Add validation/mutating webhook server for Fission custom resources (#2608)

* add webhook server * add metrics port * Add self-signed cert generation in helm chart for webhooks (#2611) * remove cert-manager installation * update fission webhook charts * remove extra cluster role * add mutating webhook for pkg creation * Service name and bundle fixes (#2614) * caBundle templating * Rename fission.svc to fission-webhook.svc * update package build status Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>
2022-11-13 17:31:31 +05:30
parent 31dfc3e4d3
commit 9a07d7d96b
23 changed files with 1181 additions and 3 deletions
@@ -0,0 +1,68 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var canaryconfiglog = loggerfactory.GetLogger().Named("canaryconfig-resource")
+
+func (r *CanaryConfig) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-canaryconfig,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=canaryconfigs,verbs=create;update,versions=v1,name=mcanaryconfig.fission.io,admissionReviewVersions=v1
+// Refer Makefile -> generate-webhooks to generate config for manifests
+
+var _ webhook.Defaulter = &CanaryConfig{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *CanaryConfig) Default() {
+	canaryconfiglog.Debug("default", zap.String("name", r.Name))
+}
+
+// user can change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+// Validation webhooks can be added by adding tag: kubebuilder:webhook:path=/validate-fission-io-v1-canaryconfig,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=canaryconfigs,verbs=create;update,versions=v1,name=vcanaryconfig.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &CanaryConfig{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *CanaryConfig) ValidateCreate() error {
+	canaryconfiglog.Debug("validate create", zap.String("name", r.Name))
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *CanaryConfig) ValidateUpdate(old runtime.Object) error {
+	canaryconfiglog.Debug("validate update", zap.String("name", r.Name))
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *CanaryConfig) ValidateDelete() error {
+	canaryconfiglog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,72 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var environmentlog = loggerfactory.GetLogger().Named("environment-resource")
+
+func (r *Environment) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-environment,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create;update,versions=v1,name=menvironment.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &Environment{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *Environment) Default() {
+	environmentlog.Debug("default", zap.String("name", r.Name))
+}
+
+// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-environment,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=environments,verbs=create,versions=v1,name=venvironment.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &Environment{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *Environment) ValidateCreate() error {
+	environmentlog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("Environment", err)
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *Environment) ValidateUpdate(old runtime.Object) error {
+	environmentlog.Debug("validate update", zap.String("name", r.Name))
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *Environment) ValidateDelete() error {
+	environmentlog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,74 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var functionlog = loggerfactory.GetLogger().Named("function-resource")
+
+func (r *Function) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-function,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=mfunction.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &Function{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *Function) Default() {
+}
+
+// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-function,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=functions,verbs=create;update,versions=v1,name=vfunction.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &Function{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *Function) ValidateCreate() error {
+	functionlog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		return AggregateValidationErrors("Function", err)
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *Function) ValidateUpdate(old runtime.Object) error {
+	functionlog.Debug("validate update", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		return AggregateValidationErrors("Function", err)
+	}
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *Function) ValidateDelete() error {
+	functionlog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,79 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var httptriggerlog = loggerfactory.GetLogger().Named("httptrigger-resource")
+
+func (r *HTTPTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-httptrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=mhttptrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &HTTPTrigger{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *HTTPTrigger) Default() {
+	httptriggerlog.Debug("default", zap.String("name", r.Name))
+}
+
+// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-httptrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=httptriggers,verbs=create;update,versions=v1,name=vhttptrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &HTTPTrigger{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (t *HTTPTrigger) ValidateCreate() error {
+	httptriggerlog.Debug("validate create", zap.String("name", t.Name))
+	err := t.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("HTTPTrigger", err)
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *HTTPTrigger) ValidateUpdate(old runtime.Object) error {
+	httptriggerlog.Debug("validate update", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("HTTPTrigger", err)
+		return err
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *HTTPTrigger) ValidateDelete() error {
+	httptriggerlog.Debug("validate delete", zap.String("name", r.Name))
+
+	return nil
+}
@@ -0,0 +1,72 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var kuberneteswatchtriggerlog = loggerfactory.GetLogger().Named("kuberneteswatchtrigger-resource")
+
+func (r *KubernetesWatchTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-kuberneteswatchtrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create;update,versions=v1,name=mkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &KubernetesWatchTrigger{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *KubernetesWatchTrigger) Default() {
+	kuberneteswatchtriggerlog.Debug("default", zap.String("name", r.Name))
+}
+
+// user: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-kuberneteswatchtrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=kuberneteswatchtriggers,verbs=create,versions=v1,name=vkuberneteswatchtrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &KubernetesWatchTrigger{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *KubernetesWatchTrigger) ValidateCreate() error {
+	kuberneteswatchtriggerlog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("Watch", err)
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *KubernetesWatchTrigger) ValidateUpdate(old runtime.Object) error {
+	// WATCH UPDATE NOT IMPLEMENTED
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *KubernetesWatchTrigger) ValidateDelete() error {
+	kuberneteswatchtriggerlog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,77 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var messagequeuetriggerlog = loggerfactory.GetLogger().Named("messagequeuetrigger-resource")
+
+func (r *MessageQueueTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-messagequeuetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=messagequeuetriggers,verbs=create;update,versions=v1,name=mmessagequeuetrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &MessageQueueTrigger{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *MessageQueueTrigger) Default() {
+	messagequeuetriggerlog.Debug("default", zap.String("name", r.Name))
+}
+
+// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-messagequeuetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=messagequeuetriggers,verbs=create;update,versions=v1,name=vmessagequeuetrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &MessageQueueTrigger{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *MessageQueueTrigger) ValidateCreate() error {
+	messagequeuetriggerlog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("MessageQueueTrigger", err)
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *MessageQueueTrigger) ValidateUpdate(old runtime.Object) error {
+	messagequeuetriggerlog.Debug("validate update", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("MessageQueueTrigger", err)
+		return err
+	}
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *MessageQueueTrigger) ValidateDelete() error {
+	messagequeuetriggerlog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,98 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+
+	"github.com/dustin/go-humanize"
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	ferror "github.com/fission/fission/pkg/error"
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var packagelog = loggerfactory.GetLogger().Named("package-resource")
+
+func (r *Package) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+//+kubebuilder:webhook:path=/mutate-fission-io-v1-package,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=mpackage.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &Package{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *Package) Default() {
+	packagelog.Debug("default", zap.String("name", r.Name))
+	if r.Status.BuildStatus == "" {
+		r.Status.BuildStatus = BuildStatusPending
+	}
+}
+
+// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-package,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=packages,verbs=create;update,versions=v1,name=vpackage.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &Package{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *Package) ValidateCreate() error {
+	packagelog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("Package", err)
+		return err
+	}
+
+	// Ensure size limits
+	if len(r.Spec.Source.Literal) > int(ArchiveLiteralSizeLimit) {
+		err := ferror.MakeError(ferror.ErrorInvalidArgument,
+			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
+		return err
+	}
+	if len(r.Spec.Deployment.Literal) > int(ArchiveLiteralSizeLimit) {
+		err := ferror.MakeError(ferror.ErrorInvalidArgument,
+			fmt.Sprintf("Package literal larger than %s", humanize.Bytes(uint64(ArchiveLiteralSizeLimit))))
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *Package) ValidateUpdate(old runtime.Object) error {
+	packagelog.Debug("validate update", zap.String("name", r.Name))
+	err := r.Validate()
+
+	if err != nil {
+		err = AggregateValidationErrors("Package", err)
+		return err
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *Package) ValidateDelete() error {
+	packagelog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,92 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"github.com/robfig/cron"
+	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	ferror "github.com/fission/fission/pkg/error"
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+// log is for logging in this package.
+var timetriggerlog = loggerfactory.GetLogger().Named("timetrigger-resource")
+
+func (r *TimeTrigger) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// Admission webhooks can be added by adding tag: kubebuilder:webhook:path=/mutate-fission-io-v1-timetrigger,mutating=true,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=mtimetrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &TimeTrigger{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *TimeTrigger) Default() {
+	timetriggerlog.Debug("default", zap.String("name", r.Name))
+}
+
+// user change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-fission-io-v1-timetrigger,mutating=false,failurePolicy=fail,sideEffects=None,groups=fission.io,resources=timetriggers,verbs=create;update,versions=v1,name=vtimetrigger.fission.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &TimeTrigger{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *TimeTrigger) ValidateCreate() error {
+	timetriggerlog.Debug("validate create", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("TimeTrigger", err)
+		return err
+	}
+
+	_, err = cron.Parse(r.Spec.Cron)
+	if err != nil {
+		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
+		return err
+	}
+	return nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *TimeTrigger) ValidateUpdate(old runtime.Object) error {
+	timetriggerlog.Debug("validate update", zap.String("name", r.Name))
+	err := r.Validate()
+	if err != nil {
+		err = AggregateValidationErrors("TimeTrigger", err)
+		return err
+	}
+
+	_, err = cron.Parse(r.Spec.Cron)
+	if err != nil {
+		err = ferror.MakeError(ferror.ErrorInvalidArgument, "TimeTrigger cron spec is not valid")
+		return err
+	}
+
+	return nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *TimeTrigger) ValidateDelete() error {
+	timetriggerlog.Debug("validate delete", zap.String("name", r.Name))
+	return nil
+}
@@ -0,0 +1,85 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhook
+
+import (
+	"context"
+	"os"
+
+	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
+	// to ensure that exec-entrypoint and run can make use of them.
+
+	"go.uber.org/zap"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+
+	v1 "github.com/fission/fission/pkg/apis/core/v1"
+	"github.com/fission/fission/pkg/generated/clientset/versioned/scheme"
+	//+kubebuilder:scaffold:imports
+)
+
+type WebhookInjector interface {
+	SetupWebhookWithManager(mgr manager.Manager) error
+}
+
+func Start(ctx context.Context, logger *zap.Logger, port int) (err error) {
+
+	wLogger := logger.Named("webhook")
+
+	metricsAddr := os.Getenv("METRICS_ADDR")
+	if metricsAddr == "" {
+		metricsAddr = ":8080"
+	}
+	// Setup a Manager
+	mgr, err := manager.New(config.GetConfigOrDie(), manager.Options{
+		Scheme:             scheme.Scheme,
+		Port:               port,
+		MetricsBindAddress: metricsAddr,
+	})
+	if err != nil {
+		wLogger.Error("unable to set up overall controller manager", zap.Error(err))
+		return err
+	}
+
+	// Setup webhooks
+
+	webhookInjectors := []WebhookInjector{
+		&v1.CanaryConfig{},
+		&v1.Environment{},
+		&v1.Package{},
+		&v1.Function{},
+		&v1.HTTPTrigger{},
+		&v1.MessageQueueTrigger{},
+		&v1.TimeTrigger{},
+		&v1.KubernetesWatchTrigger{},
+	}
+
+	for _, injector := range webhookInjectors {
+		if err := injector.SetupWebhookWithManager(mgr); err != nil {
+			wLogger.Error("unable to create webhook", zap.Error(err))
+			return err
+		}
+	}
+
+	wLogger.Info("starting manager")
+	if err := mgr.Start(ctx); err != nil {
+		wLogger.Error("unable to run manager", zap.Error(err))
+		return err
+	}
+	return nil
+}