@@ -15,15 +15,15 @@ deploy it as a sidecar container alongside your operator. This allows you to mak
15
15
server that the operator deploys, as well as the cache that backs it. The sidecar will be defined in the ` deploy/operator.yaml ` and it will look like:
16
16
17
17
``` yaml
18
- # This deploys the webhook
19
- - name : webhook
20
- # Replace this with the built image name
21
- image : " REPLACE_WEBHOOK_IMAGE"
22
- imagePullPolicy : " Always"
23
- volumeMounts :
24
- - mountPath : /etc/tls/
25
- name : webhook-cert
26
- ...
18
+ # This deploys the webhook
19
+ - name : webhook
20
+ # Replace this with the built image name
21
+ image : " REPLACE_WEBHOOK_IMAGE"
22
+ imagePullPolicy : " Always"
23
+ volumeMounts :
24
+ - mountPath : /etc/tls/
25
+ name : webhook-cert
26
+ ` ` `
27
27
28
28
## Ensuring the webhook server uses the caching proxy
29
29
@@ -41,43 +41,43 @@ as your webhook server is required to have a valid SSL configuration. Below is a
41
41
specification that deploys a webhook :
42
42
43
43
` ` ` yaml
44
- containers:
45
- - name: my-operator
46
- # Replace this with the built image name
47
- image: "REPLACE_IMAGE"
48
- imagePullPolicy: "Always"
49
- volumeMounts:
50
- - mountPath: /tmp/ansible-operator/runner
51
- name: runner
52
- env:
53
- - name: WATCH_NAMESPACE
54
- valueFrom:
55
- fieldRef:
56
- fieldPath: metadata.namespace
57
- - name: POD_NAME
58
- valueFrom:
59
- fieldRef:
60
- fieldPath: metadata.name
61
- - name: OPERATOR_NAME
62
- value: "validating-operator"
63
- - name: ANSIBLE_GATHERING
64
- value: explicit
65
- # This deploys the webhook
66
- - name: webhook
67
- # Replace this with the built image name
68
- image: "REPLACE_WEBHOOK_IMAGE"
69
- imagePullPolicy: "Always"
70
- volumeMounts:
71
- - mountPath: /etc/tls/
72
- name: webhook-cert
73
- volumes:
74
- - name: runner
75
- emptyDir: {}
76
- # This assumes there is a secret called webhook-cert containing TLS certificates
77
- # Projects like cert-manager can create these certificates
78
- - name: webhook-cert
79
- secret:
80
- secretName: webhook-cert
44
+ containers:
45
+ - name: my-operator
46
+ # Replace this with the built image name
47
+ image: "REPLACE_IMAGE"
48
+ imagePullPolicy: "Always"
49
+ volumeMounts:
50
+ - mountPath: /tmp/ansible-operator/runner
51
+ name: runner
52
+ env:
53
+ - name: WATCH_NAMESPACE
54
+ valueFrom:
55
+ fieldRef:
56
+ fieldPath: metadata.namespace
57
+ - name: POD_NAME
58
+ valueFrom:
59
+ fieldRef:
60
+ fieldPath: metadata.name
61
+ - name: OPERATOR_NAME
62
+ value: "validating-operator"
63
+ - name: ANSIBLE_GATHERING
64
+ value: explicit
65
+ # This deploys the webhook
66
+ - name: webhook
67
+ # Replace this with the built image name
68
+ image: "REPLACE_WEBHOOK_IMAGE"
69
+ imagePullPolicy: "Always"
70
+ volumeMounts:
71
+ - mountPath: /etc/tls/
72
+ name: webhook-cert
73
+ volumes:
74
+ - name: runner
75
+ emptyDir: {}
76
+ # This assumes there is a secret called webhook-cert containing TLS certificates
77
+ # Projects like cert-manager can create these certificates
78
+ - name: webhook-cert
79
+ secret:
80
+ secretName: webhook-cert
81
81
` ` `
82
82
83
83
This will run your webhook server alongside the operator, but Kubernetes will not yet call the webhooks before
@@ -168,7 +168,7 @@ incoming resources before they are written to the Kubernetes database.
168
168
169
169
# # Summary
170
170
171
- To deploy an existing admissions webhook to validate or mutate your Kubernetes resources alongside an
171
+ To deploy an existing admissions webhook to validate or mutate your Kubernetes resources alongside an
172
172
Ansible-based Operator, you must
173
173
1. Configure your admissions webhook to use the proxy server running on `http://localhost:8888` in the operator pod
174
174
1. Add the webhook container to your operator deployment
@@ -178,5 +178,5 @@ Ansible-based Operator, you must
178
178
179
179
180
180
[admission-controllers]:https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/
181
- [validating-webhook]:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#validatingwebhookconfiguration-v1-admissionregistration-k8s-io
182
- [mutating-webhook]:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#mutatingwebhookconfiguration-v1-admissionregistration-k8s-io
181
+ [validating-webhook]:https://v1-17.docs. kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#validatingwebhookconfiguration-v1-admissionregistration-k8s-io
182
+ [mutating-webhook]:https://v1-17.docs. kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#mutatingwebhookconfiguration-v1-admissionregistration-k8s-io
0 commit comments