mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 18:59:09 +00:00
Philip LaineandGitHub
e83dc472e2
The webhook for the NBSetupKey does a mix of runtime validation and configuration validation. The validation of secret key ref has been switched to using CEL rules to achieve the same thing. The other logic is just being removed as it is goes against common practice in Kubernetes. We should not block secret deletion if a pod is using the secret. Existing pods will keep running while new pods will not be able to be created. This is expected behavior in other tools and should be dealt with during reconcile. Checking that secrets exist and other dependency problems should be done during reconcile and then bubbled up with conditions instead. Signed-off-by: Philip Laine <philip.laine@gmail.com>
136 lines
4.1 KiB
YAML
136 lines
4.1 KiB
YAML
{{ $tls := fromYaml ( include "kubernetes-operator.webhookCerts" . ) }}
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
{{- if $.Values.webhook.enableCertManager }}
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
|
|
{{- end }}
|
|
name: {{ include "kubernetes-operator.fullname" . }}-mpod-webhook
|
|
labels:
|
|
{{- include "kubernetes-operator.labels" . | nindent 4 }}
|
|
webhooks:
|
|
- clientConfig:
|
|
{{- if not $.Values.webhook.enableCertManager }}
|
|
caBundle: {{ $tls.caCert }}
|
|
{{ end }}
|
|
service:
|
|
name: {{ template "kubernetes-operator.webhookService" . }}
|
|
namespace: {{ $.Release.Namespace }}
|
|
path: /mutate--v1-pod
|
|
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
name: mpod-v1.netbird.io
|
|
admissionReviewVersions:
|
|
- v1
|
|
{{- if .Values.webhook.namespaceSelectors }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
{{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
|
|
{{ end }}
|
|
objectSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/name
|
|
operator: NotIn
|
|
values:
|
|
- {{ include "kubernetes-operator.name" . }}
|
|
{{- if .Values.webhook.objectSelector.matchExpressions }}
|
|
{{- toYaml .Values.webhook.objectSelector.matchExpressions | nindent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.webhook.objectSelector.matchLabels }}
|
|
matchLabels:
|
|
{{- toYaml .Values.webhook.objectSelector.matchLabels | nindent 6 }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- CREATE
|
|
resources:
|
|
- pods
|
|
sideEffects: None
|
|
{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
{{- if $.Values.webhook.enableCertManager }}
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
|
|
{{- end }}
|
|
name: {{ include "kubernetes-operator.fullname" . }}-vnbgroup-webhook
|
|
labels:
|
|
{{- include "kubernetes-operator.labels" . | nindent 4 }}
|
|
webhooks:
|
|
- clientConfig:
|
|
{{- if not $.Values.webhook.enableCertManager }}
|
|
caBundle: {{ $tls.caCert }}
|
|
{{ end }}
|
|
service:
|
|
name: {{ template "kubernetes-operator.webhookService" . }}
|
|
namespace: {{ $.Release.Namespace }}
|
|
path: /validate-netbird-io-v1-nbgroup
|
|
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
name: vnbgroup-v1.netbird.io
|
|
admissionReviewVersions:
|
|
- v1
|
|
{{- if .Values.webhook.namespaceSelectors }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
{{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
|
|
{{ end }}
|
|
rules:
|
|
- apiGroups:
|
|
- netbird.io
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- DELETE
|
|
resources:
|
|
- "nbgroups"
|
|
sideEffects: None
|
|
{{- end }}
|
|
---
|
|
{{- if not $.Values.webhook.enableCertManager }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ template "kubernetes-operator.webhookCertSecret" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{ include "kubernetes-operator.labels" . | indent 4 }}
|
|
type: kubernetes.io/tls
|
|
data:
|
|
ca.crt: {{ $tls.caCert }}
|
|
tls.crt: {{ $tls.clientCert }}
|
|
tls.key: {{ $tls.clientKey }}
|
|
{{- else }}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ template "kubernetes-operator.fullname" . }}-serving-cert
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{ include "kubernetes-operator.labels" . | indent 4 }}
|
|
spec:
|
|
dnsNames:
|
|
- {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc
|
|
- {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.{{ .Values.cluster.dns }}
|
|
issuerRef:
|
|
kind: Issuer
|
|
name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer
|
|
secretName: {{ template "kubernetes-operator.webhookCertSecret" . }}
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{ include "kubernetes-operator.labels" . | indent 4 }}
|
|
spec:
|
|
selfSigned: {}
|
|
{{- end }}
|