Skip to content

Commit 468d1f6

Browse files
awgreeneawgreene
committed
OLM Support for Admission Webhooks
This commit introduces OLM support for validating and mutating admission webhooks by updating the ClusterServiceVersion CRD to include a WebhooksDefinitions array. In the current iteration, OLM supports cycling the CA Certs required for webhooks.
1 parent bde5fe7 commit 468d1f6

23 files changed

+2649
-809
lines changed

‎deploy/chart/crds/0000_50_olm_03-clusterserviceversion.crd.yaml

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8310,6 +8310,148 @@ spec:
83108310
description: OperatorVersion is a wrapper around semver.Version which
83118311
supports correct marshaling to YAML and JSON.
83128312
type: string
8313+
webhookdefinitions:
8314+
type: array
8315+
items:
8316+
description: WebhookDescription provides details to OLM about required
8317+
webhooks
8318+
type: object
8319+
required:
8320+
- admissionReviewVersions
8321+
- name
8322+
- sideEffects
8323+
- type
8324+
properties:
8325+
admissionReviewVersions:
8326+
type: array
8327+
items:
8328+
type: string
8329+
containerPort:
8330+
type: integer
8331+
format: int32
8332+
deploymentName:
8333+
type: string
8334+
failurePolicy:
8335+
type: string
8336+
matchPolicy:
8337+
description: MatchPolicyType specifies the type of match policy
8338+
type: string
8339+
name:
8340+
type: string
8341+
objectSelector:
8342+
description: A label selector is a label query over a set of resources.
8343+
The result of matchLabels and matchExpressions are ANDed. An
8344+
empty label selector matches all objects. A null label selector
8345+
matches no objects.
8346+
type: object
8347+
properties:
8348+
matchExpressions:
8349+
description: matchExpressions is a list of label selector
8350+
requirements. The requirements are ANDed.
8351+
type: array
8352+
items:
8353+
description: A label selector requirement is a selector
8354+
that contains values, a key, and an operator that relates
8355+
the key and values.
8356+
type: object
8357+
required:
8358+
- key
8359+
- operator
8360+
properties:
8361+
key:
8362+
description: key is the label key that the selector
8363+
applies to.
8364+
type: string
8365+
operator:
8366+
description: operator represents a key's relationship
8367+
to a set of values. Valid operators are In, NotIn,
8368+
Exists and DoesNotExist.
8369+
type: string
8370+
values:
8371+
description: values is an array of string values. If
8372+
the operator is In or NotIn, the values array must
8373+
be non-empty. If the operator is Exists or DoesNotExist,
8374+
the values array must be empty. This array is replaced
8375+
during a strategic merge patch.
8376+
type: array
8377+
items:
8378+
type: string
8379+
matchLabels:
8380+
description: matchLabels is a map of {key,value} pairs. A
8381+
single {key,value} in the matchLabels map is equivalent
8382+
to an element of matchExpressions, whose key field is "key",
8383+
the operator is "In", and the values array contains only
8384+
"value". The requirements are ANDed.
8385+
type: object
8386+
additionalProperties:
8387+
type: string
8388+
reinvocationPolicy:
8389+
description: ReinvocationPolicyType specifies what type of policy
8390+
the admission hook uses.
8391+
type: string
8392+
rules:
8393+
type: array
8394+
items:
8395+
description: RuleWithOperations is a tuple of Operations and
8396+
Resources. It is recommended to make sure that all the tuple
8397+
expansions are valid.
8398+
type: object
8399+
properties:
8400+
apiGroups:
8401+
description: APIGroups is the API groups the resources belong
8402+
to. '*' is all groups. If '*' is present, the length of
8403+
the slice must be one. Required.
8404+
type: array
8405+
items:
8406+
type: string
8407+
apiVersions:
8408+
description: APIVersions is the API versions the resources
8409+
belong to. '*' is all versions. If '*' is present, the
8410+
length of the slice must be one. Required.
8411+
type: array
8412+
items:
8413+
type: string
8414+
operations:
8415+
description: Operations is the operations the admission
8416+
hook cares about - CREATE, UPDATE, or * for all operations.
8417+
If '*' is present, the length of the slice must be one.
8418+
Required.
8419+
type: array
8420+
items:
8421+
type: string
8422+
resources:
8423+
description: "Resources is a list of resources this rule
8424+
applies to. \n For example: 'pods' means pods. 'pods/log'
8425+
means the log subresource of pods. '*' means all resources,
8426+
but not subresources. 'pods/*' means all subresources
8427+
of pods. '*/scale' means all scale subresources. '*/*'
8428+
means all resources and their subresources. \n If wildcard
8429+
is present, the validation rule will ensure resources
8430+
do not overlap with each other. \n Depending on the enclosing
8431+
object, subresources might not be allowed. Required."
8432+
type: array
8433+
items:
8434+
type: string
8435+
scope:
8436+
description: scope specifies the scope of this rule. Valid
8437+
values are "Cluster", "Namespaced", and "*" "Cluster"
8438+
means that only cluster-scoped resources will match this
8439+
rule. Namespace API objects are cluster-scoped. "Namespaced"
8440+
means that only namespaced resources will match this rule.
8441+
"*" means that there are no scope restrictions. Subresources
8442+
match the scope of their parent resource. Default is "*".
8443+
type: string
8444+
sideEffects:
8445+
type: string
8446+
timeoutSeconds:
8447+
type: integer
8448+
format: int32
8449+
type:
8450+
description: WebhookAdmissionType is the type of admission webhooks
8451+
supported by OLM
8452+
type: string
8453+
webhookPath:
8454+
type: string
83138455
status:
83148456
description: ClusterServiceVersionStatus represents information about the
83158457
status of a pod. Status may trail the actual state of a system.

‎deploy/chart/crds/0000_50_olm_04-installplan.crd.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,7 @@ spec:
140140
type: object
141141
required:
142142
- catalogSourceRef
143+
- identifier
143144
- path
144145
- replaces
145146
properties:
@@ -212,6 +213,10 @@ spec:
212213
type:
213214
description: Type of condition.
214215
type: string
216+
identifier:
217+
description: Identifier is the catalog-unique name of the operator
218+
(the name of the CSV for bundles that contain CSVs)
219+
type: string
215220
path:
216221
description: Path refers to the location of a bundle to pull.
217222
It's typically an image reference.

‎deploy/chart/crds/0000_50_olm_06-catalogsource.crd.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,10 @@ spec:
168168
format: date-time
169169
message:
170170
description: A human readable message indicating details about why the
171-
ClusterServiceVersion is in this condition.
171+
CatalogSource is in this condition.
172172
type: string
173173
reason:
174-
description: Reason is the reason the Subscription was transitioned
174+
description: Reason is the reason the CatalogSource was transitioned
175175
to its current state.
176176
type: string
177177
registryService:

0 commit comments

Comments
 (0)