This repository has been archived by the owner on Jun 26, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 172
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Integrate GK cert as the default internal cert
Fork the cert management from open-policy-agent/gatekeeper repo to serve as the default internal cert management for HNC. Add an "enable-internal-cert-management" flag to switch between using the internal cert (integrated Gatekeeper cert) or the external cert "cert-manager". Update main.go to start the controller manager with internal certs first and once the cert files are ready, add other controllers and webhooks if webhook is enabled and internal certs are used. Refactor the cert generation and validator startup into pkg/validators/setup.go. To use external cert-manager, update config/default/kustomization.yaml and manager_auth_proxy_patch.yaml as instructed. Run 'make deploy-cm' before 'make deploy'. Tested on a GKE cluster. The manager restarts 0 times and the webhooks are working as expected.
- Loading branch information
1 parent
e37728b
commit ba5c7da
Showing
14 changed files
with
1,066 additions
and
83 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| resources: | ||
| - manifests.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: webhook-server-cert | ||
| namespace: system |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| package validators | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "k8s.io/apimachinery/pkg/types" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook" | ||
|
|
||
| "github.com/kubernetes-sigs/multi-tenancy/incubator/hnc/pkg/forest" | ||
| cert "github.com/kubernetes-sigs/multi-tenancy/incubator/hnc/third_party/open-policy-agent/gatekeeper/pkg/webhook" | ||
| ) | ||
|
|
||
| const ( | ||
| serviceName = "hnc-webhook-service" | ||
| vwhName = "hnc-validating-webhook-configuration" | ||
| caName = "hnc-ca" | ||
| caOrganization = "hnc" | ||
| secretNamespace = "hnc-system" | ||
| secretName = "hnc-webhook-server-cert" | ||
| certDir = "/tmp/k8s-webhook-server/serving-certs" | ||
| ) | ||
|
|
||
| // DNSName is <service name>.<namespace>.svc | ||
| var dnsName = fmt.Sprintf("%s.%s.svc", serviceName, secretNamespace) | ||
|
|
||
| // CreateCertsIfNeeded creates all certs for webhooks. This function is called from main.go. | ||
| func CreateCertsIfNeeded(mgr ctrl.Manager, novalidation, internalCert bool) (chan struct{}, error) { | ||
| setupFinished := make(chan struct{}) | ||
| if novalidation || !internalCert { | ||
| close(setupFinished) | ||
| return setupFinished, nil | ||
| } | ||
|
|
||
| return setupFinished, cert.AddRotator(mgr, &cert.CertRotator{ | ||
| SecretKey: types.NamespacedName{ | ||
| Namespace: secretNamespace, | ||
| Name: secretName, | ||
| }, | ||
| CertDir: certDir, | ||
| CAName: caName, | ||
| CaOrganization: caOrganization, | ||
| DNSName: dnsName, | ||
| CertsMounted: setupFinished, | ||
| }, vwhName) | ||
| } | ||
|
|
||
| // Create creates all validators. This function is called from main.go. | ||
| func Create(mgr ctrl.Manager, f *forest.Forest) { | ||
| // Create webhook for Hierarchy | ||
| mgr.GetWebhookServer().Register(HierarchyServingPath, &webhook.Admission{Handler: &Hierarchy{ | ||
| Log: ctrl.Log.WithName("validators").WithName("Hierarchy"), | ||
| Forest: f, | ||
| }}) | ||
|
|
||
| // Create webhooks for managed objects | ||
| mgr.GetWebhookServer().Register(ObjectsServingPath, &webhook.Admission{Handler: &Object{ | ||
| Log: ctrl.Log.WithName("validators").WithName("Object"), | ||
| Forest: f, | ||
| }}) | ||
|
|
||
| // Create webhook for the config | ||
| mgr.GetWebhookServer().Register(ConfigServingPath, &webhook.Admission{Handler: &HNCConfig{ | ||
| Log: ctrl.Log.WithName("validators").WithName("HNCConfig"), | ||
| }}) | ||
|
|
||
| // Create webhook for the HierarchicalNamespaces. | ||
| mgr.GetWebhookServer().Register(HierarchicalNamespaceServingPath, &webhook.Admission{Handler: &HierarchicalNamespace{ | ||
| Log: ctrl.Log.WithName("validators").WithName("HierarchicalNamespace"), | ||
| Forest: f, | ||
| }}) | ||
|
|
||
| // Create webhook for the namespaces (core type). | ||
| mgr.GetWebhookServer().Register(NamespaceServingPath, &webhook.Admission{Handler: &Namespace{ | ||
| Log: ctrl.Log.WithName("validators").WithName("Namespace"), | ||
| Forest: f, | ||
| }}) | ||
| } |
Oops, something went wrong.