-
Notifications
You must be signed in to change notification settings - Fork 593
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore(config) use a patch to add Secret hooks
Split the webhook manifest into the generated manifest and additional rule patches. Kubebuilder limitations require writing your own rules to use objectSelectors. Remove the kubebuilder Secret hook generation directive and document the workaround. Refactor the envtest runner to build a webhook manifest via Kustomize, rather than reading a static manifest.
- Loading branch information
Showing
6 changed files
with
76 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,58 @@ | ||
# https://github.com/kubernetes-sigs/controller-tools/issues/553 | ||
# controller-tools, and by extension kubebuilder, do not support specifying objectSelector, | ||
# which we need for the Secret rules. | ||
apiVersion: admissionregistration.k8s.io/v1 | ||
kind: ValidatingWebhookConfiguration | ||
metadata: | ||
name: validating-webhook-configuration | ||
webhooks: | ||
- admissionReviewVersions: | ||
- v1 | ||
clientConfig: | ||
service: | ||
name: webhook-service | ||
namespace: system | ||
path: / | ||
failurePolicy: Fail | ||
matchPolicy: Equivalent | ||
name: secrets.credentials.validation.ingress-controller.konghq.com | ||
objectSelector: | ||
matchExpressions: | ||
- key: "konghq.com/credential" | ||
operator: "Exists" | ||
rules: | ||
- apiGroups: | ||
- "" | ||
apiVersions: | ||
- v1 | ||
operations: | ||
- CREATE | ||
- UPDATE | ||
resources: | ||
- secrets | ||
sideEffects: None | ||
- admissionReviewVersions: | ||
- v1 | ||
clientConfig: | ||
service: | ||
name: webhook-service | ||
namespace: system | ||
path: / | ||
failurePolicy: Fail | ||
matchPolicy: Equivalent | ||
name: secrets.plugins.validation.ingress-controller.konghq.com | ||
objectSelector: | ||
matchExpressions: | ||
- key: "konghq.com/validate" | ||
operator: "Exists" | ||
rules: | ||
- apiGroups: | ||
- "" | ||
apiVersions: | ||
- v1 | ||
operations: | ||
- CREATE | ||
- UPDATE | ||
resources: | ||
- secrets | ||
sideEffects: None |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
apiVersion: kustomize.config.k8s.io/v1beta1 | ||
kind: Kustomization | ||
resources: | ||
- manifests.yaml | ||
|
||
patchesStrategicMerge: | ||
- additional_secret_hooks.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79a43bc
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possible performance regression was detected for benchmark 'Go Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold
2
.BenchmarkListHTTPRoutes/100
10662
ns/op 2688 B/op 2 allocs/op3433
ns/op 2688 B/op 2 allocs/op3.11
BenchmarkListHTTPRoutes/100 - ns/op
10662
ns/op3433
ns/op3.11
This comment was automatically generated by workflow using github-action-benchmark.
CC: @Kong/k8s-maintainers
79a43bc
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possible performance regression was detected for benchmark 'Go Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold
2
.BenchmarkListHTTPRoutes/100
8972
ns/op 2688 B/op 2 allocs/op3331
ns/op 2688 B/op 2 allocs/op2.69
BenchmarkListHTTPRoutes/100 - ns/op
8972
ns/op3331
ns/op2.69
This comment was automatically generated by workflow using github-action-benchmark.
CC: @Kong/k8s-maintainers
79a43bc
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possible performance regression was detected for benchmark 'Go Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold
2
.BenchmarkListHTTPRoutes/100
9603
ns/op 2688 B/op 2 allocs/op3285
ns/op 2688 B/op 2 allocs/op2.92
BenchmarkListHTTPRoutes/100 - ns/op
9603
ns/op3285
ns/op2.92
This comment was automatically generated by workflow using github-action-benchmark.
CC: @Kong/k8s-maintainers