Bug/blocked pods (#9)

* improved getting started steps

* fixed self signed issuer reference

* fixed bug with pods being blocked for non openfeature workloads

Author: AlexsJones

README.md

@@ -63,4 +63,6 @@ root@nginx:/# curl localhost:8080
 
  1. Create a local cluster with MicroK8s or Kind
  2. `kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.8.0/cert-manager.yaml`
- 3. `IMG=ghcr.io/open-feature/open-feature-operator:main make deploy`
+ 3. `kubectl apply -f config/webhook/certificate.yaml`
+ 4. `IMG=ghcr.io/open-feature/open-feature-operator:main make deploy`
+

config/manager/kustomization.yaml

@@ -13,4 +13,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: ghcr.io/open-feature/open-feature-operator
-  newTag: main
+  newTag: main

config/manager/manager.yaml

@@ -74,7 +74,8 @@ metadata:
   namespace: open-feature-operator-system  
 spec:  
   secretName: sidecar-injector-certs  
-  dnsNames:  
+  dnsNames:
+    - open-feature-operator-webhook-service
     - open-feature-operator-webhook-service.open-feature-operator-system.svc  
     - open-feature-operator-webhook-service.open-feature-operator-system.svc.cluster.local  
   issuerRef:  

config/samples/deployment.yaml

@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  annotations:
+    openfeature.dev: "enabled"
+    openfeature.dev/featureflagconfiguration: "featureflagconfiguration-sample"
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  replicas: 2 # tells deployment to run 2 pods matching the template
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.14.2
+        ports:
+        - containerPort: 80

examples/pod.yaml renamed to config/samples/pod.yaml

@@ -0,0 +1,21 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: open-feature-operator-selfsigned-issuer
+  namespace: open-feature-operator-system  
+spec:
+  selfSigned: {}
+---  
+apiVersion: cert-manager.io/v1
+kind: Certificate  
+metadata:  
+  name: webhook-cert
+  namespace: open-feature-operator-system  
+spec:  
+  secretName: sidecar-injector-certs  
+  dnsNames:
+    - open-feature-operator-webhook-service
+    - open-feature-operator-webhook-service.open-feature-operator-system.svc  
+    - open-feature-operator-webhook-service.open-feature-operator-system.svc.cluster.local  
+  issuerRef:  
+    name: open-feature-operator-selfsigned-issuer

config/webhook/certificate.yaml

@@ -24,4 +24,5 @@ webhooks:
     - UPDATE
     resources:
     - pods
+    - deployments
   sideEffects: NoneOnDryRun

config/webhook/manifests.yaml

@@ -17,7 +17,7 @@ import (
 // NOTE: RBAC not needed here.
 //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:webhook:path=/mutate-v1-pod,mutating=true,failurePolicy=Ignore,groups="",resources=pods,verbs=create;update,versions=v1,name=mpod.kb.io,admissionReviewVersions=v1,sideEffects=NoneOnDryRun
+// +kubebuilder:webhook:path=/mutate-v1-pod,mutating=true,failurePolicy=Ignore,groups="",resources=pods;deployments,verbs=create;update,versions=v1,name=mpod.kb.io,admissionReviewVersions=v1,sideEffects=NoneOnDryRun
 
 // PodMutator annotates Pods
 type PodMutator struct {
@@ -39,11 +39,11 @@ func (m *PodMutator) Handle(ctx context.Context, req admission.Request) admissio
 	// Check enablement
 	val, ok := pod.GetAnnotations()["openfeature.dev"]
 	if !ok {
-		return admission.Response{}
+		return admission.Allowed("no annotation")
 	} else {
 		if val != "enabled" {
 			m.Log.V(2).Info("openfeature.dev Annotation is not enabled")
-			return admission.Response{}
+			return admission.Allowed("openfeature is disabled")
 		}
 	}
 	var featureFlagCustomResource corev1alpha1.FeatureFlagConfiguration
@@ -81,7 +81,9 @@ func (m *PodMutator) Handle(ctx context.Context, req admission.Request) admissio
 			"config.yaml": featureFlagCustomResource.Spec.FeatureFlagSpec,
 		},
 	}); err != nil {
-		fmt.Printf(fmt.Sprintf("failed to create config map %s", configName))
+
+		m.Log.V(1).Info(fmt.Sprintf("failed to create config map %s", configName))
+
 		return admission.Errored(http.StatusInternalServerError, err)
 	}