Add webhook devops files.

develop/webhook/.gitignore

@@ -0,0 +1,5 @@
+certificates/*
+
+prepare-certificate.yaml
+validating-webhook-configuration.yaml
+launch.json

develop/webhook/0.prepare-certificates.yaml.tmpl

@@ -0,0 +1,59 @@
+# Install cert-manager.io: https://cert-manager.io/docs/installation/
+---
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: my-selfsigned-ca
+  namespace: kube-system
+spec:
+  isCA: true
+  commonName: my-selfsigned-ca
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: my-ca-issuer
+  namespace: kube-system
+spec:
+  ca:
+    secretName: root-secret
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: serving-cert
+  namespace: kube-system
+spec:
+  dnsNames:
+  - bigip-kubernetes-gateway-webhook.kube-system.svc
+  - bigip-kubernetes-gateway-webhook.kube-system.svc.cluster.local
+  ipAddresses:
+    - 127.0.0.1
+    - 0.0.0.0
+    - ${local_host_ipaddr}
+  issuerRef:
+    kind: Issuer
+    name: my-ca-issuer
+  secretName: webhook-server-cert

develop/webhook/1.validating-webhook-configuration.yaml.tmpl

@@ -0,0 +1,91 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: validating-webhook-configuration
+  annotations:
+    cert-manager.io/inject-ca-from: kube-system/my-selfsigned-ca
+webhooks:
+  - admissionReviewVersions:
+      - v1beta1
+      - v1
+    clientConfig:
+      # service:
+        # name: webhook-service
+        # namespace: system
+      url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-gatewayclass"
+    failurePolicy: Fail
+    name: vgwc.kb.io
+    rules:
+      - apiGroups:
+          - gateway.networking.k8s.io
+        apiVersions:
+        - v1beta1
+        operations: ["*"]
+        resources:
+          - gatewayclasses
+    sideEffects: None
+  - admissionReviewVersions:
+      - v1beta1
+      - v1
+    clientConfig:
+      service:
+        # name: bigip-kubernetes-gateway
+        # namespace: kube-system
+        # path: /validate-gateway-networking-k8s-io-v1beta1-gateway
+        # port: 9443
+      url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-gateway"
+    failurePolicy: Fail
+    name: vgw.kb.io
+    rules:
+      - apiGroups:
+          - gateway.networking.k8s.io
+        apiVersions:
+        - v1beta1
+        operations: ["*"]
+        resources:
+          - gateways
+    sideEffects: None
+  - admissionReviewVersions:
+      - v1beta1
+      - v1
+    clientConfig:
+      # service:
+      #   name: bigip-kubernetes-gateway
+      #   namespace: kube-system
+      #   path: /validate-gateway-networking-k8s-io-v1beta1-httproute
+      #   port: 9443
+      url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-httproute"
+    failurePolicy: Fail
+    name: vhr.kb.io
+    rules:
+      - apiGroups:
+          - gateway.networking.k8s.io
+        apiVersions:
+        - v1beta1
+        operations: ["*"]
+        resources:
+          - httproutes
+    sideEffects: None
+  - admissionReviewVersions:
+      - v1beta1
+      - v1
+    clientConfig:
+      # service:
+      #   name: bigip-kubernetes-gateway
+      #   namespace: kube-system
+      #   path: /validate-gateway-networking-k8s-io-v1beta1-referencegrant
+      #   port: 9443
+      url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-referencegrant"
+    failurePolicy: Fail
+    name: vrg.kb.io
+    rules:
+      - apiGroups:
+          - gateway.networking.k8s.io
+        apiVersions:
+        - v1beta1
+        operations: ["*"]
+        resources:
+          - referencegrants
+    sideEffects: None

develop/webhook/2.vscode-launch.json.tmpl

@@ -0,0 +1,19 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "GO: Launch webhook program",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "\${workspaceFolder}/cmd/webhook",
+            "args": [
+                "--controller-name",            "f5.io/gateway-controller-name",
+                "--log-level",                  "trace",
+                "--certificate-directory",      "\${workspaceFolder}/develop/webhook/certificates",
+                "--kubeconfig",                 "${kube_config}",
+                "--validates",                  "gateway.gatewayClassName,gateway.listeners.tls.certificateRefs,httproute.parentRefs,httproute.rules.backendRefs"
+            ]
+        }
+    ]
+}

develop/webhook/README.md

@@ -0,0 +1,17 @@
+This guide aims to make it clear how to develop bigip-kubernetes-gateway-webhook program.
+
+Refer to `setup-webhook-dev.sh` for more details.
+
+Basically, it setup 3 things for developing webhook program:
+
+* create the webhook server crt/key via cert-manager.io, see `0.prepare-cerfitifcate.yaml.tmpl` for detail.
+
+* create the webhook validating configuration, see `1.validating-webhook-configuration.yaml.tmpl` for detail.
+
+* create the vscode `launch.json` for debugging.
+
+During the process, variables are needed:
+
+* `local_host_ipaddr`: the callback IP address for webhook API.
+
+* `kube_config`: the kubeconfig file for accessing kubernetes API.

develop/webhook/setup-webhook-dev.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+local_host_ipaddr=10.250.64.107
+kube_config=/Users/zong/.kube/config
+
+k="kubectl --kubeconfig $kube_config"
+
+eval "cat <<EOF
+$(< 0.prepare-certificates.yaml.tmpl)
+EOF
+" > prepare-certificate.yaml
+
+$k apply -f prepare-certificate.yaml
+if [ $? -ne 0 ]; then 
+    echo "Error: Failed to create certificate"
+    exit 1; 
+fi
+
+while true; do 
+    $k get secret/webhook-server-cert -n kube-system; 
+    if [ $? -eq 0 ]; then break; fi
+    echo "waiting for secret webhook-server-cert ready"; sleep 1; 
+done
+
+$k get secret webhook-server-cert -n kube-system -o json | jq '.data["tls.crt"]' | tr -d '"' | base64 -d > certificates/tls.crt
+$k get secret webhook-server-cert -n kube-system -o json | jq '.data["tls.key"]' | tr -d '"' | base64 -d > certificates/tls.key
+
+
+eval "cat <<EOF
+$(< 1.validating-webhook-configuration.yaml.tmpl)
+EOF
+" > validating-webhook-configuration.yaml
+
+$k apply -f validating-webhook-configuration.yaml
+
+
+eval "cat <<EOF
+$(< 2.vscode-launch.json.tmpl)
+EOF
+" > launch.json
+
+echo "Copy the launch.json to .vscode folder in the project root folder"