Add validation/mutating webhook server for Fission custom resources (#2608)
* add webhook server * add metrics port * Add self-signed cert generation in helm chart for webhooks (#2611) * remove cert-manager installation * update fission webhook charts * remove extra cluster role * add mutating webhook for pkg creation * Service name and bundle fixes (#2614) * caBundle templating * Rename fission.svc to fission-webhook.svc * update package build status Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
This commit is contained in:
neha_gupta
co-authored by
shaunak_deshmukh
shaunak_deshmukh
parent
31dfc3e4d3
commit
9a07d7d96b
@@ -0,0 +1,43 @@
|
||||
|
||||
|
||||
{{- define "fision.selfSignedCABundleCertPEM" -}}
|
||||
{{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
|
||||
{{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
|
||||
{{- $caKeypair.Cert -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "webhook.caBundleCertPEM" -}}
|
||||
{{- if .Values.webhook.caBundlePEM -}}
|
||||
{{- trim .Values.webhook.caBundlePEM -}}
|
||||
{{- else -}}
|
||||
{{- $caKeypair := .selfSignedCAKeypair | default (genCA "fission-ca" 1825) -}}
|
||||
{{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
|
||||
{{- $caKeypair.Cert -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "webhook.certPEM" -}}
|
||||
{{- if .Values.webhook.crtPEM -}}
|
||||
{{- trim .Values.webhook.crtPEM -}}
|
||||
{{- else -}}
|
||||
{{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace }}
|
||||
{{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
|
||||
{{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
|
||||
{{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) }}
|
||||
{{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
|
||||
{{- $webhookServerTLSKeypair.Cert -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "webhook.keyPEM" -}}
|
||||
{{- if .Values.webhook.keyPEM -}}
|
||||
{{ trim .Values.webhook.keyPEM }}
|
||||
{{- else -}}
|
||||
{{- $webhookName := printf "%s.%s.svc" (include "fission-webhook.svc" .) .Release.Namespace -}}
|
||||
{{- $fullWebhookName := printf "%s.%s.svc.cluster.local" (include "fission-webhook.svc" .) .Release.Namespace -}}
|
||||
{{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
|
||||
{{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert $webhookName nil (list $webhookName $fullWebhookName) 1825 $webhookCA) -}}
|
||||
{{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
|
||||
{{- $webhookServerTLSKeypair.Key -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -79,4 +79,11 @@ This template generates the image name for the deployment depending on the value
|
||||
{{- else }}
|
||||
value: {{ .Values.defaultNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Define the svc's name
|
||||
*/}}
|
||||
{{- define "fission-webhook.svc" -}}
|
||||
{{- printf "webhook-service" -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,38 @@
|
||||
{{- $certManagerEnabled := .Values.webhook.certManager.enabled }}
|
||||
|
||||
{{- if not $certManagerEnabled }}
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: fission-webhook-certs
|
||||
labels:
|
||||
app.kubernetes.io/component: webhook-secret
|
||||
type: Opaque
|
||||
data:
|
||||
ca.crt: {{ b64enc (include "webhook.caBundleCertPEM" .) }}
|
||||
tls.crt: {{ b64enc (include "webhook.certPEM" .) }}
|
||||
tls.key: {{ b64enc (include "webhook.keyPEM" .) }}
|
||||
|
||||
{{- else }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: fission-selfsigned-issuer
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: fission-webhook-cert
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
secretName: fission-webhook-certs
|
||||
dnsNames:
|
||||
- "webhook-service.{{ .Release.Namespace }}.svc"
|
||||
- "webhook-service.{{ .Release.Namespace }}.svc.cluster.local "
|
||||
issuerRef:
|
||||
name: fission-selfsigned-issuer
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,55 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: webhook
|
||||
labels:
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
svc: webhook-service
|
||||
application: fission-webhook
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
svc: webhook-service
|
||||
application: fission-webhook
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
svc: webhook-service
|
||||
application: fission-webhook
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "/metrics"
|
||||
prometheus.io/port: "8080"
|
||||
spec:
|
||||
{{- if .Values.webhook.securityContext.enabled }}
|
||||
securityContext: {{- omit .Values.webhook.securityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: webhook
|
||||
image: {{ include "fission-bundleImage" . | quote }}
|
||||
imagePullPolicy: {{ .Values.pullPolicy }}
|
||||
command: ["/fission-bundle"]
|
||||
args: ["--webhookPort", "9443"]
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: serving-certs
|
||||
readOnly: true
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: metrics
|
||||
volumes:
|
||||
- name: serving-certs
|
||||
secret:
|
||||
secretName: fission-webhook-certs
|
||||
serviceAccountName: fission-webhook
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraCoreComponentPodConfig }}
|
||||
{{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: fission-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: webhook-monitor
|
||||
{{- if .Values.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.serviceMonitor.namespace }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.additionalServiceMonitorLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
svc: webhook-service
|
||||
endpoints:
|
||||
- targetPort: 8080
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: webhook-service
|
||||
labels:
|
||||
svc: webhook-service
|
||||
application: fission-webhook
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
type: {{ .Values.serviceType }}
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 9443
|
||||
selector:
|
||||
svc: webhook-service
|
||||
@@ -0,0 +1,203 @@
|
||||
---
|
||||
{{- $caCert := include "webhook.caBundleCertPEM" . -}}
|
||||
{{- $crtPEM := include "webhook.certPEM" . -}}
|
||||
{{- $keyPEM := include "webhook.keyPEM" . -}}
|
||||
|
||||
{{- $certManagerEnabled := $.Values.webhook.certManager.enabled }}
|
||||
{{- $caBundleValue := "" -}}
|
||||
{{- if $certManagerEnabled }}
|
||||
{{- $caBundleValue = "Cg==" -}}
|
||||
{{- else }}
|
||||
{{- $caBundleValue = ternary (b64enc $caCert) (b64enc (trim $crtPEM)) (empty $crtPEM) -}}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: mutating-webhook-configuration
|
||||
{{- if $certManagerEnabled }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate-fission-io-v1-package
|
||||
failurePolicy: Fail
|
||||
name: mpackage.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- packages
|
||||
sideEffects: None
|
||||
---
|
||||
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: validating-webhook-configuration
|
||||
{{- if $certManagerEnabled }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/fission-webhook-cert"
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-environment
|
||||
failurePolicy: Fail
|
||||
name: venvironment.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- environments
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-function
|
||||
failurePolicy: Fail
|
||||
name: vfunction.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- functions
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-httptrigger
|
||||
failurePolicy: Fail
|
||||
name: vhttptrigger.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- httptriggers
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-kuberneteswatchtrigger
|
||||
failurePolicy: Fail
|
||||
name: vkuberneteswatchtrigger.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kuberneteswatchtriggers
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-messagequeuetrigger
|
||||
failurePolicy: Fail
|
||||
name: vmessagequeuetrigger.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- messagequeuetriggers
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-package
|
||||
failurePolicy: Fail
|
||||
name: vpackage.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- packages
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
caBundle: {{ $caBundleValue }}
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-fission-io-v1-timetrigger
|
||||
failurePolicy: Fail
|
||||
name: vtimetrigger.fission.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fission.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- timetriggers
|
||||
sideEffects: None
|
||||
@@ -361,6 +361,44 @@ controller:
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
|
||||
## webhook is the component that validates API calls.
|
||||
## It contains validation and mutation for functions, triggers, environments, Kubernetes event watches, etc.
|
||||
##
|
||||
webhook:
|
||||
## Pod resources as:
|
||||
## resources:
|
||||
## limits:
|
||||
## cpu: <tbd>
|
||||
## memory: <tbd>
|
||||
## requests:
|
||||
## cpu: <tbd>
|
||||
## memory: <tbd>
|
||||
##
|
||||
resources: {}
|
||||
|
||||
certManager:
|
||||
enabled: false
|
||||
|
||||
caBundlePEM: |
|
||||
|
||||
crtPEM: |
|
||||
|
||||
keyPEM: |
|
||||
|
||||
|
||||
## Security Context
|
||||
## It holds pod-level and container level security configuration.
|
||||
## This is an experimental section, please verify before enabling in production.
|
||||
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
|
||||
securityContext:
|
||||
enabled: false
|
||||
## Mark it false, if you want to stop the non root user validation
|
||||
runAsNonRoot: true
|
||||
fsGroup: 10001
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
|
||||
|
||||
## kubewatcher watches the Kubernetes API and invokes functions associated with watches, sending the watch event to the function.
|
||||
##
|
||||
kubewatcher:
|
||||
|
||||
Reference in New Issue
Block a user