Skip to content

Commit 8d60250

Browse files
dprincedprince
committed
bindata: add support for service operator webhooks
Currently configured just to extra webhooks for the infra operator as it is also a multigroup operator which requires webhooks to be enabled
1 parent 98d1293 commit 8d60250

File tree

6 files changed

+148
-11
lines changed

6 files changed

+148
-11
lines changed

‎apis/bases/operator.openstack.org_openstacks.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.11.1
7-
creationTimestamp: null
6+
controller-gen.kubebuilder.io/version: v0.14.0
87
name: openstacks.operator.openstack.org
98
spec:
109
group: operator.openstack.org

‎apis/operator/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/operator.openstack.org_openstacks.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.11.1
7-
creationTimestamp: null
6+
controller-gen.kubebuilder.io/version: v0.14.0
87
name: openstacks.operator.openstack.org
98
spec:
109
group: operator.openstack.org

‎config/operator/managers.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ spec:
3030
- /manager
3131
env:
3232
- name: ENABLE_WEBHOOKS
33+
{{ if eq $operatorName "infra" }}
34+
value: 'true'
35+
{{ else }}
3336
value: 'false'
37+
{{ end }}
3438
image: {{ $operatorImage }}
3539
livenessProbe:
3640
httpGet:
@@ -54,6 +58,12 @@ spec:
5458
memory: 128Mi
5559
securityContext:
5660
allowPrivilegeEscalation: false
61+
{{ if eq $operatorName "infra" }}
62+
volumeMounts:
63+
- mountPath: /tmp/k8s-webhook-server/serving-certs
64+
name: cert
65+
readOnly: true
66+
{{ end }}
5767
- args:
5868
- --secure-listen-address=0.0.0.0:8443
5969
- --upstream=http://127.0.0.1:8080/
@@ -78,5 +88,12 @@ spec:
7888
runAsNonRoot: true
7989
serviceAccountName: {{ $operatorName }}-operator-controller-manager
8090
terminationGracePeriodSeconds: 10
91+
{{ if eq $operatorName "infra" }}
92+
volumes:
93+
- name: cert
94+
secret:
95+
defaultMode: 420
96+
secretName: {{ $operatorName }}-operator-webhook-server-cert
97+
{{ end }}
8198
---
8299
{{ end }}

‎config/operator/rbac/role.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRole
44
metadata:
5-
creationTimestamp: null
65
name: operator-role
76
rules:
87
- apiGroups:

‎hack/sync-bindata.sh‎

Lines changed: 129 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
# -TODO: role data
66
set -ex
77

8+
OUT_DATA=bindata
9+
EXTRACT_DIR=tmp/bindata
10+
11+
mkdir -p "$EXTRACT_DIR"
12+
mkdir -p "$OUT_DATA/crds"
13+
814
function extract_bundle {
915
local IN_DIR=$1
1016
local OUT_DIR=$2
@@ -13,11 +19,125 @@ function extract_bundle {
1319
done
1420
}
1521

16-
OUT_DATA=bindata
17-
EXTRACT_DIR=tmp/bindata
1822

19-
mkdir -p "$EXTRACT_DIR"
20-
mkdir -p "$OUT_DATA/crds"
23+
function extract_webhooks {
24+
local CSV_FILENAME=$1
25+
local OPERATOR_NAME=$2
26+
local TYPE=$3
27+
28+
cat $CSV_FILENAME | yq -r ".spec.webhookdefinitions.[] | select(.type == \"$TYPE\")" | \
29+
sed -e '/^containerPort:/d' | \
30+
sed -e '/^deploymentName:/d' | \
31+
sed -e '/^targetPort:/d' | \
32+
sed -e '/^type:/d' | \
33+
sed -e 's|^| |' | sed -e 's|.*admissionReviewVersions:|- admissionReviewVersions:|' | \
34+
sed -e 's|.*generateName:| name:|' | \
35+
sed -e 's| - v1| - v1|' | \
36+
sed -e "s|.*webhookPath:| clientConfig:\n service:\n name: ${OPERATOR_NAME}-webhook-service\n namespace: '{{ .OperatorNamespace }}'\n path:|"
37+
38+
}
39+
40+
41+
function write_webhooks {
42+
local CSV_FILENAME=$1
43+
local OPERATOR_NAME=$2
44+
45+
MUTATING_WEBHOOKS=$(extract_webhooks "$CSV_FILENAME" "$OPERATOR_NAME" "MutatingAdmissionWebhook")
46+
VALIDATING_WEBHOOKS=$(extract_webhooks "$CSV_FILENAME" "$OPERATOR_NAME" "ValidatingAdmissionWebhook")
47+
48+
cat > operator/$OPERATOR_NAME-webhooks.yaml <<EOF_CAT
49+
apiVersion: v1
50+
kind: Service
51+
metadata:
52+
labels:
53+
app.kubernetes.io/component: webhook
54+
app.kubernetes.io/created-by: openstack-operator
55+
app.kubernetes.io/instance: webhook-service
56+
app.kubernetes.io/managed-by: kustomize
57+
app.kubernetes.io/name: service
58+
app.kubernetes.io/part-of: $OPERATOR_NAME
59+
name: $OPERATOR_NAME-webhook-service
60+
namespace: '{{ .OperatorNamespace }}'
61+
spec:
62+
ports:
63+
- port: 443
64+
protocol: TCP
65+
targetPort: 9443
66+
selector:
67+
openstack.org/operator-name: ${OPERATOR_NAME//-operator}
68+
---
69+
apiVersion: cert-manager.io/v1
70+
kind: Certificate
71+
metadata:
72+
labels:
73+
app.kubernetes.io/component: certificate
74+
app.kubernetes.io/created-by: openstack-operator
75+
app.kubernetes.io/instance: serving-cert
76+
app.kubernetes.io/managed-by: kustomize
77+
app.kubernetes.io/name: certificate
78+
app.kubernetes.io/part-of: $OPERATOR_NAME
79+
name: $OPERATOR_NAME-serving-cert
80+
namespace: '{{ .OperatorNamespace }}'
81+
spec:
82+
dnsNames:
83+
- $OPERATOR_NAME-webhook-service.{{ .OperatorNamespace }}.svc
84+
- $OPERATOR_NAME-webhook-service.{{ .OperatorNamespace }}.svc.cluster.local
85+
issuerRef:
86+
kind: Issuer
87+
name: $OPERATOR_NAME-selfsigned-issuer
88+
secretName: $OPERATOR_NAME-webhook-server-cert
89+
---
90+
apiVersion: cert-manager.io/v1
91+
kind: Issuer
92+
metadata:
93+
labels:
94+
app.kubernetes.io/component: certificate
95+
app.kubernetes.io/created-by: openstack-operator
96+
app.kubernetes.io/instance: selfsigned-issuer
97+
app.kubernetes.io/managed-by: kustomize
98+
app.kubernetes.io/name: issuer
99+
app.kubernetes.io/part-of: $OPERATOR_NAME
100+
name: $OPERATOR_NAME-selfsigned-issuer
101+
namespace: '{{ .OperatorNamespace }}'
102+
spec:
103+
selfSigned: {}
104+
---
105+
apiVersion: admissionregistration.k8s.io/v1
106+
kind: MutatingWebhookConfiguration
107+
metadata:
108+
annotations:
109+
cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/$OPERATOR_NAME-serving-cert'
110+
creationTimestamp: null
111+
labels:
112+
app.kubernetes.io/component: webhook
113+
app.kubernetes.io/created-by: openstack-operator
114+
app.kubernetes.io/instance: mutating-webhook-configuration
115+
app.kubernetes.io/managed-by: kustomize
116+
app.kubernetes.io/name: mutatingwebhookconfiguration
117+
app.kubernetes.io/part-of: $OPERATOR_NAME
118+
name: $OPERATOR_NAME-mutating-webhook-configuration
119+
webhooks:
120+
${MUTATING_WEBHOOKS}
121+
---
122+
apiVersion: admissionregistration.k8s.io/v1
123+
kind: ValidatingWebhookConfiguration
124+
metadata:
125+
annotations:
126+
cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/$OPERATOR_NAME-serving-cert'
127+
creationTimestamp: null
128+
labels:
129+
app.kubernetes.io/component: webhook
130+
app.kubernetes.io/created-by: openstack-operator
131+
app.kubernetes.io/instance: validating-webhook-configuration
132+
app.kubernetes.io/managed-by: kustomize
133+
app.kubernetes.io/name: validatingwebhookconfiguration
134+
app.kubernetes.io/part-of: $OPERATOR_NAME
135+
name: $OPERATOR_NAME-validating-webhook-configuration
136+
webhooks:
137+
${VALIDATING_WEBHOOKS}
138+
EOF_CAT
139+
140+
}
21141

22142
for BUNDLE in $(hack/pin-bundle-images.sh | tr "," " "); do
23143
skopeo copy "docker://$BUNDLE" dir:${EXTRACT_DIR}/tmp;
@@ -30,13 +150,17 @@ grep -l CustomResourceDefinition manifests/* | xargs -I % sh -c 'cp % ./crds/'
30150

31151
# extract role, clusterRole, and deployment from CSV's
32152
for X in $(ls manifests/*clusterserviceversion.yaml); do
33-
echo $OPERATOR_NAME
34153
OPERATOR_NAME=$(echo $X | sed -e "s|manifests\/\([^\.]*\)\..*|\1|")
154+
echo $OPERATOR_NAME
35155
LEADER_ELECTION_ROLE_RULES=$(cat $X | yq -r .spec.install.spec.permissions | sed -e 's|- rules:|rules:|' | sed -e 's| ||' | sed -e '/ serviceAccountName.*/d'
36156
)
37157
CLUSTER_ROLE_RULES=$(cat $X | yq -r .spec.install.spec.clusterPermissions| sed -e 's|- rules:|rules:|' | sed -e 's| ||' | sed -e '/ serviceAccountName.*/d'
38158
)
39159

160+
if [[ "$OPERATOR_NAME" == "infra-operator" ]]; then
161+
write_webhooks "$X" "$OPERATOR_NAME"
162+
fi
163+
40164
mkdir -p rbac
41165
cat > rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
42166
# NOTE: this file is automatically generated by hack/sync-bindata.sh!

0 commit comments

Comments
 (0)