Skip to content

Commit 20393ad

Browse files
maiquebmaiqueb
authored
Merge pull request #3 from maiqueb/add-webhook
admission: add ipam-claim-reference to pod network selection elements
2 parents 7d665c1 + 3c07500 commit 20393ad

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+4809
-17
lines changed

‎.golangci.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ issues:
1616
linters:
1717
- dupl
1818
- lll
19+
- linters:
20+
- lll
21+
source: "^// \\+kubebuilder"
1922
linters:
2023
disable-all: true
2124
enable:

‎Makefile

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ help: ## Display this help.
4444

4545
##@ Development
4646

47+
.PHONY: manifests
48+
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
49+
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
50+
51+
.PHONY: generate
52+
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
53+
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
54+
4755
.PHONY: fmt
4856
fmt: ## Run go fmt against code.
4957
go fmt ./...
@@ -53,7 +61,7 @@ vet: ## Run go vet against code.
5361
go vet ./...
5462

5563
.PHONY: test
56-
test: fmt vet envtest ## Run tests.
64+
test: manifests generate fmt vet envtest ## Run tests.
5765
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out -v -ginkgo.v
5866

5967
# Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
@@ -72,11 +80,11 @@ lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
7280
##@ Build
7381

7482
.PHONY: build
75-
build: fmt vet ## Build manager binary.
83+
build: manifests generate fmt vet ## Build manager binary.
7684
go build -o bin/manager cmd/main.go
7785

7886
.PHONY: run
79-
run: fmt vet ## Run a controller from your host.
87+
run: manifests generate fmt vet ## Run a controller from your host.
8088
go run ./cmd/main.go
8189

8290
# If you wish to build the manager image targeting other platforms you can use the --platform flag.
@@ -108,7 +116,7 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
108116
rm Dockerfile.cross
109117

110118
.PHONY: build-installer
111-
build-installer: kustomize ## Generate a consolidated YAML with CRDs and deployment.
119+
build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
112120
mkdir -p dist
113121
@if [ -d "config/crd" ]; then \
114122
$(KUSTOMIZE) build config/crd > dist/install.yaml; \
@@ -124,15 +132,15 @@ ifndef ignore-not-found
124132
endif
125133

126134
.PHONY: install
127-
install: kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
135+
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
128136
$(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f -
129137

130138
.PHONY: uninstall
131-
uninstall: kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
139+
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
132140
$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
133141

134142
.PHONY: deploy
135-
deploy: kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
143+
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
136144
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
137145
$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -
138146

‎cmd/main.go

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,30 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

2324
// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
2425
// to ensure that exec-entrypoint and run can make use of them.
2526
_ "k8s.io/client-go/plugin/pkg/client/auth"
2627

28+
corev1 "k8s.io/api/core/v1"
2729
"k8s.io/apimachinery/pkg/runtime"
2830
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
2931
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3032

3133
ctrl "sigs.k8s.io/controller-runtime"
3234
"sigs.k8s.io/controller-runtime/pkg/healthz"
3335
"sigs.k8s.io/controller-runtime/pkg/log/zap"
36+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3437

3538
virtv1 "kubevirt.io/api/core/v1"
3639

3740
ipamclaimsapi "github.com/k8snetworkplumbingwg/ipamclaims/pkg/crd/ipamclaims/v1alpha1"
3841
nadv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1"
3942

43+
"github.com/maiqueb/kubevirt-ipam-claims/pkg/ipamclaimswebhook"
4044
"github.com/maiqueb/kubevirt-ipam-claims/pkg/vmnetworkscontroller"
4145
//+kubebuilder:scaffold:imports
4246
)
@@ -73,11 +77,32 @@ func main() {
7377

7478
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
7579

80+
// if the enable-http2 flag is false (the default), http/2 should be disabled
81+
// due to its vulnerabilities. More specifically, disabling http/2 will
82+
// prevent from being vulnerable to the HTTP/2 Stream Cancelation and
83+
// Rapid Reset CVEs. For more information see:
84+
// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
85+
// - https://github.com/advisories/GHSA-4374-p667-p6c8
86+
disableHTTP2 := func(c *tls.Config) {
87+
setupLog.Info("disabling http/2")
88+
c.NextProtos = []string{"http/1.1"}
89+
}
90+
91+
tlsOpts := []func(*tls.Config){}
92+
if !enableHTTP2 {
93+
tlsOpts = append(tlsOpts, disableHTTP2)
94+
}
95+
96+
webhookServer := webhook.NewServer(webhook.Options{
97+
TLSOpts: tlsOpts,
98+
})
99+
76100
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
77101
Scheme: scheme,
78102
HealthProbeBindAddress: probeAddr,
79103
LeaderElection: enableLeaderElection,
80104
LeaderElectionID: "71d89df3",
105+
WebhookServer: webhookServer,
81106
// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
82107
// when the Manager ends. This requires the binary to immediately end when the
83108
// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
@@ -111,6 +136,15 @@ func main() {
111136
os.Exit(1)
112137
}
113138

139+
if err := ctrl.NewWebhookManagedBy(mgr).For(&corev1.Pod{}).Complete(); err != nil {
140+
setupLog.Error(err, "unable to create webhook controller", "controller", "Pod")
141+
}
142+
143+
mgr.GetWebhookServer().Register(
144+
"/mutate-v1-pod",
145+
&webhook.Admission{Handler: ipamclaimswebhook.NewIPAMClaimsValet(mgr)},
146+
)
147+
114148
setupLog.Info("starting manager")
115149
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
116150
setupLog.Error(err, "problem running manager")

‎config/certmanager/certificate.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: certificate
9+
app.kubernetes.io/instance: serving-cert
10+
app.kubernetes.io/component: certificate
11+
app.kubernetes.io/created-by: kubevirt-ipam-claims
12+
app.kubernetes.io/part-of: kubevirt-ipam-claims
13+
app.kubernetes.io/managed-by: kustomize
14+
name: selfsigned-issuer
15+
namespace: kubevirt-ipam-claims-system
16+
spec:
17+
selfSigned: {}
18+
---
19+
apiVersion: cert-manager.io/v1
20+
kind: Certificate
21+
metadata:
22+
labels:
23+
app.kubernetes.io/name: certificate
24+
app.kubernetes.io/instance: serving-cert
25+
app.kubernetes.io/component: certificate
26+
app.kubernetes.io/created-by: kubevirt-ipam-claims
27+
app.kubernetes.io/part-of: kubevirt-ipam-claims
28+
app.kubernetes.io/managed-by: kustomize
29+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
30+
namespace: kubevirt-ipam-claims-system
31+
spec:
32+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
33+
dnsNames:
34+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
35+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
36+
issuerRef:
37+
kind: Issuer
38+
name: selfsigned-issuer
39+
secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

‎config/certmanager/kustomization.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resources:
2+
- certificate.yaml
3+
4+
configurations:
5+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This configuration is for teaching kustomize how to update name ref substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name

‎config/default/kustomization.yaml

Lines changed: 109 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,115 @@ namespace: kubevirt-ipam-claims-system
88
# field above.
99
namePrefix: kubevirt-ipam-claims-
1010

11+
labels:
12+
- includeSelectors: true
13+
pairs:
14+
app: ipam-virt-workloads
15+
1116
resources:
12-
#- ../crd
1317
- ../rbac
1418
- ../manager
19+
- ../webhook
20+
- ../certmanager
21+
22+
patches:
23+
- path: manager_webhook_patch.yaml
24+
- path: webhookcainjection_patch.yaml
25+
26+
replacements:
27+
- source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
28+
kind: Certificate
29+
group: cert-manager.io
30+
version: v1
31+
name: serving-cert # this name should match the one in certificate.yaml
32+
fieldPath: .metadata.namespace # namespace of the certificate CR
33+
targets:
34+
- select:
35+
kind: ValidatingWebhookConfiguration
36+
fieldPaths:
37+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
38+
options:
39+
delimiter: '/'
40+
index: 0
41+
create: true
42+
- select:
43+
kind: MutatingWebhookConfiguration
44+
fieldPaths:
45+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
46+
options:
47+
delimiter: '/'
48+
index: 0
49+
create: true
50+
- select:
51+
kind: CustomResourceDefinition
52+
fieldPaths:
53+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
54+
options:
55+
delimiter: '/'
56+
index: 0
57+
create: true
58+
- source:
59+
kind: Certificate
60+
group: cert-manager.io
61+
version: v1
62+
name: serving-cert # this name should match the one in certificate.yaml
63+
fieldPath: .metadata.name
64+
targets:
65+
- select:
66+
kind: ValidatingWebhookConfiguration
67+
fieldPaths:
68+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
69+
options:
70+
delimiter: '/'
71+
index: 1
72+
create: true
73+
- select:
74+
kind: MutatingWebhookConfiguration
75+
fieldPaths:
76+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
77+
options:
78+
delimiter: '/'
79+
index: 1
80+
create: true
81+
- select:
82+
kind: CustomResourceDefinition
83+
fieldPaths:
84+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
85+
options:
86+
delimiter: '/'
87+
index: 1
88+
create: true
89+
- source: # Add cert-manager annotation to the webhook Service
90+
kind: Service
91+
version: v1
92+
name: webhook-service
93+
fieldPath: .metadata.name # namespace of the service
94+
targets:
95+
- select:
96+
kind: Certificate
97+
group: cert-manager.io
98+
version: v1
99+
fieldPaths:
100+
- .spec.dnsNames.0
101+
- .spec.dnsNames.1
102+
options:
103+
delimiter: '.'
104+
index: 0
105+
create: true
106+
- source:
107+
kind: Service
108+
version: v1
109+
name: webhook-service
110+
fieldPath: .metadata.namespace # namespace of the service
111+
targets:
112+
- select:
113+
kind: Certificate
114+
group: cert-manager.io
115+
version: v1
116+
fieldPaths:
117+
- .spec.dnsNames.0
118+
- .spec.dnsNames.1
119+
options:
120+
delimiter: '.'
121+
index: 1
122+
create: true

‎config/default/manager_webhook_patch.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager
11+
ports:
12+
- containerPort: 9443
13+
name: webhook-server
14+
protocol: TCP
15+
volumeMounts:
16+
- mountPath: /tmp/k8s-webhook-server/serving-certs
17+
name: cert
18+
readOnly: true
19+
volumes:
20+
- name: cert
21+
secret:
22+
defaultMode: 420
23+
secretName: webhook-server-cert

‎config/default/webhookcainjection_patch.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# This patch add annotation to admission webhook config and
2+
# CERTIFICATE_NAMESPACE and CERTIFICATE_NAME will be substituted by kustomize
3+
apiVersion: admissionregistration.k8s.io/v1
4+
kind: MutatingWebhookConfiguration
5+
metadata:
6+
labels:
7+
app.kubernetes.io/name: mutatingwebhookconfiguration
8+
app.kubernetes.io/instance: mutating-webhook-configuration
9+
app.kubernetes.io/component: webhook
10+
app.kubernetes.io/created-by: kubevirt-ipam-claims
11+
app.kubernetes.io/part-of: kubevirt-ipam-claims
12+
app.kubernetes.io/managed-by: kustomize
13+
name: mutating-webhook-configuration
14+
namespace: kubevirt-ipam-claims-system
15+
annotations:
16+
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME

‎config/webhook/kustomization.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resources:
2+
- manifests.yaml
3+
- service.yaml
4+
5+
configurations:
6+
- kustomizeconfig.yaml

0 commit comments

Comments
 (0)