Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove CSR check from deploy-config #172

Merged
merged 1 commit into from
Feb 6, 2023
Merged

Remove CSR check from deploy-config #172

merged 1 commit into from
Feb 6, 2023

Conversation

chickenbeef
Copy link
Contributor

@chickenbeef chickenbeef commented Feb 4, 2023

Issue #, if available:

When trying to build the project as per the instructions in the README, the installation goes into an infinite loop waiting for a CSR.

The CSR creation was removed from 0.3.0:

Use in-cluster=false so that the webhook reloads certificates from the filesystem rather than creating CSRs to request certificates (using CSRs is now deprecated and will not work versions later than v0.3.0).

$ make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest
...
mutatingwebhookconfiguration.admissionregistration.k8s.io/pod-identity-webhook configured
until kubectl get csr -o \
		jsonpath='{.items[?(@.spec.username=="system:serviceaccount:default:pod-identity-webhook")].metadata.name}' | \
		grep -m 1 "csr-"; \
		do echo "Waiting for CSR to be created" && sleep 1 ; \
	done
Waiting for CSR to be created
....
Waiting for CSR to be created

Description of changes:

This PR updates the makefile to align with the CSR removal introduced in 0.3.0.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@chickenbeef chickenbeef requested a review from a team as a code owner February 4, 2023 13:47
@dims
Copy link
Member

dims commented Feb 4, 2023

@chickenbeef wanna pick the other change from #150 as well?

@chickenbeef
Copy link
Contributor Author

@dims definitely, I overlooked that.

Updated the prep-config, delete-config and removed the hack/webhook-patch-ca-bundle.sh as it's no longer needed.

$ make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest
Deploying into active cluster...
...
Applying configuration to active cluster...
kubectl apply -f deploy/auth.yaml
serviceaccount/pod-identity-webhook created
role.rbac.authorization.k8s.io/pod-identity-webhook created
rolebinding.rbac.authorization.k8s.io/pod-identity-webhook created
clusterrole.rbac.authorization.k8s.io/pod-identity-webhook created
clusterrolebinding.rbac.authorization.k8s.io/pod-identity-webhook created
kubectl apply -f deploy/deployment.yaml
deployment.apps/pod-identity-webhook created
clusterissuer.cert-manager.io/selfsigned created
certificate.cert-manager.io/pod-identity-webhook created
kubectl apply -f deploy/service.yaml
service/pod-identity-webhook created

Down:

$ make cluster-down
Tearing down mutating controller and associated resources...
kubectl delete -f deploy/service.yaml
service "pod-identity-webhook" deleted
kubectl delete -f deploy/deployment.yaml
deployment.apps "pod-identity-webhook" deleted
clusterissuer.cert-manager.io "selfsigned" deleted
certificate.cert-manager.io "pod-identity-webhook" deleted
kubectl delete -f deploy/auth.yaml
serviceaccount "pod-identity-webhook" deleted
role.rbac.authorization.k8s.io "pod-identity-webhook" deleted
rolebinding.rbac.authorization.k8s.io "pod-identity-webhook" deleted
clusterrole.rbac.authorization.k8s.io "pod-identity-webhook" deleted
clusterrolebinding.rbac.authorization.k8s.io "pod-identity-webhook" deleted
kubectl delete secret pod-identity-webhook-cert
secret "pod-identity-webhook-cert" deleted

Copy link
Member

@dims dims left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dims dims merged commit 131e8e1 into aws:master Feb 6, 2023
@dims
Copy link
Member

dims commented Feb 6, 2023

thanks @chickenbeef

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants