Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Validation webhook for ingress #6341

Merged
merged 6 commits into from
Aug 23, 2023
Merged

Validation webhook for ingress #6341

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
800901e
Validate `Ingress` annotations
MustafaSaber Aug 7, 2023
192701f
Rename validation webhook and narrow the condition
MustafaSaber Aug 8, 2023
af66845
Update skipper version for webhook binary
MustafaSaber Aug 15, 2023
ac7b3a8
Use same application for skipper
MustafaSaber Aug 16, 2023
b2e9c67
fix deletion order
MustafaSaber Aug 16, 2023
7993869
fix metrics job naming and path
MustafaSaber Aug 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions cluster/manifests/01-admission-control/routegroups-webhook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
{{ if eq .Cluster.ConfigItems.routegroups_validation "enabled" }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: "routegroup-admitter.teapot.zalan.do"
name: "skipper-admitter.teapot.zalan.do"
labels:
application: routegroups-admission-webhook
application: skipper-ingress
component: webhook
webhooks:
{{ if eq .Cluster.ConfigItems.routegroups_validation "enabled" }}
- name: "routegroup-admitter.teapot.zalan.do"
rules:
- operations: ["CREATE", "UPDATE"]
Expand All @@ -19,3 +20,15 @@ webhooks:
sideEffects: None
timeoutSeconds: 5
{{ end }}
- name: "ingress-admitter.teapot.zalan.do"
rules:
- operations: ["CREATE", "UPDATE"]
apiGroups: ["networking.k8s.io"]
apiVersions: ["v1"]
resources: ["ingresses"]
clientConfig:
url: "https://localhost:9085/ingresses"
caBundle: "{{ .ConfigItems.ca_cert_decompressed }}"
admissionReviewVersions: ["v1"]
sideEffects: None
timeoutSeconds: 5
4 changes: 3 additions & 1 deletion cluster/manifests/deletions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
# everything defined under here will be deleted before applying the manifests
pre_apply:
- name: "skipper-admitter.teapot.zalan.do"
AlexanderYastrebov marked this conversation as resolved.
Show resolved Hide resolved
kind: ValidatingWebhookConfiguration
{{ if ne .Cluster.ConfigItems.routegroups_validation "enabled" }}
- name: "routegroup-admitter.teapot.zalan.do"
kind: ValidatingWebhookConfiguration
kind: ValidatingWebhookConfiguration
{{ end }}
- name: cronjob-monitor
namespace: kube-system
Expand Down
8 changes: 3 additions & 5 deletions cluster/node-pools/master-default/userdata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,9 +241,8 @@ write_files:
- mountPath: /etc/kubernetes/admission-controller-kubeconfig
name: admission-controller-kubeconfig
readOnly: true
{{- if or (eq .Cluster.ConfigItems.routegroups_validation "provisioned") (eq .Cluster.ConfigItems.routegroups_validation "enabled") }}
AlexanderYastrebov marked this conversation as resolved.
Show resolved Hide resolved
- name: routegroups-admission-webhook
image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.16.167
- name: skipper-admission-webhook
image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/skipper:v0.17.1
args:
- webhook
- --address=:9085
Expand All @@ -270,7 +269,6 @@ write_files:
- mountPath: /etc/kubernetes/ssl
name: ssl-certs-kubernetes
readOnly: true
{{- end}}
- image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/k8s-authnz-webhook:master-127
name: webhook
ports:
Expand Down Expand Up @@ -491,7 +489,7 @@ write_files:
-> disableAccessLog()
-> setPath("/metrics")
-> "http://127.0.0.1:8081";
routegroups_admission_webhook: Path("/routegroups-admission-webhook")
skipper_admission_webhook: Path("/skipper-admission-webhook")
AlexanderYastrebov marked this conversation as resolved.
Show resolved Hide resolved
-> disableAccessLog()
-> setPath("/metrics")
-> "https://127.0.0.1:9085";
Expand Down