Skip to content

Commit 562998c

Browse files
camilamacedo86camilamacedo86
committed
Replace WebhookProviderCertManager and WebhookProviderOpenshiftServiceCA with flag certificate-provider
1 parent efaa1b9 commit 562998c

File tree

6 files changed

+34
-46
lines changed

6 files changed

+34
-46
lines changed

‎Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,6 @@ update-crds:
152152
#
153153
# Override HELM_SETTINGS on the command line to include additional Helm settings
154154
# e.g. make HELM_SETTINGS="options.openshift.enabled=true" manifests
155-
# e.g. make HELM_SETTINGS="operatorControllerFeatures={WebhookProviderCertManager}" manifests
156155
#
157156
MANIFESTS ?= $(STANDARD_MANIFEST) $(STANDARD_E2E_MANIFEST) $(EXPERIMENTAL_MANIFEST) $(EXPERIMENTAL_E2E_MANIFEST)
158157
$(STANDARD_MANIFEST) ?= helm/cert-manager.yaml

‎cmd/operator-controller/main.go‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,14 @@ type config struct {
105105
catalogdCasDir string
106106
pullCasDir string
107107
globalPullSecret string
108+
certificateProvider string
108109
}
109110

110111
const (
111-
authFilePrefix = "operator-controller-global-pull-secrets"
112-
fieldOwnerPrefix = "olm.operatorframework.io"
112+
authFilePrefix = "operator-controller-global-pull-secrets"
113+
fieldOwnerPrefix = "olm.operatorframework.io"
114+
certificateProviderCertManager = "cert-manager"
115+
certificateProviderOpenshiftCA = "openshift-serviceca"
113116
)
114117

115118
// podNamespace checks whether the controller is running in a Pod vs.
@@ -159,6 +162,7 @@ func init() {
159162
flags.StringVar(&cfg.cachePath, "cache-path", "/var/cache", "The local directory path used for filesystem based caching")
160163
flags.StringVar(&cfg.systemNamespace, "system-namespace", "", "Configures the namespace that gets used to deploy system resources.")
161164
flags.StringVar(&cfg.globalPullSecret, "global-pull-secret", "", "The <namespace>/<name> of the global pull secret that is going to be used to pull bundle images.")
165+
flags.StringVar(&cfg.certificateProvider, "certificate-provider", certificateProviderCertManager, "The certificate provider to use for webhook support. Options: 'cert-manager' (default) or 'openshift-serviceca'.")
162166

163167
//adds version sub command
164168
operatorControllerCmd.AddCommand(versionCommand)
@@ -451,7 +455,11 @@ func run() error {
451455
return err
452456
}
453457

454-
certProvider := getCertificateProvider()
458+
certProvider, err := getCertificateProvider()
459+
if err != nil {
460+
setupLog.Error(err, "invalid certificate provider configuration")
461+
return err
462+
}
455463
regv1ManifestProvider := &applier.RegistryV1ManifestProvider{
456464
BundleRenderer: registryv1.Renderer,
457465
CertificateProvider: certProvider,
@@ -514,13 +522,14 @@ func run() error {
514522
return nil
515523
}
516524

517-
func getCertificateProvider() render.CertificateProvider {
518-
if features.OperatorControllerFeatureGate.Enabled(features.WebhookProviderCertManager) {
519-
return certproviders.CertManagerCertificateProvider{}
520-
} else if features.OperatorControllerFeatureGate.Enabled(features.WebhookProviderOpenshiftServiceCA) {
521-
return certproviders.OpenshiftServiceCaCertificateProvider{}
525+
func getCertificateProvider() (render.CertificateProvider, error) {
526+
switch strings.ToLower(cfg.certificateProvider) {
527+
case "", certificateProviderCertManager:
528+
return certproviders.CertManagerCertificateProvider{}, nil
529+
case certificateProviderOpenshiftCA:
530+
return certproviders.OpenshiftServiceCaCertificateProvider{}, nil
522531
}
523-
return nil
532+
return nil, fmt.Errorf("unsupported certificate provider %q", cfg.certificateProvider)
524533
}
525534

526535
func setupBoxcutter(

‎docs/draft/howto/enable-webhook-support.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
## Installation of Bundles containing Webhooks
22

33
!!! note
4-
Webhook support is enabled by default. The controller uses the `WebhookProviderCertManager`
5-
feature-gate unless you override it. To switch to the OpenShift Service CA provider,
6-
start the controller with `--feature-gates=WebhookProviderCertManager=false`.
4+
Webhook support is enabled by default. The controller uses the `cert-manager`
5+
certificate provider unless you override it. To switch to the OpenShift Service CA provider,
6+
start the controller with `--certificate-provider=openshift-serviceca`.
77

88
OLMv1 supports the installation of bundles containing webhooks by default.
99
Webhooks, or more concretely Admission Webhooks, are part of Kuberntes' [Dynamic Admission Control](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/)
1010
feature. Webhooks run as services called by the kube-apiservice in due course of processing a resource related request. They can be used to validate resources, ensure reasonable default values,
1111
are set, or aid in the migration to new CustomResourceDefinition schema. The communication with the webhook service is secured by TLS. In OLMv1, the TLS certificate is managed by a
12-
certificate provider. Currently, two certificate providers are supported: CertManager and Openshift-ServiceCA. The certificate provider to use given by the feature-gate:
12+
certificate provider. Currently, two certificate providers are supported: CertManager and Openshift-ServiceCA. The controller selects the provider via the `--certificate-provider` flag:
1313

14-
- `WebhookProviderCertManager` for [CertManager](https://cert-manager.io/)
15-
- `WebhookProviderOpenshiftServiceCA` for [Openshift-ServiceCA](https://github.com/openshift/service-ca-operator)
14+
- `cert-manager` for [CertManager](https://cert-manager.io/) (default)
15+
- `openshift-serviceca` for [Openshift-ServiceCA](https://github.com/openshift/service-ca-operator)
1616

17-
As CertManager is already installed with OLMv1, we suggest using `WebhookProviderCertManager`.
17+
As CertManager is already installed with OLMv1, we suggest staying with the default `cert-manager` provider.
1818

1919
### Run OLM v1 with Webhook Support
2020

‎hack/demo/webhook-provider-certmanager-demo-script.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@
55
#
66
trap "trap - SIGTERM && kill -- -$$" SIGINT SIGTERM EXIT
77

8-
# enable 'WebhookProviderCertManager' feature
9-
kubectl kustomize config/overlays/featuregate/webhook-provider-certmanager | kubectl apply -f -
8+
# Cert-manager is the default certificate provider, so no additional configuration is required.
109

1110
# wait for operator-controller to become available
1211
kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager

‎helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ spec:
4444
{{- if not .Values.options.tilt.enabled }}
4545
- --leader-elect
4646
{{- end }}
47+
{{- if .Values.options.openshift.enabled }}
48+
- --certificate-provider=openshift-serviceca
49+
{{- end }}
4750
{{- range .Values.operatorControllerFeatures }}
4851
- --feature-gates={{- . -}}=true
4952
{{- end }}

‎internal/operator-controller/features/features.go‎

Lines changed: 5 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,11 @@ import (
1111
const (
1212
// Add new feature gates constants (strings)
1313
// Ex: SomeFeature featuregate.Feature = "SomeFeature"
14-
PreflightPermissions featuregate.Feature = "PreflightPermissions"
15-
SingleOwnNamespaceInstallSupport featuregate.Feature = "SingleOwnNamespaceInstallSupport"
16-
SyntheticPermissions featuregate.Feature = "SyntheticPermissions"
17-
WebhookProviderCertManager featuregate.Feature = "WebhookProviderCertManager"
18-
WebhookProviderOpenshiftServiceCA featuregate.Feature = "WebhookProviderOpenshiftServiceCA"
19-
HelmChartSupport featuregate.Feature = "HelmChartSupport"
20-
BoxcutterRuntime featuregate.Feature = "BoxcutterRuntime"
14+
PreflightPermissions featuregate.Feature = "PreflightPermissions"
15+
SingleOwnNamespaceInstallSupport featuregate.Feature = "SingleOwnNamespaceInstallSupport"
16+
SyntheticPermissions featuregate.Feature = "SyntheticPermissions"
17+
HelmChartSupport featuregate.Feature = "HelmChartSupport"
18+
BoxcutterRuntime featuregate.Feature = "BoxcutterRuntime"
2119
)
2220

2321
var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
@@ -46,26 +44,6 @@ var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.Feature
4644
LockToDefault: false,
4745
},
4846

49-
// WebhookProviderCertManager enables support for installing
50-
// registry+v1 cluster extensions that include validating,
51-
// mutating, and/or conversion webhooks with CertManager
52-
// as the certificate provider.
53-
WebhookProviderCertManager: {
54-
Default: true,
55-
PreRelease: featuregate.GA,
56-
LockToDefault: false,
57-
},
58-
59-
// WebhookProviderCertManager enables support for installing
60-
// registry+v1 cluster extensions that include validating,
61-
// mutating, and/or conversion webhooks with Openshift Service CA
62-
// as the certificate provider.
63-
WebhookProviderOpenshiftServiceCA: {
64-
Default: true,
65-
PreRelease: featuregate.GA,
66-
LockToDefault: false,
67-
},
68-
6947
// HelmChartSupport enables support for installing,
7048
// updating and uninstalling Helm Charts via Cluster Extensions.
7149
HelmChartSupport: {

0 commit comments

Comments
 (0)