Skip to content

Commit d41ddd0

Browse files
perdasilvaPer Goncalves da Silva
perdasilva
and
Per Goncalves da Silva
authored
🌱 Add feature-gate kustomize files, docs, and demo for webhook support feature (#1996)
* Add webhook support featuregate kustomize overlay Signed-off-by: Per Goncalves da Silva <[email protected]> * Add webhook support demo Signed-off-by: Per Goncalves da Silva <[email protected]> * Add docs Signed-off-by: Per Goncalves da Silva <[email protected]> * Fix featuregate kustomization.yaml comments Signed-off-by: Per Goncalves da Silva <[email protected]> --------- Signed-off-by: Per Goncalves da Silva <[email protected]> Co-authored-by: Per Goncalves da Silva <[email protected]>
1 parent 50ead7d commit d41ddd0

File tree

11 files changed

+199
-1
lines changed

11 files changed

+199
-1
lines changed

‎config/overlays/featuregate/synthetic-user-permissions/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# kustomization file for secure OLMv1
1+
# kustomization file for OLMv1 support for synthetic auth
22
# DO NOT ADD A NAMESPACE HERE
33
apiVersion: kustomize.config.k8s.io/v1beta1
44
kind: Kustomization

‎config/overlays/featuregate/webhook-provider-certmanager/kustomization.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# kustomization file for cert-manager backed OLMv1 support for installation of bundles with webhooks
2+
# DO NOT ADD A NAMESPACE HERE
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ../../../base/operator-controller
7+
- ../../../base/common
8+
components:
9+
- ../../../components/tls/operator-controller
10+
11+
patches:
12+
- target:
13+
kind: Deployment
14+
name: operator-controller-controller-manager
15+
path: patches/enable-featuregate.yaml

‎config/overlays/featuregate/webhook-provider-certmanager/patches/enable-featuregate.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# enable cert-manager backed webhook support feature gate
2+
- op: add
3+
path: /spec/template/spec/containers/0/args/-
4+
value: "--feature-gates=WebhookProviderCertManager=true"

‎config/overlays/featuregate/webhook-provider-openshift-serviceca/kustomization.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# kustomization file for openshift-serviceca backed OLMv1 support for installation of bundles with webhooks
2+
# DO NOT ADD A NAMESPACE HERE
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ../../../base/operator-controller
7+
- ../../../base/common
8+
components:
9+
- ../../../components/tls/operator-controller
10+
11+
patches:
12+
- target:
13+
kind: Deployment
14+
name: operator-controller-controller-manager
15+
path: patches/enable-featuregate.yaml

‎config/overlays/featuregate/webhook-provider-openshift-serviceca/patches/enable-featuregate.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# enable openshift-serviceca backed webhook support feature gate
2+
- op: add
3+
path: /spec/template/spec/containers/0/args/-
4+
value: "--feature-gates=WebhookProviderOpenshiftServiceCA=true"

‎docs/draft/howto/enable-webhook-support.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
## Installation of Bundles containing Webhooks
2+
3+
!!! note
4+
This feature is still in *alpha*. Either the `WebhookProviderCertManager`, or the `WebhookProviderOpenshiftServiceCA`, feature-gate
5+
must be enabled to make use of it. See the instructions below on how to enable the feature-gate.
6+
7+
OLMv1 currently does not support the installation of bundles containing webhooks. The webhook support feature enables this capability.
8+
Webhooks, or more concretely Admission Webhooks, are part of Kuberntes' [Dynamic Admission Control](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/)
9+
feature. Webhooks run as services called by the kube-apiservice in due course of processing a resource related request. They can be used to validate resources, ensure reasonable default values,
10+
are set, or aid in the migration to new CustomResourceDefinition schema. The communication with the webhook service is secured by TLS. In OLMv1, the TLS certificate is managed by a
11+
certificate provider. Currently, two certificate providers are supported: CertManager and Openshift-ServiceCA. The certificate provider to use given by the feature-gate:
12+
13+
- `WebhookProviderCertManager` for [CertManager](https://cert-manager.io/)
14+
- `WebhookProviderOpenshiftServiceCA` for [Openshift-ServiceCA](https://github.com/openshift/service-ca-operator)
15+
16+
As CertManager is already installed with OLMv1, we suggest using `WebhookProviderCertManager`.
17+
18+
### Update OLM to enable Feature
19+
20+
```terminal title=Enable WebhookProviderCertManager feature
21+
kubectl kustomize config/overlays/featuregate/webhook-provider-certmanager | kubectl apply -f -
22+
```
23+
24+
Or,
25+
26+
```terminal title=Enable WebhookProviderOpenshiftServiceCA feature
27+
kubectl kustomize config/overlays/featuregate/webhook-provider-openshift-serviceca | kubectl apply -f -
28+
```
29+
30+
Then,
31+
32+
```terminal title=Wait for rollout to complete
33+
kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
34+
```
35+
36+
### Notes on the generated certificate
37+
38+
#### CertManager
39+
40+
The generated certificate maintains a high-level of parity with the certificate generated by OLMv0:
41+
- Self-signed
42+
- Two validity period, rotating 24h before expiry
43+
- Valid for the webhook service's DNSNames:
44+
- <service-name>.<namespace>
45+
- <service-name>.<namespace>.svc
46+
- <service-name>.<namespace>.svc.cluster.local
47+
48+
#### Openshift-ServiceCA
49+
50+
Generation and rotation are completely governed by [Openshift-ServiceCA](https://github.com/openshift/service-ca-operator)
51+
52+
### How does it work?
53+
54+
There's no change in the installation flow. Just install a bundle containing webhooks as you would any other.
55+
56+
### Demo
57+
58+
!!! note
59+
As there is no difference in usage or experience between the CertManager and Openshift-ServiceCA variants, only
60+
the cert-manager variant is demoed.
61+
62+
[![asciicast](https://asciinema.org/a/GyjsB129GkUadeuxFhNuG4FcS.svg)](https://asciinema.org/a/GyjsB129GkUadeuxFhNuG4FcS)

‎hack/demo/resources/webhook-provider-certmanager/mutating-webhook-test.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: webhook.operators.coreos.io/v1
2+
kind: webhooktest
3+
metadata:
4+
namespace: webhook-operator
5+
name: mutating-webhook-test
6+
spec:
7+
valid: true

‎hack/demo/resources/webhook-provider-certmanager/validating-webhook-test.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: webhook.operators.coreos.io/v1
2+
kind: webhooktest
3+
metadata:
4+
namespace: webhook-operator
5+
name: validating-webhook-test
6+
spec:
7+
valid: false

‎hack/demo/resources/webhook-provider-certmanager/webhook-operator-catalog.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: olm.operatorframework.io/v1
2+
kind: ClusterCatalog
3+
metadata:
4+
name: webhook-operator-catalog
5+
spec:
6+
source:
7+
type: Image
8+
image:
9+
ref: quay.io/operator-framework/webhook-operator-index:0.0.3

‎hack/demo/resources/webhook-provider-certmanager/webhook-operator-extension.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: olm.operatorframework.io/v1
2+
kind: ClusterExtension
3+
metadata:
4+
name: webhook-operator
5+
spec:
6+
namespace: webhook-operator
7+
serviceAccount:
8+
name: webhook-operator-installer
9+
source:
10+
catalog:
11+
packageName: webhook-operator
12+
version: 0.0.1
13+
selector: {}
14+
upgradeConstraintPolicy: CatalogProvided
15+
sourceType: Catalog

‎hack/demo/webhook-provider-certmanager-demo.sh

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/env bash
2+
3+
#
4+
# Welcome to the webhook support with CertManager demo
5+
#
6+
trap "trap - SIGTERM && kill -- -$$" SIGINT SIGTERM EXIT
7+
8+
# enable 'WebhookProviderCertManager' feature
9+
kubectl kustomize config/overlays/featuregate/webhook-provider-certmanager | kubectl apply -f -
10+
11+
# wait for operator-controller to become available
12+
kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
13+
14+
# create webhook-operator catalog
15+
cat ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/webhook-operator-catalog.yaml
16+
kubectl apply -f ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/webhook-operator-catalog.yaml
17+
18+
# wait for catalog to be serving
19+
kubectl wait --for=condition=Serving clustercatalog/webhook-operator-catalog --timeout="60s"
20+
21+
# create install namespace
22+
kubectl create ns webhook-operator
23+
24+
# create installer service account
25+
kubectl create serviceaccount -n webhook-operator webhook-operator-installer
26+
27+
# give installer service account admin privileges
28+
kubectl create clusterrolebinding webhook-operator-installer-crb --clusterrole=cluster-admin --serviceaccount=webhook-operator:webhook-operator-installer
29+
30+
# install webhook operator clusterextension
31+
cat ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/webhook-operator-extension.yaml
32+
33+
# apply cluster extension
34+
kubectl apply -f ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/webhook-operator-extension.yaml
35+
36+
# wait for cluster extension installation to succeed
37+
kubectl wait --for=condition=Installed clusterextension/webhook-operator --timeout="60s"
38+
39+
# wait for webhook-operator deployment to become available and back the webhook service
40+
kubectl wait --for=condition=Available -n webhook-operator deployments/webhook-operator-webhook
41+
42+
# demonstrate working validating webhook
43+
cat ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/validating-webhook-test.yaml
44+
45+
# resource creation should be rejected by the validating webhook due to bad attribute value
46+
kubectl apply -f ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/validating-webhook-test.yaml
47+
48+
# demonstrate working mutating webhook
49+
cat ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/mutating-webhook-test.yaml
50+
51+
# apply resource
52+
kubectl apply -f ${DEMO_RESOURCE_DIR}/webhook-provider-certmanager/mutating-webhook-test.yaml
53+
54+
# get webhooktest resource in v1 schema - resource should have new .spec.mutate attribute
55+
kubectl get webhooktest.v1.webhook.operators.coreos.io -n webhook-operator mutating-webhook-test -o yaml
56+
57+
# demonstrate working conversion webhook by getting webhook test resource in v2 schema - the .spec attributes should now be under the .spec.conversion stanza
58+
kubectl get webhooktest.v2.webhook.operators.coreos.io -n webhook-operator mutating-webhook-test -o yaml
59+
60+
# this concludes the webhook support demo - Thank you!

0 commit comments

Comments
 (0)