Fix webhook rbac and add istio tests

helm-charts/seldon-core-operator/templates/deployment_seldon-controller-manager.yaml

@@ -69,6 +69,8 @@ spec:
           value: '{{ .Values.istio.enabled }}'
         - name: ISTIO_GATEWAY
           value: '{{ .Values.istio.gateway }}'
+        - name: ISTIO_TLS_MODE
+          value: '{{ .Values.istio.tlsMode }}'
         image: '{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}'
         imagePullPolicy: '{{ .Values.image.pullPolicy }}'
         name: manager

helm-charts/seldon-core-operator/templates/webhook.yaml

@@ -61,13 +61,39 @@ webhooks:
     resources:
     - seldondeployments
 - clientConfig:
-    caBundle: Cg==
+    caBundle: '{{ $ca.Cert | b64enc }}'
     service:
       name: seldon-webhook-service
-      namespace: seldon-system
+      namespace: '{{ .Release.Namespace }}'
       path: /validate-machinelearning-seldon-io-v1alpha2-seldondeployment
   failurePolicy: Fail
   name: vseldondeployment.kb.io
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.singleNamespace }}
+  namespaceSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.singleNamespace }}
+  namespaceSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Release.Namespace }}
+{{- end }}
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.controllerId }}
+  objectSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.controllerId }}
+  objectSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Values.controllerId }}
+{{- end }}
   rules:
   - apiGroups:
     - machinelearning.seldon.io
@@ -79,13 +105,39 @@ webhooks:
     resources:
     - seldondeployments
 - clientConfig:
-    caBundle: Cg==
+    caBundle: '{{ $ca.Cert | b64enc }}'
     service:
       name: seldon-webhook-service
-      namespace: seldon-system
+      namespace: '{{ .Release.Namespace }}'
       path: /validate-machinelearning-seldon-io-v1alpha3-seldondeployment
   failurePolicy: Fail
   name: vseldondeployment.kb.io
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.singleNamespace }}
+  namespaceSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.singleNamespace }}
+  namespaceSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Release.Namespace }}
+{{- end }}
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.controllerId }}
+  objectSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.controllerId }}
+  objectSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Values.controllerId }}
+{{- end }}
   rules:
   - apiGroups:
     - machinelearning.seldon.io
@@ -98,20 +150,6 @@ webhooks:
     - seldondeployments
 ---
 
-{{- if not .Values.certManager.enabled -}}
-apiVersion: v1
-data:
-  ca.crt: '{{ $ca.Cert | b64enc }}'
-  tls.crt: '{{ $cert.Cert | b64enc }}'
-  tls.key: '{{ $cert.Key | b64enc }}'
-kind: Secret
-metadata:
-  name: seldon-webhook-server-cert
-  namespace: '{{ .Release.Namespace }}'
-type: kubernetes.io/tls
-{{- end }}
----
-
 apiVersion: admissionregistration.k8s.io/v1beta1
 kind: MutatingWebhookConfiguration
 metadata:
@@ -170,13 +208,39 @@ webhooks:
     resources:
     - seldondeployments
 - clientConfig:
-    caBundle: Cg==
+    caBundle: '{{ $ca.Cert | b64enc }}'
     service:
       name: seldon-webhook-service
-      namespace: seldon-system
+      namespace: '{{ .Release.Namespace }}'
       path: /mutate-machinelearning-seldon-io-v1alpha2-seldondeployment
   failurePolicy: Fail
   name: mseldondeployment.kb.io
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.singleNamespace }}
+  namespaceSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.singleNamespace }}
+  namespaceSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Release.Namespace }}
+{{- end }}
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.controllerId }}
+  objectSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.controllerId }}
+  objectSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Values.controllerId }}
+{{- end }}
   rules:
   - apiGroups:
     - machinelearning.seldon.io
@@ -188,13 +252,39 @@ webhooks:
     resources:
     - seldondeployments
 - clientConfig:
-    caBundle: Cg==
+    caBundle: '{{ $ca.Cert | b64enc }}'
     service:
       name: seldon-webhook-service
-      namespace: seldon-system
+      namespace: '{{ .Release.Namespace }}'
       path: /mutate-machinelearning-seldon-io-v1alpha3-seldondeployment
   failurePolicy: Fail
   name: mseldondeployment.kb.io
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.singleNamespace }}
+  namespaceSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.singleNamespace }}
+  namespaceSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Release.Namespace }}
+{{- end }}
+{{- if semverCompare ">=1.15.0" .Capabilities.KubeVersion.Version }}
+{{- if not .Values.controllerId }}
+  objectSelector:
+    matchExpressions:
+    - key: seldon.io/controller-id
+      operator: DoesNotExist
+{{- end }}
+{{- end }}
+{{- if .Values.controllerId }}
+  objectSelector:
+    matchLabels:
+      seldon.io/controller-id: {{ .Values.controllerId }}
+{{- end }}
   rules:
   - apiGroups:
     - machinelearning.seldon.io
@@ -205,3 +295,17 @@ webhooks:
     - UPDATE
     resources:
     - seldondeployments
+---
+
+{{- if not .Values.certManager.enabled -}}
+apiVersion: v1
+data:
+  ca.crt: '{{ $ca.Cert | b64enc }}'
+  tls.crt: '{{ $cert.Cert | b64enc }}'
+  tls.key: '{{ $cert.Key | b64enc }}'
+kind: Secret
+metadata:
+  name: seldon-webhook-server-cert
+  namespace: '{{ .Release.Namespace }}'
+type: kubernetes.io/tls
+{{- end }}

helm-charts/seldon-core-operator/values.yaml

@@ -21,13 +21,14 @@ engine:
     name: default
   user: 8888
 image:
-  pullPolicy: Always
+  pullPolicy: IfNotPresent
   registry: docker.io
   repository: seldonio/seldon-core-operator
   tag: 0.5.2-SNAPSHOT
 istio:
   enabled: false
   gateway: seldon-gateway
+  tlsMode: ''
 predictiveUnit:
   port: 9000
 rbac:

operator/config/cert/kustomization.yaml

@@ -5,7 +5,17 @@ bases:
 resources:
 - secret.yaml
 
-patches:
-- mutating.yaml
-- validating.yaml
+patchesJson6902:
+- target:
+    group: admissionregistration.k8s.io
+    version: v1beta1
+    kind: MutatingWebhookConfiguration
+    name: mutating-webhook-configuration
+  path: patch_webhook.yaml
+- target:
+    group: admissionregistration.k8s.io
+    version: v1beta1
+    kind: ValidatingWebhookConfiguration
+    name: validating-webhook-configuration
+  path: patch_webhook.yaml
 

operator/config/cert/patch_webhook.yaml

@@ -0,0 +1,9 @@
+- op: replace
+  path: /webhooks/0/clientConfig/caBundle
+  value: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRVENDQWltZ0F3SUJBZ0lVRkgwbG9uSUFGK2NjUGJnMmdjRlQ5R2JCaVhvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0x6RXRNQ3NHQTFVRUF3d2tRV1J0YVhOemFXOXVJRU52Ym5SeWIyeHNaWElnVjJWaWFHOXZheUJFWlcxdgpJRU5CTUNBWERURTVNVEF3TWpFek1qRXlNRm9ZRHpJNU9Ua3hNakF6TVRNeU1USXdXakF2TVMwd0t3WURWUVFECkRDUkJaRzFwYzNOcGIyNGdRMjl1ZEhKdmJHeGxjaUJYWldKb2IyOXJJRVJsYlc4Z1EwRXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQyt5UFhjWVRUc0NKODl6VEl3MzdyK0FndTlEcitrOFNxRQpMbUdvaW5qZmZBZTRUUHFDRTU5U21RS2VLZGJnZTVxdE1hcWwwTmhZUDNjRGlZR0hIeUlxRGU1L1Z3SHpzaDJECklxNDlaMDIwRUc0aWo2YzhScGt2S2FDd2VvOWVDZk9CRFFkWXZkUzk4b0xOMFE0WEFaSHdMR3pSdmNabmNtZmYKRHdBb2trZHUyU0h3eFc3T1RHYW5uaDYvak85K3I3ZnJqOTBFZURlNGNRelRGbVR3ZjZrWVZsUzluV1FiYndRago0VGVkUE44eFdrakw3RXhWUWZvTkQ3djltckg3T1o1azdQS2VuLzVnNUJqVmFOZDBlQ0hESml4K3VKLzZuK3QvCkxkZDZoeTdSVWQxSzVvMEtnSnQ2T1ZsSTNZczRDVUNTdVRpTTdydDRkdXVQalA2b3JNOXBBZ01CQUFHalV6QlIKTUIwR0ExVWREZ1FXQkJUa3kvSEQwV0RBeFJoL0t0UmZSWFdnWldLR1FqQWZCZ05WSFNNRUdEQVdnQlRreS9IRAowV0RBeFJoL0t0UmZSWFdnWldLR1FqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUJxc0FzMGFDVjFSMWNRa05vTkxQeEZ6R3hiUmJSRll1WHhDdHFXNTdNU3JDUmlSOXVjWUdWYW9Jb1YKZ1g0T2x2MXdxRC95eWU1aVhSVG0wV0ZrcVhpa3hqdmQ1L3NhSVlXOVRGQW53b0ZRMUJiRUhhb2RtbkJqaW4vNQp2bHRsZmJpanRNbUhSbHNZWm81aHZ4cFFJbXJ2azJveUErdDA3S1I5TWh4T0hRVGs5RXJkckd0RG1zc1p3cHpXCkxHS2NCMEJPbEtPTEVCRmFBUEdST2hUamdXdXJqejJ6TXdwS2JoNENnL0YyWXgvek8yaHFjbTRoNmUyU2RueFoKVDM1VGF5UzdHYnRNaG9oeU1WMTc2SVdRTmJzWkw3Rm1PK0xqU0JPR3FnT2ZmWWpGTzd5aENJdUdGblN2L2pBSgozSGhJVXhaN0lhajc2bE1VK0JjWEF5VjN6SmRkCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- op: replace
+  path: /webhooks/1/clientConfig/caBundle
+  value: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRVENDQWltZ0F3SUJBZ0lVRkgwbG9uSUFGK2NjUGJnMmdjRlQ5R2JCaVhvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0x6RXRNQ3NHQTFVRUF3d2tRV1J0YVhOemFXOXVJRU52Ym5SeWIyeHNaWElnVjJWaWFHOXZheUJFWlcxdgpJRU5CTUNBWERURTVNVEF3TWpFek1qRXlNRm9ZRHpJNU9Ua3hNakF6TVRNeU1USXdXakF2TVMwd0t3WURWUVFECkRDUkJaRzFwYzNOcGIyNGdRMjl1ZEhKdmJHeGxjaUJYWldKb2IyOXJJRVJsYlc4Z1EwRXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQyt5UFhjWVRUc0NKODl6VEl3MzdyK0FndTlEcitrOFNxRQpMbUdvaW5qZmZBZTRUUHFDRTU5U21RS2VLZGJnZTVxdE1hcWwwTmhZUDNjRGlZR0hIeUlxRGU1L1Z3SHpzaDJECklxNDlaMDIwRUc0aWo2YzhScGt2S2FDd2VvOWVDZk9CRFFkWXZkUzk4b0xOMFE0WEFaSHdMR3pSdmNabmNtZmYKRHdBb2trZHUyU0h3eFc3T1RHYW5uaDYvak85K3I3ZnJqOTBFZURlNGNRelRGbVR3ZjZrWVZsUzluV1FiYndRago0VGVkUE44eFdrakw3RXhWUWZvTkQ3djltckg3T1o1azdQS2VuLzVnNUJqVmFOZDBlQ0hESml4K3VKLzZuK3QvCkxkZDZoeTdSVWQxSzVvMEtnSnQ2T1ZsSTNZczRDVUNTdVRpTTdydDRkdXVQalA2b3JNOXBBZ01CQUFHalV6QlIKTUIwR0ExVWREZ1FXQkJUa3kvSEQwV0RBeFJoL0t0UmZSWFdnWldLR1FqQWZCZ05WSFNNRUdEQVdnQlRreS9IRAowV0RBeFJoL0t0UmZSWFdnWldLR1FqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUJxc0FzMGFDVjFSMWNRa05vTkxQeEZ6R3hiUmJSRll1WHhDdHFXNTdNU3JDUmlSOXVjWUdWYW9Jb1YKZ1g0T2x2MXdxRC95eWU1aVhSVG0wV0ZrcVhpa3hqdmQ1L3NhSVlXOVRGQW53b0ZRMUJiRUhhb2RtbkJqaW4vNQp2bHRsZmJpanRNbUhSbHNZWm81aHZ4cFFJbXJ2azJveUErdDA3S1I5TWh4T0hRVGs5RXJkckd0RG1zc1p3cHpXCkxHS2NCMEJPbEtPTEVCRmFBUEdST2hUamdXdXJqejJ6TXdwS2JoNENnL0YyWXgvek8yaHFjbTRoNmUyU2RueFoKVDM1VGF5UzdHYnRNaG9oeU1WMTc2SVdRTmJzWkw3Rm1PK0xqU0JPR3FnT2ZmWWpGTzd5aENJdUdGblN2L2pBSgozSGhJVXhaN0lhajc2bE1VK0JjWEF5VjN6SmRkCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- op: replace
+  path: /webhooks/2/clientConfig/caBundle
+  value: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRVENDQWltZ0F3SUJBZ0lVRkgwbG9uSUFGK2NjUGJnMmdjRlQ5R2JCaVhvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0x6RXRNQ3NHQTFVRUF3d2tRV1J0YVhOemFXOXVJRU52Ym5SeWIyeHNaWElnVjJWaWFHOXZheUJFWlcxdgpJRU5CTUNBWERURTVNVEF3TWpFek1qRXlNRm9ZRHpJNU9Ua3hNakF6TVRNeU1USXdXakF2TVMwd0t3WURWUVFECkRDUkJaRzFwYzNOcGIyNGdRMjl1ZEhKdmJHeGxjaUJYWldKb2IyOXJJRVJsYlc4Z1EwRXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQyt5UFhjWVRUc0NKODl6VEl3MzdyK0FndTlEcitrOFNxRQpMbUdvaW5qZmZBZTRUUHFDRTU5U21RS2VLZGJnZTVxdE1hcWwwTmhZUDNjRGlZR0hIeUlxRGU1L1Z3SHpzaDJECklxNDlaMDIwRUc0aWo2YzhScGt2S2FDd2VvOWVDZk9CRFFkWXZkUzk4b0xOMFE0WEFaSHdMR3pSdmNabmNtZmYKRHdBb2trZHUyU0h3eFc3T1RHYW5uaDYvak85K3I3ZnJqOTBFZURlNGNRelRGbVR3ZjZrWVZsUzluV1FiYndRago0VGVkUE44eFdrakw3RXhWUWZvTkQ3djltckg3T1o1azdQS2VuLzVnNUJqVmFOZDBlQ0hESml4K3VKLzZuK3QvCkxkZDZoeTdSVWQxSzVvMEtnSnQ2T1ZsSTNZczRDVUNTdVRpTTdydDRkdXVQalA2b3JNOXBBZ01CQUFHalV6QlIKTUIwR0ExVWREZ1FXQkJUa3kvSEQwV0RBeFJoL0t0UmZSWFdnWldLR1FqQWZCZ05WSFNNRUdEQVdnQlRreS9IRAowV0RBeFJoL0t0UmZSWFdnWldLR1FqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUJDd1VBCkE0SUJBUUJxc0FzMGFDVjFSMWNRa05vTkxQeEZ6R3hiUmJSRll1WHhDdHFXNTdNU3JDUmlSOXVjWUdWYW9Jb1YKZ1g0T2x2MXdxRC95eWU1aVhSVG0wV0ZrcVhpa3hqdmQ1L3NhSVlXOVRGQW53b0ZRMUJiRUhhb2RtbkJqaW4vNQp2bHRsZmJpanRNbUhSbHNZWm81aHZ4cFFJbXJ2azJveUErdDA3S1I5TWh4T0hRVGs5RXJkckd0RG1zc1p3cHpXCkxHS2NCMEJPbEtPTEVCRmFBUEdST2hUamdXdXJqejJ6TXdwS2JoNENnL0YyWXgvek8yaHFjbTRoNmUyU2RueFoKVDM1VGF5UzdHYnRNaG9oeU1WMTc2SVdRTmJzWkw3Rm1PK0xqU0JPR3FnT2ZmWWpGTzd5aENJdUdGblN2L2pBSgozSGhJVXhaN0lhajc2bE1VK0JjWEF5VjN6SmRkCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K

operator/config/manager/manager.yaml

@@ -62,6 +62,8 @@ spec:
           value: "false"
         - name: ISTIO_GATEWAY
           value: seldon-gateway
+        - name: ISTIO_TLS_MODE
+          value: ""
         image: controller:latest
         name: manager
         resources:

operator/config/webhook/kustomization.yaml

@@ -6,5 +6,16 @@ configurations:
 - kustomizeconfig.yaml
 
 # Comment this if you have a k8s cluster < 1.15 and want to use namespaced or labelled operators
-patchesStrategicMerge:
-- patch_object_selector.yaml
+patchesJson6902:
+- target:
+    group: admissionregistration.k8s.io
+    version: v1beta1
+    kind: MutatingWebhookConfiguration
+    name: mutating-webhook-configuration
+  path: patch_webhook.yaml
+- target:
+    group: admissionregistration.k8s.io
+    version: v1beta1
+    kind: ValidatingWebhookConfiguration
+    name: validating-webhook-configuration
+  path: patch_webhook.yaml

operator/controllers/istio.go

@@ -3,5 +3,6 @@ package controllers
 const (
 	ENV_ISTIO_ENABLED        = "ISTIO_ENABLED"
 	ENV_ISTIO_GATEWAY        = "ISTIO_GATEWAY"
+	ENV_ISTIO_TLS_MODE       = "ISTIO_TLS_MODE"
 	ANNOTATION_ISTIO_GATEWAY = "seldon.io/istio-gateway"
 )