER_GEN_TMP_DIR ;\
73+
go mod init tmp ;\
74+
go get sigs.k8s.io/controller-tools/cmd/[email protected] ;\
75+
rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
76+
}
77+
CONTROLLER_GEN=$(GOBIN)/controller-gen
78+
else
79+
CONTROLLER_GEN=$(shell which controller-gen)
80+
endif

‎PROJECT‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
domain: fluxcd.io
2+
repo: github.com/stefanprodan/source-watcher
3+
version: "2"

‎config/certmanager/certificate.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager 0.11 check https://docs.cert-manager.io/en/latest/tasks/upgrading/index.html for
4+
# breaking changes
5+
apiVersion: cert-manager.io/v1alpha2
6+
kind: Issuer
7+
metadata:
8+
name: selfsigned-issuer
9+
namespace: system
10+
spec:
11+
selfSigned: {}
12+
---
13+
apiVersion: cert-manager.io/v1alpha2
14+
kind: Certificate
15+
metadata:
16+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
17+
namespace: system
18+
spec:
19+
# $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
20+
dnsNames:
21+
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
22+
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
23+
issuerRef:
24+
kind: Issuer
25+
name: selfsigned-issuer
26+
secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

‎config/certmanager/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resources:
2+
- certificate.yaml
3+
4+
configurations:
5+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# This configuration is for teaching kustomize how to update name ref and var substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name
9+
10+
varReference:
11+
- kind: Certificate
12+
group: cert-manager.io
13+
path: spec/commonName
14+
- kind: Certificate
15+
group: cert-manager.io
16+
path: spec/dnsNames

‎config/default/kustomization.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Adds namespace to all resources.
2+
namespace: source-watcher-system
3+
4+
# Value of this field is prepended to the
5+
# names of all resources, e.g. a deployment named
6+
# "wordpress" becomes "alices-wordpress".
7+
# Note that it should also match with the prefix (text before '-') of the namespace
8+
# field above.
9+
namePrefix: source-watcher-
10+
11+
# Labels to add to all resources and selectors.
12+
#commonLabels:
13+
# someName: someValue
14+
15+
bases:
16+
- ../crd
17+
- ../rbac
18+
- ../manager
19+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
20+
# crd/kustomization.yaml
21+
#- ../webhook
22+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
23+
#- ../certmanager
24+
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
25+
#- ../prometheus
26+
27+
patchesStrategicMerge:
28+
# Protect the /metrics endpoint by putting it behind auth.
29+
# If you want your controller-manager to expose the /metrics
30+
# endpoint w/o any authn/z, please comment the following line.
31+
- manager_auth_proxy_patch.yaml
32+
33+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
34+
# crd/kustomization.yaml
35+
#- manager_webhook_patch.yaml
36+
37+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
38+
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
39+
# 'CERTMANAGER' needs to be enabled to use ca injection
40+
#- webhookcainjection_patch.yaml
41+
42+
# the following config is for teaching kustomize how to do var substitution
43+
vars:
44+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
45+
#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
46+
# objref:
47+
# kind: Certificate
48+
# group: cert-manager.io
49+
# version: v1alpha2
50+
# name: serving-cert # this name should match the one in certificate.yaml
51+
# fieldref:
52+
# fieldpath: metadata.namespace
53+
#- name: CERTIFICATE_NAME
54+
# objref:
55+
# kind: Certificate
56+
# group: cert-manager.io
57+
# version: v1alpha2
58+
# name: serving-cert # this name should match the one in certificate.yaml
59+
#- name: SERVICE_NAMESPACE # namespace of the service
60+
# objref:
61+
# kind: Service
62+
# version: v1
63+
# name: webhook-service
64+
# fieldref:
65+
# fieldpath: metadata.namespace
66+
#- name: SERVICE_NAME
67+
# objref:
68+
# kind: Service
69+
# version: v1
70+
# name: webhook-service

‎config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# This patch inject a sidecar container which is a HTTP proxy for the
2+
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: controller-manager
7+
namespace: system
8+
spec:
9+
template:
10+
spec:
11+
containers:
12+
- name: kube-rbac-proxy
13+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
14+
args:
15+
- "--secure-listen-address=0.0.0.0:8443"
16+
- "--upstream=http://127.0.0.1:8080/"
17+
- "--logtostderr=true"
18+
- "--v=10"
19+
ports:
20+
- containerPort: 8443
21+
name: https
22+
- name: manager
23+
args:
24+
- "--metrics-addr=127.0.0.1:8080"
25+
- "--enable-leader-election"

‎config/default/manager_webhook_patch.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager
11+
ports:
12+
- containerPort: 9443
13+
name: webhook-server
14+
protocol: TCP
15+
volumeMounts:
16+
- mountPath: /tmp/k8s-webhook-server/serving-certs
17+
name: cert
18+
readOnly: true
19+
volumes:
20+
- name: cert
21+
secret:
22+
defaultMode: 420
23+
secretName: webhook-server-cert

0 commit comments

Comments
 (0)