Skip to content

Commit 58154db

Browse files
ajanikowajanikow
authored
[Feature] Webhooks (#1781)
1 parent 3993a0c commit 58154db

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+4355
-446
lines changed

‎.golangci.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ linters-settings:
129129
pkg: k8s.io/api/batch/v1
130130
- alias: core
131131
pkg: k8s.io/api/core/v1
132+
- alias: admission
133+
pkg: k8s.io/api/admission/v1
132134
- alias: policy
133135
pkg: k8s.io/api/policy/v1
134136
- alias: storage

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
- (Feature) (Scheduler) Shutdown Integration
3434
- (Feature) CertManager Integration
3535
- (Feature) (Networking) Gateway Options sync
36+
- (Feature) Webhooks
3637

3738
## [1.2.43](https://github.com/arangodb/kube-arangodb/tree/1.2.43) (2024-10-14)
3839
- (Feature) ArangoRoute CRD

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ Flags:
195195
--kubernetes.max-batch-size int Size of batch during objects read (default 256)
196196
--kubernetes.qps float32 Number of queries per second for k8s API (default 15)
197197
--log.format string Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
198-
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-config-v1, integration-envoy-auth-v3, integration-scheduler-v2, integration-storage-v2, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication (default [info])
198+
--log.level stringArray Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-config-v1, integration-envoy-auth-v3, integration-scheduler-v2, integration-storage-v2, integrations, k8s-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
199199
--log.sampling If true, operator will try to minimize duplication of logging events (default true)
200200
--memory-limit uint Define memory limit for hard shutdown and the dump of goroutines. Used for testing
201201
--metrics.excluded-prefixes stringArray List of the excluded metrics prefixes

‎chart/kube-arangodb-arm64/templates/deployment.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,67 @@ spec:
191191
scheme: HTTPS
192192
initialDelaySeconds: 5
193193
periodSeconds: 10
194+
{{- end }}
195+
{{ if .Values.webhooks.enabled }}
196+
- name: webhooks
197+
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
198+
image: {{ .Values.operator.image }}
199+
args:
200+
- webhook
201+
{{- if .Values.certificate.enabled }}
202+
- --ssl.secret.name={{ template "kube-arangodb.operatorName" . }}-webhook-cert
203+
- --ssl.secret.namespace={{ .Release.Namespace }}
204+
{{- end -}}
205+
{{- if .Values.webhooks.args }}
206+
{{- range .Values.webhooks.args }}
207+
- {{ . | quote }}
208+
{{- end }}
209+
{{- end }}
210+
env:
211+
- name: MY_POD_NAMESPACE
212+
valueFrom:
213+
fieldRef:
214+
fieldPath: metadata.namespace
215+
- name: MY_POD_NAME
216+
valueFrom:
217+
fieldRef:
218+
fieldPath: metadata.name
219+
- name: MY_CONTAINER_NAME
220+
value: "webhooks"
221+
- name: MY_POD_IP
222+
valueFrom:
223+
fieldRef:
224+
fieldPath: status.podIP
225+
ports:
226+
- name: webhooks
227+
containerPort: 8828
228+
securityContext:
229+
privileged: false
230+
allowPrivilegeEscalation: false
231+
readOnlyRootFilesystem: true
232+
capabilities:
233+
drop:
234+
- 'ALL'
235+
{{- if .Values.webhooks.resources }}
236+
resources:
237+
{{ toYaml .Values.webhooks.resources | indent 22 }}
238+
{{- end }}
239+
{{- if not .Values.webhooks.debug }}
240+
livenessProbe:
241+
httpGet:
242+
path: /health
243+
port: 8828
244+
scheme: HTTPS
245+
initialDelaySeconds: 5
246+
periodSeconds: 10
247+
readinessProbe:
248+
httpGet:
249+
path: /ready
250+
port: 8828
251+
scheme: HTTPS
252+
initialDelaySeconds: 5
253+
periodSeconds: 10
254+
{{- end }}
194255
{{- end }}
195256
tolerations:
196257
- key: "node.kubernetes.io/unreachable"

‎chart/kube-arangodb-arm64/templates/service-webhooks.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{ if .Values.webhooks.enabled }}
2+
3+
apiVersion: v1
4+
kind: Service
5+
metadata:
6+
name: {{ template "kube-arangodb.operatorName" . }}-webhook
7+
namespace: {{ .Release.Namespace }}
8+
{{- if .Values.operator.annotations }}
9+
annotations:
10+
{{ toYaml .Values.operator.annotations | indent 8 }}
11+
{{- end }}
12+
labels:
13+
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
14+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
15+
app.kubernetes.io/managed-by: {{ .Release.Service }}
16+
app.kubernetes.io/instance: {{ .Release.Name }}
17+
release: {{ .Release.Name }}
18+
spec:
19+
ports:
20+
- name: webhooks
21+
port: 443
22+
protocol: TCP
23+
targetPort: webhooks
24+
selector:
25+
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
26+
app.kubernetes.io/managed-by: {{ .Release.Service }}
27+
app.kubernetes.io/instance: {{ .Release.Name }}
28+
release: {{ .Release.Name }}
29+
type: ClusterIP
30+
31+
{{- end }}

‎chart/kube-arangodb-arm64/templates/webhook/certificate.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{ if .Values.certificate.enabled -}}
2+
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ template "kube-arangodb.operatorName" . }}-webhook
7+
namespace: {{ .Release.Namespace }}
8+
labels:
9+
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
10+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
11+
app.kubernetes.io/managed-by: {{ .Release.Service }}
12+
app.kubernetes.io/instance: {{ .Release.Name }}
13+
release: {{ .Release.Name }}
14+
spec:
15+
secretName: {{ template "kube-arangodb.operatorName" . }}-webhook-cert
16+
duration: {{ .Values.certificate.cert.duration }}
17+
issuerRef:
18+
name: {{ template "kube-arangodb.operatorName" . }}
19+
dnsNames:
20+
- {{ template "kube-arangodb.operatorName" . }}-webhook
21+
- {{ template "kube-arangodb.operatorName" . }}-webhook.{{ .Release.Namespace }}
22+
- {{ template "kube-arangodb.operatorName" . }}-webhook.{{ .Release.Namespace }}.svc
23+
24+
{{- end }}

‎chart/kube-arangodb-arm64/templates/webhook/mutation.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{{ if .Values.webhooks.enabled }}
2+
3+
apiVersion: admissionregistration.k8s.io/v1
4+
kind: MutatingWebhookConfiguration
5+
metadata:
6+
name: "{{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.operator.arangodb.com"
7+
annotations:
8+
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ template "kube-arangodb.operatorName" . }}-ca"
9+
labels:
10+
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
11+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
12+
app.kubernetes.io/managed-by: {{ .Release.Service }}
13+
app.kubernetes.io/instance: {{ .Release.Name }}
14+
release: {{ .Release.Name }}
15+
webhooks:
16+
- name: "pods.policies.scheduler.arangodb.com"
17+
namespaceSelector:
18+
matchExpressions:
19+
- key: kubernetes.io/metadata.name
20+
operator: In
21+
values:
22+
- {{ .Release.Namespace }}
23+
objectSelector:
24+
matchExpressions:
25+
- key: profiles.arangodb.com/deployment
26+
operator: Exists
27+
rules:
28+
- apiGroups: [""]
29+
apiVersions: ["v1"]
30+
operations: ["CREATE"]
31+
resources: ["pods"]
32+
scope: "Namespaced"
33+
clientConfig:
34+
service:
35+
namespace: {{ .Release.Namespace }}
36+
name: {{ template "kube-arangodb.operatorName" . }}-webhook
37+
path: /webhook/core/v1/pods/policies/mutate
38+
admissionReviewVersions: ["v1"]
39+
sideEffects: None
40+
timeoutSeconds: 5
41+
42+
{{- end }}

‎chart/kube-arangodb-arm64/templates/webhook/validation.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{ if .Values.webhooks.enabled }}
2+
3+
apiVersion: admissionregistration.k8s.io/v1
4+
kind: ValidatingWebhookConfiguration
5+
metadata:
6+
name: "{{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.operator.arangodb.com"
7+
annotations:
8+
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ template "kube-arangodb.operatorName" . }}-ca"
9+
labels:
10+
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
11+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
12+
app.kubernetes.io/managed-by: {{ .Release.Service }}
13+
app.kubernetes.io/instance: {{ .Release.Name }}
14+
release: {{ .Release.Name }}
15+
webhooks: []
16+
17+
{{- end }}

‎chart/kube-arangodb-arm64/values.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,16 @@ rbac:
4444
acs: true
4545
at: true
4646
debug: false
47+
webhooks:
48+
enabled: false
49+
args: []
50+
resources:
51+
limits:
52+
cpu: 1
53+
memory: 128Mi
54+
requests:
55+
cpu: 250m
56+
memory: 128Mi
4757
certificate:
4858
enabled: false
4959
ca:

‎chart/kube-arangodb-enterprise-arm64/templates/deployment.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,67 @@ spec:
191191
scheme: HTTPS
192192
initialDelaySeconds: 5
193193
periodSeconds: 10
194+
{{- end }}
195+
{{ if .Values.webhooks.enabled }}
196+
- name: webhooks
197+
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
198+
image: {{ .Values.operator.image }}
199+
args:
200+
- webhook
201+
{{- if .Values.certificate.enabled }}
202+
- --ssl.secret.name={{ template "kube-arangodb.operatorName" . }}-webhook-cert
203+
- --ssl.secret.namespace={{ .Release.Namespace }}
204+
{{- end -}}
205+
{{- if .Values.webhooks.args }}
206+
{{- range .Values.webhooks.args }}
207+
- {{ . | quote }}
208+
{{- end }}
209+
{{- end }}
210+
env:
211+
- name: MY_POD_NAMESPACE
212+
valueFrom:
213+
fieldRef:
214+
fieldPath: metadata.namespace
215+
- name: MY_POD_NAME
216+
valueFrom:
217+
fieldRef:
218+
fieldPath: metadata.name
219+
- name: MY_CONTAINER_NAME
220+
value: "webhooks"
221+
- name: MY_POD_IP
222+
valueFrom:
223+
fieldRef:
224+
fieldPath: status.podIP
225+
ports:
226+
- name: webhooks
227+
containerPort: 8828
228+
securityContext:
229+
privileged: false
230+
allowPrivilegeEscalation: false
231+
readOnlyRootFilesystem: true
232+
capabilities:
233+
drop:
234+
- 'ALL'
235+
{{- if .Values.webhooks.resources }}
236+
resources:
237+
{{ toYaml .Values.webhooks.resources | indent 22 }}
238+
{{- end }}
239+
{{- if not .Values.webhooks.debug }}
240+
livenessProbe:
241+
httpGet:
242+
path: /health
243+
port: 8828
244+
scheme: HTTPS
245+
initialDelaySeconds: 5
246+
periodSeconds: 10
247+
readinessProbe:
248+
httpGet:
249+
path: /ready
250+
port: 8828
251+
scheme: HTTPS
252+
initialDelaySeconds: 5
253+
periodSeconds: 10
254+
{{- end }}
194255
{{- end }}
195256
tolerations:
196257
- key: "node.kubernetes.io/unreachable"

0 commit comments

Comments
 (0)