From 52cf59704104eb8c19eda3e2d4af268f9b0373f0 Mon Sep 17 00:00:00 2001 From: Bright Zheng Date: Sat, 2 Oct 2021 21:44:55 +0800 Subject: [PATCH] docs: use one patch for each webhook --- Makefile | 37 +++++++++++++++++-------------------- docs/dev-guide.md | 38 ++++++++++++++++++++------------------ 2 files changed, 37 insertions(+), 38 deletions(-) diff --git a/Makefile b/Makefile index 8e1635f9..5e25fc4a 100644 --- a/Makefile +++ b/Makefile @@ -83,7 +83,7 @@ generate: controller-gen # LAPTOP_HOST_IP= make dev-setup # For example: # LAPTOP_HOST_IP=192.168.10.101 make dev-setup -define tls_cnf +define TLS_CNF [ req ] default_bits = 4096 distinguished_name = req_distinguished_name @@ -99,11 +99,11 @@ subjectAltName = @alt_names [alt_names] IP.1 = $(LAPTOP_HOST_IP) endef -export tls_cnf -dev-setup: +export TLS_CNF +dev-setup: kubectl -n capsule-system scale deployment capsule-controller-manager --replicas=0 mkdir -p /tmp/k8s-webhook-server/serving-certs - echo "$${tls_cnf}" > _tls.cnf + echo "$${TLS_CNF}" > _tls.cnf openssl req -newkey rsa:4096 -days 3650 -nodes -x509 \ -subj "/C=SG/ST=SG/L=SG/O=CAPSULE/CN=CAPSULE" \ -extensions req_ext \ @@ -114,23 +114,20 @@ dev-setup: export WEBHOOK_URL="https://$${LAPTOP_HOST_IP}:9443"; \ export CA_BUNDLE=`openssl base64 -in /tmp/k8s-webhook-server/serving-certs/tls.crt | tr -d '\n'`; \ kubectl patch MutatingWebhookConfiguration capsule-mutating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/mutate-v1-namespace-owner-reference\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ + --type='json' -p="[\ + {'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/mutate-v1-namespace-owner-reference\",'caBundle':\"$${CA_BUNDLE}\"}}\ + ]" && \ kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/cordoning\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/1/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/ingresses\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/2/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/namespaces\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/3/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/networkpolicies\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/4/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/pods\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/5/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/persistentvolumeclaims\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/6/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/services\",'caBundle':\"$${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/7/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/tenants\",'caBundle':\"$${CA_BUNDLE}\"}}]"; + --type='json' -p="[\ + {'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/cordoning\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/1/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/ingresses\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/2/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/namespaces\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/3/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/networkpolicies\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/4/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/pods\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/5/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/persistentvolumeclaims\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/6/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/services\",'caBundle':\"$${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/7/clientConfig', 'value':{'url':\"$${WEBHOOK_URL}/tenants\",'caBundle':\"$${CA_BUNDLE}\"}}\ + ]"; # Build the docker image docker-build: test diff --git a/docs/dev-guide.md b/docs/dev-guide.md index 57d7b7da..83f073f8 100644 --- a/docs/dev-guide.md +++ b/docs/dev-guide.md @@ -180,11 +180,16 @@ To achieve that, there are some necessary steps we need to walk through, which h So the TL;DR answer is: ```sh -# To retrieve your laptop's IP and execute `make dev-setup` +# If you haven't installed or run `make deploy` before, do it first +# Note: please retry if you saw errors +$ make deploy + +# To retrieve your laptop's IP and execute `make dev-setup` to setup dev env # For example: LAPTOP_HOST_IP=192.168.10.101 make dev-setup -$ LAPTOP_HOST_IP= make dev-setup +$ LAPTOP_HOST_IP="" make dev-setup ``` + This is a very common setup for typical Kubernetes Operator development so we'd better walk them through with more details here. 1. Scaling down the deployed Pod(s) to 0 @@ -250,7 +255,9 @@ $ export CA_BUNDLE=`openssl base64 -in /tmp/k8s-webhook-server/serving-certs/tls # Patch the MutatingWebhookConfiguration webhook $ kubectl patch MutatingWebhookConfiguration capsule-mutating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/mutate-v1-namespace-owner-reference\",'caBundle':\"${CA_BUNDLE}\"}}]" + --type='json' -p="[\ + {'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/mutate-v1-namespace-owner-reference\",'caBundle':\"${CA_BUNDLE}\"}}\ + ]" # Verify it if you want $ kubectl get MutatingWebhookConfiguration capsule-mutating-webhook-configuration -o yaml @@ -258,21 +265,16 @@ $ kubectl get MutatingWebhookConfiguration capsule-mutating-webhook-configuratio # Patch the ValidatingWebhookConfiguration webhooks # Note: there is a list of validating webhook endpoints, not just one $ kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/cordoning\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/1/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/ingresses\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/2/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/namespaces\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/3/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/networkpolicies\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/4/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/pods\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/5/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/persistentvolumeclaims\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/6/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/services\",'caBundle':\"${CA_BUNDLE}\"}}]" && \ - kubectl patch ValidatingWebhookConfiguration capsule-validating-webhook-configuration \ - --type='json' -p="[{'op': 'replace', 'path': '/webhooks/7/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/tenants\",'caBundle':\"${CA_BUNDLE}\"}}]" + --type='json' -p="[\ + {'op': 'replace', 'path': '/webhooks/0/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/cordoning\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/1/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/ingresses\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/2/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/namespaces\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/3/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/networkpolicies\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/4/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/pods\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/5/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/persistentvolumeclaims\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/6/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/services\",'caBundle':\"${CA_BUNDLE}\"}},\ + {'op': 'replace', 'path': '/webhooks/7/clientConfig', 'value':{'url':\"${WEBHOOK_URL}/tenants\",'caBundle':\"${CA_BUNDLE}\"}}\ + ]" # Verify it if you want $ kubectl get ValidatingWebhookConfiguration capsule-validating-webhook-configuration -o yaml