CCO-363: Adding azure identidy webhook

bindata/v4.1.0/aws-pod-identity-webhook/deployment.yaml

@@ -29,7 +29,7 @@ spec:
         - --tls-cert=/var/run/app/certs/tls.crt
         - --tls-key=/var/run/app/certs/tls.key
         - --namespace=openshift-cloud-credential-operator
-        - --port=6443
+        - --port=9443
         - --service-name=pod-identity-webhook
         - --annotation-prefix=eks.amazonaws.com # TODO: use openshift.io based prefix
         - --token-audience=sts.amazonaws.com

bindata/v4.1.0/aws-pod-identity-webhook/mutatingwebhook.yaml

@@ -5,24 +5,24 @@ metadata:
   annotations:
     service.beta.openshift.io/inject-cabundle: "true"
 webhooks:
-- name: pod-identity-webhook.amazonaws.com
-  admissionReviewVersions:
-  - v1beta1
-  failurePolicy: Ignore
-  sideEffects: None
-  clientConfig:
-    service:
-      name: pod-identity-webhook
-      namespace: openshift-cloud-credential-operator
-      path: "/mutate"
-  namespaceSelector:
-    matchExpressions:
-    - key: openshift.io/run-level
-      operator: NotIn
-      values:
-      - "0"
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
+  - name: pod-identity-webhook.aws.mutate.io
+    admissionReviewVersions:
+      - v1beta1
+    failurePolicy: Ignore
+    sideEffects: None
+    clientConfig:
+      service:
+        name: pod-identity-webhook
+        namespace: openshift-cloud-credential-operator
+        path: "/mutate"
+    namespaceSelector:
+      matchExpressions:
+        - key: openshift.io/run-level
+          operator: NotIn
+          values:
+            - "0"
+    rules:
+      - operations: [ "CREATE" ]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods"]

bindata/v4.1.0/azure-pod-identity-webhook/deployment.yaml

@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    azure-workload-identity.io/system: "true"
+  name: pod-identity-webhook
+  namespace: openshift-cloud-credential-operator
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: pod-identity-webhook
+  template:
+    metadata:
+      labels:
+        app: pod-identity-webhook
+    spec:
+      containers:
+        - args:
+            - --log-level=info
+            - --disable-cert-rotation=true
+          command:
+            - /usr/bin/azure-workload-identity-webhook
+          env:
+            - name: AZURE_TENANT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: azure-credentials
+                  key: azure_tenant_id
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+          image: ${IMAGE}
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 6
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          name: pod-identity-webhook
+          ports:
+            - containerPort: 6443
+              name: webhook-server
+              protocol: TCP
+            - containerPort: 8095
+              name: metrics
+              protocol: TCP
+            - containerPort: 9440
+              name: healthz
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: healthz
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            limits:
+              cpu: 100m
+              memory: 30Mi
+            requests:
+              cpu: 100m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ "ALL" ]
+          volumeMounts:
+            - mountPath: /certs
+              name: webhook-certs
+              readOnly: true
+      nodeSelector:
+        node-role.kubernetes.io/master: ""
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoExecute
+          key: node.kubernetes.io/unreachable
+          operator: Exists
+          tolerationSeconds: 120
+        - effect: NoExecute
+          key: node.kubernetes.io/not-ready
+          operator: Exists
+          tolerationSeconds: 120
+      priorityClassName: system-cluster-critical
+      serviceAccountName: pod-identity-webhook
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: webhook-certs
+          secret:
+            secretName: pod-identity-webhook

bindata/v4.1.0/azure-pod-identity-webhook/mutatingwebhook.yaml

@@ -0,0 +1,32 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: pod-identity-webhook
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
+webhooks:
+  - admissionReviewVersions:
+      - v1
+      - v1beta1
+    clientConfig:
+      service:
+        name: pod-identity-webhook
+        namespace: openshift-cloud-credential-operator
+        path: /mutate-v1-pod
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    name: pod-identity-webhook.azure.mutate.io
+    objectSelector:
+      matchLabels:
+        azure.workload.identity/use: "true"
+    reinvocationPolicy: IfNeeded
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - pods
+    sideEffects: None

bindata/v4.1.0/aws-pod-identity-webhook/svc.yaml → bindata/v4.1.0/common/svc.yaml

@@ -11,6 +11,6 @@ metadata:
 spec:
   ports:
   - port: 443
-    targetPort: 6443
+    targetPort: 9443
   selector:
     app: pod-identity-webhook

manifests/03-deployment.yaml

@@ -69,6 +69,8 @@ spec:
         env:
         - name: RELEASE_VERSION
           value: 0.0.1-snapshot
+        - name: AZURE_POD_IDENTITY_WEBHOOK_IMAGE
+          value: quay.io/openshift/azure-workload-identity-webhook:latest
         - name: AWS_POD_IDENTITY_WEBHOOK_IMAGE
           value: quay.io/openshift/aws-pod-identity-webhook:latest
         image: quay.io/openshift/origin-cloud-credential-operator:latest

manifests/image-references

@@ -10,6 +10,10 @@ spec:
     from:
       kind: DockerImage
       Name: quay.io/openshift/aws-pod-identity-webhook
+  - name: azure-pod-identity-webhook
+      from:
+        kind: DockerImage
+        Name: quay.io/openshift/azure-workload-identity-webhook:latest
   - name: kube-rbac-proxy
     from:
       kind: DockerImage