Single webhook per configuration entity

We've noticed an unexpected behavior in OpenShift: 1. ValidatingWebhookConfiguration or MutatingWebhookConfiguration is posted with a webhook 2. CA bundle is injected to the webhook 3. More webhooks are added to the configuration entity 4. Some of the webhooks (in our case it has always been the last one) does not get a CA bundle injected This is a workaround for this issue - avoid adding webhooks to an existing configuration entity by separating each webhook to a different configuration entity. Signed-off-by: Arik Hadas <[email protected]>
ahadas · Sep 21, 2023 · b343aec · b343aec
1 parent 5a6c62b
commit b343aec
Show file tree

Hide file tree

Showing 8 changed files with 227 additions and 147 deletions.
diff --git a/operator/roles/forkliftcontroller/tasks/main.yml b/operator/roles/forkliftcontroller/tasks/main.yml
@@ -125,16 +125,41 @@
       state: present
       definition: "{{ lookup('template', 'api/deployment-forklift-api.yml.j2') }}"
 
-  - name: "Setup api validating webhook configuration"
+  - name: "Delete aggregated validation webhook configurations"
     k8s:
-      state: present
+      state: absent
       definition: "{{ lookup('template', 'api/validatingwebhookconfiguration-forklift-api.yml.j2') }}"
 
-  - name: "Setup api mutating webhook configuration"
+  - name: "Setup secrets validating webhook configuration"
+    k8s:
+      state: present
+      definition: "{{ lookup('template', 'api/validatingwebhookconfiguration-secrets.yml.j2') }}"
+
+  - name: "Setup plans validating webhook configuration"
     k8s:
       state: present
+      definition: "{{ lookup('template', 'api/validatingwebhookconfiguration-plans.yml.j2') }}"
+
+  - name: "Setup providers validating webhook configuration"
+    k8s:
+      state: present
+      definition: "{{ lookup('template', 'api/validatingwebhookconfiguration-providers.yml.j2') }}"
+
+  - name: "Delete aggregated mutating webhook configurations"
+    k8s:
+      state: absent
       definition: "{{ lookup('template', 'api/mutatingwebhookconfiguration-forklift-api.yml.j2') }}"
 
+  - name: "Setup secrets mutating webhook configuration"
+    k8s:
+      state: present
+      definition: "{{ lookup('template', 'api/mutatingwebhookconfiguration-secrets.yml.j2') }}"
+
+  - name: "Setup plans mutating webhook configuration"
+    k8s:
+      state: present
+      definition: "{{ lookup('template', 'api/mutatingwebhookconfiguration-plans.yml.j2') }}"
+
   - name: "Setup default provider"
     k8s:
       state: present

diff --git a/...r/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-forklift-api.yml.j2 b/...r/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-forklift-api.yml.j2
@@ -1,67 +1,8 @@
+# Do not add webhooks to this file
+# This configuration has been deprecated
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   name: {{ api_deployment_name }}
   namespace: ""
-  annotations:
-{% if k8s_cluster|bool %}
-    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
-{% else %}
-    service.beta.openshift.io/inject-cabundle: "true"
-{% endif %}
-webhooks:
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: {{ api_service_name }}
-      namespace: {{ app_namespace }}
-      path: /secret-mutate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Equivalent
-  name: ca-mutatur.forklift.konveyor
-  namespaceSelector: {}
-  objectSelector: 
-    matchExpressions:
-    - key: createdForProviderType
-      operator: Exists
-  rules:
-  - apiGroups:
-    - ''
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - secrets
-    scope: Namespaced
-  sideEffects: None
-  timeoutSeconds: 30
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: {{ api_service_name }}
-      namespace: {{ app_namespace }}
-      path: /plan-mutate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Equivalent
-  name: plans.forklift.konveyor
-  namespaceSelector: {}
-  objectSelector: {}
-  rules:
-  - apiGroups:
-    - forklift.konveyor.io
-    resources:
-    - plans
-    apiVersions:
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-  sideEffects: None
-  timeoutSeconds: 30
diff --git a/operator/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-plans.yml.j2 b/operator/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-plans.yml.j2
@@ -0,0 +1,38 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ api_deployment_name }}-plans
+  namespace: ""
+  annotations:
+{% if k8s_cluster|bool %}
+    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
+{% else %}
+    service.beta.openshift.io/inject-cabundle: "true"
+{% endif %}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ api_service_name }}
+      namespace: {{ app_namespace }}
+      path: /plan-mutate
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: plans.forklift.konveyor
+  namespaceSelector: {}
+  objectSelector: {}
+  rules:
+  - apiGroups:
+    - forklift.konveyor.io
+    resources:
+    - plans
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+  sideEffects: None
+  timeoutSeconds: 30
diff --git a/operator/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-secrets.yml.j2 b/operator/roles/forkliftcontroller/templates/api/mutatingwebhookconfiguration-secrets.yml.j2
@@ -0,0 +1,42 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ api_deployment_name }}-secrets
+  namespace: ""
+  annotations:
+{% if k8s_cluster|bool %}
+    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
+{% else %}
+    service.beta.openshift.io/inject-cabundle: "true"
+{% endif %}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ api_service_name }}
+      namespace: {{ app_namespace }}
+      path: /secret-mutate
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: ca-mutatur.forklift.konveyor
+  namespaceSelector: {}
+  objectSelector: 
+    matchExpressions:
+    - key: createdForProviderType
+      operator: Exists
+  rules:
+  - apiGroups:
+    - ''
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - secrets
+    scope: Namespaced
+  sideEffects: None
+  timeoutSeconds: 30
diff --git a/...roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-forklift-api.yml.j2 b/...roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-forklift-api.yml.j2
@@ -1,89 +1,8 @@
+# Do not add webhooks to this file
+# This configuration has been deprecated
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: {{ api_deployment_name }}
   namespace: ""
-  annotations:
-{% if k8s_cluster|bool %}
-    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
-{% else %}
-    service.beta.openshift.io/inject-cabundle: "true"
-{% endif %}
-webhooks:
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: {{ api_service_name }}
-      namespace: {{ app_namespace }}
-      path: /secret-validate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Equivalent
-  name: secrets.forklift.konveyor
-  namespaceSelector: {}
-  objectSelector:
-    matchExpressions:
-    - key: createdForResourceType
-      operator: Exists
-  rules:
-  - apiGroups:
-    - ''
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - secrets
-    scope: Namespaced
-  sideEffects: None
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: {{ api_service_name }}
-      namespace: {{ app_namespace }}
-      path: /plan-validate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Equivalent
-  name: plans.forklift.konveyor
-  namespaceSelector: {}
-  objectSelector: {}
-  rules:
-  - apiGroups:
-    - forklift.konveyor.io
-    resources:
-    - plans
-    apiVersions:
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-  sideEffects: None
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: {{ api_service_name }}
-      namespace: {{ app_namespace }}
-      path: /provider-validate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Equivalent
-  name: providers.forklift.konveyor
-  namespaceSelector: {}
-  objectSelector: {}
-  rules:
-  - apiGroups:
-    - forklift.konveyor.io
-    resources:
-    - providers
-    apiVersions:
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-  sideEffects: None
diff --git a/operator/roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-plans.yml.j2 b/operator/roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-plans.yml.j2
@@ -0,0 +1,37 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ api_deployment_name }}-plans
+  namespace: ""
+  annotations:
+{% if k8s_cluster|bool %}
+    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
+{% else %}
+    service.beta.openshift.io/inject-cabundle: "true"
+{% endif %}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ api_service_name }}
+      namespace: {{ app_namespace }}
+      path: /plan-validate
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: plans.forklift.konveyor
+  namespaceSelector: {}
+  objectSelector: {}
+  rules:
+  - apiGroups:
+    - forklift.konveyor.io
+    resources:
+    - plans
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+  sideEffects: None
diff --git a/...or/roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-providers.yml.j2 b/...or/roles/forkliftcontroller/templates/api/validatingwebhookconfiguration-providers.yml.j2
@@ -0,0 +1,37 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ api_deployment_name }}-providers
+  namespace: ""
+  annotations:
+{% if k8s_cluster|bool %}
+    cert-manager.io/inject-ca-from: {{ app_namespace }}/{{ api_certificate_name }}
+{% else %}
+    service.beta.openshift.io/inject-cabundle: "true"
+{% endif %}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ api_service_name }}
+      namespace: {{ app_namespace }}
+      path: /provider-validate
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: providers.forklift.konveyor
+  namespaceSelector: {}
+  objectSelector: {}
+  rules:
+  - apiGroups:
+    - forklift.konveyor.io
+    resources:
+    - providers
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+  sideEffects: None