From 41e2c58c10601ba292a67772a6bfaa4482f356f4 Mon Sep 17 00:00:00 2001 From: Camila Macedo Date: Fri, 1 Nov 2024 16:04:37 +0000 Subject: [PATCH] fix ca injection - wip --- .github/workflows/test-e2e-samples.yml | 13 +- .../project/config/crd/kustomization.yaml | 6 +- .../project/config/default/kustomization.yaml | 22 +-- .../project/config/crd/kustomization.yaml | 6 +- .../project/config/default/kustomization.yaml | 22 +-- .../project/config/crd/kustomization.yaml | 7 +- .../crd/patches/cainjection_in_cronjobs.yaml | 7 - .../project/config/default/kustomization.yaml | 10 +- docs/book/src/reference/markers/scaffold.md | 81 +++++++-- .../generate_multiversion.go | 8 +- .../multiversion-tutorial/kustomize.go | 14 +- .../common/kustomize/v2/scaffolds/api.go | 1 + .../templates/config/crd/kustomization.go | 27 +-- .../crd/patches/enablecainjection_patch.go | 58 ------- .../config/kdefault/kustomization.go | 22 +-- .../kustomization_conversion_updater.go | 83 ++++++++++ .../common/kustomize/v2/scaffolds/webhook.go | 58 ++++++- test/testdata/generate.sh | 11 +- .../config/crd/kustomization.yaml | 7 +- ...ainjection_in_example.com_wordpresses.yaml | 7 - .../config/default/kustomization.yaml | 8 +- .../config/crd/kustomization.yaml | 7 +- .../patches/cainjection_in_wordpresses.yaml | 7 - .../config/default/kustomization.yaml | 8 +- testdata/project-v4/PROJECT | 20 +++ .../project-v4/api/v1/secondmate_types.go | 66 ++++++++ .../api/v1/zz_generated.deepcopy.go | 89 ++++++++++ .../project-v4/api/v2/secondmate_types.go | 64 ++++++++ .../api/v2/zz_generated.deepcopy.go | 89 ++++++++++ testdata/project-v4/cmd/main.go | 14 ++ .../crew.testproject.org_secondmates.yaml | 92 +++++++++++ .../project-v4/config/crd/kustomization.yaml | 9 +- .../patches/cainjection_in_firstmates.yaml | 7 - .../crd/patches/webhook_in_secondmates.yaml | 16 ++ .../config/default/kustomization.yaml | 26 ++- .../project-v4/config/rbac/kustomization.yaml | 2 + testdata/project-v4/config/rbac/role.yaml | 3 + .../config/rbac/secondmate_editor_role.yaml | 27 +++ .../config/rbac/secondmate_viewer_role.yaml | 23 +++ .../config/samples/crew_v1_secondmate.yaml | 9 + .../config/samples/crew_v2_secondmate.yaml | 9 + .../config/samples/kustomization.yaml | 2 + testdata/project-v4/dist/install.yaml | 155 ++++++++++++++++++ .../controller/secondmate_controller.go | 63 +++++++ .../controller/secondmate_controller_test.go | 84 ++++++++++ .../internal/webhook/v1/secondmate_webhook.go | 36 ++++ .../webhook/v1/secondmate_webhook_test.go | 55 +++++++ 47 files changed, 1230 insertions(+), 230 deletions(-) delete mode 100644 docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml delete mode 100644 pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/crd/patches/enablecainjection_patch.go create mode 100644 pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/kustomization_conversion_updater.go delete mode 100644 testdata/project-v4-multigroup/config/crd/patches/cainjection_in_example.com_wordpresses.yaml delete mode 100644 testdata/project-v4-with-plugins/config/crd/patches/cainjection_in_wordpresses.yaml create mode 100644 testdata/project-v4/api/v1/secondmate_types.go create mode 100644 testdata/project-v4/api/v2/secondmate_types.go create mode 100644 testdata/project-v4/config/crd/bases/crew.testproject.org_secondmates.yaml delete mode 100644 testdata/project-v4/config/crd/patches/cainjection_in_firstmates.yaml create mode 100644 testdata/project-v4/config/crd/patches/webhook_in_secondmates.yaml create mode 100644 testdata/project-v4/config/rbac/secondmate_editor_role.yaml create mode 100644 testdata/project-v4/config/rbac/secondmate_viewer_role.yaml create mode 100644 testdata/project-v4/config/samples/crew_v1_secondmate.yaml create mode 100644 testdata/project-v4/config/samples/crew_v2_secondmate.yaml create mode 100644 testdata/project-v4/internal/controller/secondmate_controller.go create mode 100644 testdata/project-v4/internal/controller/secondmate_controller_test.go create mode 100644 testdata/project-v4/internal/webhook/v1/secondmate_webhook.go create mode 100644 testdata/project-v4/internal/webhook/v1/secondmate_webhook_test.go diff --git a/.github/workflows/test-e2e-samples.yml b/.github/workflows/test-e2e-samples.yml index 3865f8624ca..f287e64cc75 100644 --- a/.github/workflows/test-e2e-samples.yml +++ b/.github/workflows/test-e2e-samples.yml @@ -41,7 +41,9 @@ jobs: run: | KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml" sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH - sed -i '50,177s/^#//' $KUSTOMIZATION_FILE_PATH + # Uncomment all cert-manager injections + sed -i '50,172s/^#//' $KUSTOMIZATION_FILE_PATH + sed -i '174,198s/^#//' $KUSTOMIZATION_FILE_PATH cd testdata/project-v4/ go mod tidy @@ -81,9 +83,12 @@ jobs: KUSTOMIZATION_FILE_PATH="testdata/project-v4-with-plugins/config/default/kustomization.yaml" sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH # Uncomment only ValidatingWebhookConfiguration - # from cert-manager replaces - sed -i '50,116s/^#//' $KUSTOMIZATION_FILE_PATH - sed -i '148,177s/^#//' $KUSTOMIZATION_FILE_PATH + # from cert-manager replaces; we are leaving defaulting uncommented + # since this sample has no defaulting webhooks + sed -i '50,155s/^#//' $KUSTOMIZATION_FILE_PATH + # Uncomment only --conversion webhooks CA injection + sed -i '144,163s/^#//' $KUSTOMIZATION_FILE_PATH + sed -i '165,180s/^#//' $KUSTOMIZATION_FILE_PATH cd testdata/project-v4-with-plugins/ go mod tidy diff --git a/docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml b/docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml index ce4e7415d87..64e3b9b9128 100644 --- a/docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml +++ b/docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml @@ -6,14 +6,10 @@ resources: # +kubebuilder:scaffold:crdkustomizeresource patches: -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. +# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD # +kubebuilder:scaffold:crdkustomizewebhookpatch -# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. -# patches here are for enabling the CA injection for each CRD -# +kubebuilder:scaffold:crdkustomizecainjectionpatch - # [WEBHOOK] To enable webhook, uncomment the following section # the following config is for teaching kustomize how to do kustomization for CRDs. #configurations: diff --git a/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml b/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml index 8778c1a5150..0406f1b9f5b 100644 --- a/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml +++ b/docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml @@ -151,27 +151,13 @@ replacements: # version: v1 # name: serving-cert # This name should match the one in certificate.yaml # fieldPath: .metadata.namespace # Namespace of the certificate CR -# targets: -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionns # - source: # kind: Certificate # group: cert-manager.io # version: v1 # name: serving-cert # This name should match the one in certificate.yaml # fieldPath: .metadata.name -# targets: -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml b/docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml index 217b2175494..49261096d84 100644 --- a/docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml +++ b/docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml @@ -6,14 +6,10 @@ resources: # +kubebuilder:scaffold:crdkustomizeresource patches: -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. +# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD # +kubebuilder:scaffold:crdkustomizewebhookpatch -# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. -# patches here are for enabling the CA injection for each CRD -# +kubebuilder:scaffold:crdkustomizecainjectionpatch - # [WEBHOOK] To enable webhook, uncomment the following section # the following config is for teaching kustomize how to do kustomization for CRDs. #configurations: diff --git a/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml b/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml index 8922567ea88..439cc5be0b7 100644 --- a/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml +++ b/docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml @@ -151,27 +151,13 @@ patches: # version: v1 # name: serving-cert # This name should match the one in certificate.yaml # fieldPath: .metadata.namespace # Namespace of the certificate CR -# targets: -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionns # - source: # kind: Certificate # group: cert-manager.io # version: v1 # name: serving-cert # This name should match the one in certificate.yaml # fieldPath: .metadata.name -# targets: -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml b/docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml index 4cae15b8d87..698581ee3d8 100644 --- a/docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml +++ b/docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml @@ -6,16 +6,11 @@ resources: # +kubebuilder:scaffold:crdkustomizeresource patches: -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. +# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD - path: patches/webhook_in_cronjobs.yaml # +kubebuilder:scaffold:crdkustomizewebhookpatch -# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. -# patches here are for enabling the CA injection for each CRD -#- path: patches/cainjection_in_cronjobs.yaml -# +kubebuilder:scaffold:crdkustomizecainjectionpatch - # [WEBHOOK] To enable webhook, uncomment the following section # the following config is for teaching kustomize how to do kustomization for CRDs. configurations: diff --git a/docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml b/docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml deleted file mode 100644 index 752fa9ac6a0..00000000000 --- a/docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# The following patch adds a directive for certmanager to inject CA into the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME - name: cronjobs.batch.tutorial.kubebuilder.io diff --git a/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml b/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml index 094f86a8cec..309e25c061b 100644 --- a/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml +++ b/docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml @@ -144,34 +144,38 @@ replacements: delimiter: '/' index: 1 create: true - +# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion) kind: Certificate group: cert-manager.io version: v1 name: serving-cert # This name should match the one in certificate.yaml fieldPath: .metadata.namespace # Namespace of the certificate CR - targets: + targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. - select: kind: CustomResourceDefinition + name: cronjobs.batch.tutorial.kubebuilder.io fieldPaths: - .metadata.annotations.[cert-manager.io/inject-ca-from] options: delimiter: '/' index: 0 create: true +# +kubebuilder:scaffold:crdkustomizecainjectionns - source: kind: Certificate group: cert-manager.io version: v1 name: serving-cert # This name should match the one in certificate.yaml fieldPath: .metadata.name - targets: + targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. - select: kind: CustomResourceDefinition + name: cronjobs.batch.tutorial.kubebuilder.io fieldPaths: - .metadata.annotations.[cert-manager.io/inject-ca-from] options: delimiter: '/' index: 1 create: true +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/docs/book/src/reference/markers/scaffold.md b/docs/book/src/reference/markers/scaffold.md index 48d18fa88bf..bd9f9ba217f 100644 --- a/docs/book/src/reference/markers/scaffold.md +++ b/docs/book/src/reference/markers/scaffold.md @@ -95,17 +95,76 @@ properly registered with the manager, so that the controller can reconcile the r ## List of `+kubebuilder:scaffold` Markers -| Marker | Usual Location | Function | -|--------------------------------------------|------------------------------|---------------------------------------------------------------------------------| -| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. | -| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. | -| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. | -| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. | -| `+kubebuilder:scaffold:crdkustomizeresource`| `config/crd` | Marks where CRD custom resource patches are added. | -| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. | -| `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhook. | -| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. | -| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. | +| Marker | Usual Location | Function | +|--------------------------------------------------------------------------------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. | +| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. | +| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. | +| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. | +| `+kubebuilder:scaffold:crdkustomizeresource` | `config/crd` | Marks where CRD custom resource patches are added. | +| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. | +| `+kubebuilder:scaffold:crdkustomizecainjectionns` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. | +| `+kubebuilder:scaffold:crdkustomizecainjectioname` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. | +| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. | +| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. | +| **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhooks. Replaced by `+kubebuilder:scaffold:crdkustomizecainjectionns` and `+kubebuilder:scaffold:crdkustomizecainjectioname` | + + +