From d6f28bfd9e39c11b74fa424ba8300fb950e5bea4 Mon Sep 17 00:00:00 2001 From: Holger Protzek <3481523+hprotzek@users.noreply.github.com> Date: Fri, 26 Feb 2021 09:46:01 +0100 Subject: [PATCH] Removed prometheus and certmanager crd's (#1005) * Removed prometheus and certmanager crd's, use cert-manager helm chart dependency instead * Fixed unit and 2e2 tests. Added servicemonitors and certmanager crd dependencies for tests as testdata. * Run `helm dependency update` * Delete kubevela helm release and namespace if existing * WIP - Bad hack to add the certmanager crds before installing kubevela with cert-manager as dependency. The cert-manager crds are not available, when kubevela Issuer are installed otherwise. * WIP Added admission patch for webhook * WIP Refactored secrets config * WIP Fixed helm chart * WIP Disabled metrics cap, due missing prometheus dependency by default * WIP Added certmanager for e2e tests * WIP Added certmanager for e2e tests * WIP cleanup * Updated docs * Re-added certificate mount path --- Makefile | 5 +- .../vela-core/crds/prometheus-operator.yaml | 465 ------- .../job-patch/clusterrole.yaml | 21 + .../job-patch/clusterrolebinding.yaml | 20 + .../job-patch/job-createSecret.yaml | 50 + .../job-patch/job-patchWebhook.yaml | 49 + .../admission-webhooks/job-patch/role.yaml | 21 + .../job-patch/rolebinding.yaml | 21 + .../job-patch/serviceaccount.yaml | 13 + .../mutatingWebhookConfiguration.yaml | 109 ++ .../validatingWebhookConfiguration.yaml | 132 ++ .../admission-webhooks/webhookService.yaml | 19 + charts/vela-core/templates/cert-manager.yaml | 1087 ----------------- charts/vela-core/templates/certmanager.yaml | 53 + .../templates/kubevela-controller.yaml | 12 +- charts/vela-core/templates/webhook.yaml | 249 ---- charts/vela-core/values.yaml | 33 +- docs/en/install.md | 44 +- .../v1alpha1/metrics/suite_test.go | 3 +- .../v1alpha1/podspecworkload/suite_test.go | 3 +- .../v1alpha1/routes/suite_test.go | 1 + .../v1alpha1/testdata}/crds/cert-manager.yaml | 164 ++- .../testdata/crds/servicemonitors.yaml | 372 ++++++ 23 files changed, 1085 insertions(+), 1861 deletions(-) delete mode 100644 charts/vela-core/crds/prometheus-operator.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/clusterrole.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/clusterrolebinding.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/role.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/rolebinding.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/job-patch/serviceaccount.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml create mode 100644 charts/vela-core/templates/admission-webhooks/webhookService.yaml delete mode 100644 charts/vela-core/templates/cert-manager.yaml create mode 100644 charts/vela-core/templates/certmanager.yaml delete mode 100644 charts/vela-core/templates/webhook.yaml rename {charts/vela-core => pkg/controller/standard.oam.dev/v1alpha1/testdata}/crds/cert-manager.yaml (99%) create mode 100644 pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/servicemonitors.yaml diff --git a/Makefile b/Makefile index 0462106c2..550aaa951 100644 --- a/Makefile +++ b/Makefile @@ -123,7 +123,10 @@ docker-push: docker push ${IMG} e2e-setup: - bin/vela install --set installCertManager=true --image-pull-policy IfNotPresent --image-repo vela-core-test --image-tag $(GIT_COMMIT) + helm repo add jetstack https://charts.jetstack.io + helm repo update + helm upgrade --install --create-namespace --namespace cert-manager cert-manager jetstack/cert-manager --version v1.2.0 --set installCRDs=true --wait + helm upgrade --install --create-namespace --namespace vela-system --set image.pullPolicy=IfNotPresent --set admissionWebhooks.certManager.enabled=true --set image.repository=vela-core-test --set image.tag=$(GIT_COMMIT) --wait kubevela ./charts/vela-core ginkgo version ginkgo -v -r e2e/setup kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=vela-core,app.kubernetes.io/instance=kubevela -n vela-system --timeout=600s diff --git a/charts/vela-core/crds/prometheus-operator.yaml b/charts/vela-core/crds/prometheus-operator.yaml deleted file mode 100644 index e9909dbfe..000000000 --- a/charts/vela-core/crds/prometheus-operator.yaml +++ /dev/null @@ -1,465 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.2.4 - creationTimestamp: null - name: servicemonitors.monitoring.coreos.com -spec: - group: monitoring.coreos.com - names: - kind: ServiceMonitor - listKind: ServiceMonitorList - plural: servicemonitors - singular: servicemonitor - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: ServiceMonitor defines monitoring for a set of services. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Specification of desired Service selection for target discovery - by Prometheus. - properties: - endpoints: - description: A list of endpoints allowed as part of this ServiceMonitor. - items: - description: Endpoint defines a scrapeable endpoint serving Prometheus - metrics. - properties: - basicAuth: - description: 'BasicAuth allow an endpoint to authenticate over - basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints' - properties: - password: - description: The secret in the service monitor namespace - that contains the password for authentication. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - username: - description: The secret in the service monitor namespace - that contains the username for authentication. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - bearerTokenFile: - description: File to read bearer token for scraping targets. - type: string - bearerTokenSecret: - description: Secret to mount to read bearer token for scraping - targets. The secret needs to be in the same namespace as the - service monitor and accessible by the Prometheus Operator. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - honorLabels: - description: HonorLabels chooses the metric's labels on collisions - with target labels. - type: boolean - honorTimestamps: - description: HonorTimestamps controls whether Prometheus respects - the timestamps present in scraped data. - type: boolean - interval: - description: Interval at which metrics should be scraped - type: string - metricRelabelings: - description: MetricRelabelConfigs to apply to samples before - ingestion. - items: - description: 'RelabelConfig allows dynamic rewriting of the - label set, being applied to samples before ingestion. It - defines ``-section of Prometheus - configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' - properties: - action: - description: Action to perform based on regex matching. - Default is 'replace' - type: string - modulus: - description: Modulus to take of the hash of the source - label values. - format: int64 - type: integer - regex: - description: Regular expression against which the extracted - value is matched. Default is '(.*)' - type: string - replacement: - description: Replacement value against which a regex replace - is performed if the regular expression matches. Regex - capture groups are available. Default is '$1' - type: string - separator: - description: Separator placed between concatenated source - label values. default is ';'. - type: string - sourceLabels: - description: The source labels select values from existing - labels. Their content is concatenated using the configured - separator and matched against the configured regular - expression for the replace, keep, and drop actions. - items: - type: string - type: array - targetLabel: - description: Label to which the resulting value is written - in a replace action. It is mandatory for replace actions. - Regex capture groups are available. - type: string - type: object - type: array - params: - additionalProperties: - items: - type: string - type: array - description: Optional HTTP URL parameters - type: object - path: - description: HTTP path to scrape for metrics. - type: string - port: - description: Name of the service port this endpoint refers to. - Mutually exclusive with targetPort. - type: string - proxyUrl: - description: ProxyURL eg http://proxyserver:2195 Directs scrapes - to proxy through this endpoint. - type: string - relabelings: - description: 'RelabelConfigs to apply to samples before scraping. - More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config' - items: - description: 'RelabelConfig allows dynamic rewriting of the - label set, being applied to samples before ingestion. It - defines ``-section of Prometheus - configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' - properties: - action: - description: Action to perform based on regex matching. - Default is 'replace' - type: string - modulus: - description: Modulus to take of the hash of the source - label values. - format: int64 - type: integer - regex: - description: Regular expression against which the extracted - value is matched. Default is '(.*)' - type: string - replacement: - description: Replacement value against which a regex replace - is performed if the regular expression matches. Regex - capture groups are available. Default is '$1' - type: string - separator: - description: Separator placed between concatenated source - label values. default is ';'. - type: string - sourceLabels: - description: The source labels select values from existing - labels. Their content is concatenated using the configured - separator and matched against the configured regular - expression for the replace, keep, and drop actions. - items: - type: string - type: array - targetLabel: - description: Label to which the resulting value is written - in a replace action. It is mandatory for replace actions. - Regex capture groups are available. - type: string - type: object - type: array - scheme: - description: HTTP scheme to use for scraping. - type: string - scrapeTimeout: - description: Timeout after which the scrape is ended - type: string - targetPort: - anyOf: - - type: integer - - type: string - description: Name or number of the pod port this endpoint refers - to. Mutually exclusive with port. - x-kubernetes-int-or-string: true - tlsConfig: - description: TLS configuration to use when scraping the endpoint - properties: - ca: - description: Stuct containing the CA cert to use for the - targets. - properties: - configMap: - description: ConfigMap containing data to use for the - targets. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the ConfigMap or its - key must be defined - type: boolean - required: - - key - type: object - secret: - description: Secret containing data to use for the targets. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - caFile: - description: Path to the CA cert in the Prometheus container - to use for the targets. - type: string - cert: - description: Struct containing the client cert file for - the targets. - properties: - configMap: - description: ConfigMap containing data to use for the - targets. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the ConfigMap or its - key must be defined - type: boolean - required: - - key - type: object - secret: - description: Secret containing data to use for the targets. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - certFile: - description: Path to the client cert file in the Prometheus - container for the targets. - type: string - insecureSkipVerify: - description: Disable target certificate validation. - type: boolean - keyFile: - description: Path to the client key file in the Prometheus - container for the targets. - type: string - keySecret: - description: Secret containing the client key file for the - targets. - properties: - key: - description: The key of the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the Secret or its key must - be defined - type: boolean - required: - - key - type: object - serverName: - description: Used to verify the hostname for the targets. - type: string - type: object - type: object - type: array - jobLabel: - description: The label to use to retrieve the job name from. - type: string - namespaceSelector: - description: Selector to select which namespaces the Endpoints objects - are discovered from. - properties: - any: - description: Boolean describing whether all namespaces are selected - in contrast to a list restricting them. - type: boolean - matchNames: - description: List of namespace names. - items: - type: string - type: array - type: object - podTargetLabels: - description: PodTargetLabels transfers labels on the Kubernetes Pod - onto the target. - items: - type: string - type: array - sampleLimit: - description: SampleLimit defines per-scrape limit on number of scraped - samples that will be accepted. - format: int64 - type: integer - selector: - description: Selector to select Endpoints objects. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. - type: object - type: object - targetLabels: - description: TargetLabels transfers labels on the Kubernetes Service - onto the target. - items: - type: string - type: array - required: - - endpoints - - selector - type: object - required: - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/clusterrole.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/clusterrole.yaml new file mode 100644 index 000000000..9e6d858e5 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/clusterrole.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kubevela.fullname" . }}-admission + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission + {{- include "kubevela.labels" . | nindent 4 }} +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - get + - update +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/clusterrolebinding.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/clusterrolebinding.yaml new file mode 100644 index 000000000..649bb7138 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/clusterrolebinding.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "kubevela.fullname" . }}-admission + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission + {{- include "kubevela.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "kubevela.fullname" . }}-admission +subjects: + - kind: ServiceAccount + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml new file mode 100644 index 000000000..b62f91dc1 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml @@ -0,0 +1,50 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "kubevela.fullname" . }}-admission-create + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission-create + {{- include "kubevela.labels" . | nindent 4 }} +spec: + {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} + # Alpha feature since k8s 1.12 + ttlSecondsAfterFinished: 0 + {{- end }} + template: + metadata: + name: {{ template "kubevela.fullname" . }}-admission-create + labels: + app: {{ template "kubevela.name" . }}-admission-create + {{- include "kubevela.labels" . | nindent 8 }} + spec: + containers: + - name: create + image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }} + imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }} + args: + - create + - --host={{ template "kubevela.name" . }}-webhook,{{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc + - --namespace={{ .Release.Namespace }} + - --secret-name={{ template "kubevela.fullname" . }}-admission + - --key-name=tls.key + - --cert-name=tls.crt + restartPolicy: OnFailure + serviceAccountName: {{ template "kubevela.fullname" . }}-admission + {{- with .Values.admissionWebhooks.patch.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.admissionWebhooks.patch.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + securityContext: + runAsGroup: 2000 + runAsNonRoot: true + runAsUser: 2000 +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml new file mode 100644 index 000000000..d93c8b027 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml @@ -0,0 +1,49 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "kubevela.fullname" . }}-admission-patch + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission-patch + {{- include "kubevela.labels" . | nindent 4 }} +spec: + {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} + # Alpha feature since k8s 1.12 + ttlSecondsAfterFinished: 0 + {{- end }} + template: + metadata: + name: {{ template "kubevela.fullname" . }}-admission-patch + labels: + app: {{ template "kubevela.name" . }}-admission-patch + {{- include "kubevela.labels" . | nindent 8 }} + spec: + containers: + - name: patch + image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }} + imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }} + args: + - patch + - --webhook-name={{ template "kubevela.fullname" . }}-admission + - --namespace={{ .Release.Namespace }} + - --secret-name={{ template "kubevela.fullname" . }}-admission + - --patch-failure-policy={{ .Values.admissionWebhooks.failurePolicy }} + restartPolicy: OnFailure + serviceAccountName: {{ template "kubevela.fullname" . }}-admission + {{- with .Values.admissionWebhooks.patch.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.admissionWebhooks.patch.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + securityContext: + runAsGroup: 2000 + runAsNonRoot: true + runAsUser: 2000 +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/role.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/role.yaml new file mode 100644 index 000000000..cf3d7dd33 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/role.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission + {{- include "kubevela.labels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/rolebinding.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/rolebinding.yaml new file mode 100644 index 000000000..cffdc0f54 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/rolebinding.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission + {{- include "kubevela.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "kubevela.fullname" . }}-admission +subjects: + - kind: ServiceAccount + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/job-patch/serviceaccount.yaml b/charts/vela-core/templates/admission-webhooks/job-patch/serviceaccount.yaml new file mode 100644 index 000000000..4e56267de --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/job-patch/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + app: {{ template "kubevela.name" . }}-admission + {{- include "kubevela.labels" . | nindent 4 }} +{{- end }} diff --git a/charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml b/charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml new file mode 100644 index 000000000..bad29419b --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml @@ -0,0 +1,109 @@ +{{- if .Values.admissionWebhooks.enabled -}} +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: MutatingWebhookConfiguration +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} + {{- if .Values.admissionWebhooks.certManager.enabled }} + annotations: + cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "kubevela.fullname" .) | quote }} + {{- end }} +webhooks: + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /mutating-core-oam-dev-v1alpha2-applicationconfigurations + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: Fail + {{- end }} + name: mutating.core.oam.dev.v1alpha2.applicationconfigurations + rules: + - apiGroups: + - core.oam.dev + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - applicationconfigurations + scope: Namespaced + admissionReviewVersions: + - v1beta1 + timeoutSeconds: 5 + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /mutating-core-oam-dev-v1alpha2-components + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: Fails + {{- end }} + name: mutating.core.oam-dev.v1alpha2.components + rules: + - apiGroups: + - core.oam.dev + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - components + scope: Namespaced + admissionReviewVersions: + - v1beta1 + timeoutSeconds: 5 + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /mutate-standard-oam-dev-v1alpha1-metricstrait + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: Fails + {{- end }} + name: mmetricstrait.kb.io + rules: + - apiGroups: + - standard.oam.dev + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - metricstraits + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /mutate-standard-oam-dev-v1alpha1-podspecworkload + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: Fails + {{- end }} + name: mcontainerized.kb.io + rules: + - apiGroups: + - standard.oam.dev + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - podspecworkloads + +{{- end -}} diff --git a/charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml b/charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml new file mode 100644 index 000000000..829885270 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml @@ -0,0 +1,132 @@ +{{- if .Values.admissionWebhooks.enabled -}} +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} + {{- if .Values.admissionWebhooks.certManager.enabled }} + annotations: + cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "kubevela.fullname" .) | quote }} + {{- end }} +webhooks: + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validating-core-oam-dev-v1alpha2-applicationconfigurations + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }} + {{- end }} + name: validating.core.oam.dev.v1alpha2.applicationconfigurations + rules: + - apiGroups: + - core.oam.dev + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - applicationconfigurations + scope: Namespaced + admissionReviewVersions: + - v1beta1 + timeoutSeconds: 5 + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validating-core-oam-dev-v1alpha2-components + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }} + {{- end }} + name: validating.core.oam.dev.v1alpha2.components + rules: + - apiGroups: + - core.oam.dev + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - components + scope: Namespaced + admissionReviewVersions: + - v1beta1 + timeoutSeconds: 5 + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validating-core-oam-dev-v1alpha2-traitdefinitions + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }} + {{- end }} + name: validating.core.oam.dev.v1alpha2.traitdefinitions + rules: + - apiGroups: + - core.oam.dev + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - traitdefinitions + scope: Cluster + admissionReviewVersions: + - v1beta1 + timeoutSeconds: 5 + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-standard-oam-dev-v1alpha1-metricstrait + {{- if .Values.admissionWebhooks.patch.enabled }} + failurePolicy: Ignore + {{- else }} + failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }} + {{- end }} + name: vmetricstrait.kb.io + rules: + - apiGroups: + - standard.oam.dev + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - metricstraits + - clientConfig: + caBundle: Cg== + service: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-standard-oam-dev-v1alpha1-podspecworkload + failurePolicy: Fail + name: vcontainerized.kb.io + rules: + - apiGroups: + - standard.oam.dev + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - podspecworkloads + +{{- end -}} diff --git a/charts/vela-core/templates/admission-webhooks/webhookService.yaml b/charts/vela-core/templates/admission-webhooks/webhookService.yaml new file mode 100644 index 000000000..ddfb54e74 --- /dev/null +++ b/charts/vela-core/templates/admission-webhooks/webhookService.yaml @@ -0,0 +1,19 @@ +{{- if .Values.admissionWebhooks.enabled -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "kubevela.name" . }}-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "kubevela.labels" . | nindent 4 }} +spec: + type: {{ .Values.webhookService.type }} + ports: + - port: 443 + targetPort: {{ .Values.webhookService.port }} + protocol: TCP + name: https + selector: + {{ include "kubevela.selectorLabels" . | nindent 6 }} + +{{- end -}} diff --git a/charts/vela-core/templates/cert-manager.yaml b/charts/vela-core/templates/cert-manager.yaml deleted file mode 100644 index b012513eb..000000000 --- a/charts/vela-core/templates/cert-manager.yaml +++ /dev/null @@ -1,1087 +0,0 @@ -# Copyright YEAR The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -{{- if .Values.installCertManager -}} -{{- if .Values.useWebhook -}} ---- -apiVersion: v1 -kind: Namespace -metadata: - name: cert-manager ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector - namespace: cert-manager ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager - namespace: cert-manager ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector -rules: -- apiGroups: - - cert-manager.io - resources: - - certificates - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - get - - create - - update - - patch -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - get - - list - - watch - - update -- apiGroups: - - apiregistration.k8s.io - resources: - - apiservices - verbs: - - get - - list - - watch - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - update -- apiGroups: - - auditregistration.k8s.io - resources: - - auditsinks - verbs: - - get - - list - - watch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-issuers -rules: -- apiGroups: - - cert-manager.io - resources: - - issuers - - issuers/status - verbs: - - update -- apiGroups: - - cert-manager.io - resources: - - issuers - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - update - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-clusterissuers -rules: -- apiGroups: - - cert-manager.io - resources: - - clusterissuers - - clusterissuers/status - verbs: - - update -- apiGroups: - - cert-manager.io - resources: - - clusterissuers - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - update - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-certificates -rules: -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificates/status - - certificaterequests - - certificaterequests/status - verbs: - - update -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificaterequests - - clusterissuers - - issuers - verbs: - - get - - list - - watch -- apiGroups: - - cert-manager.io - resources: - - certificates/finalizers - - certificaterequests/finalizers - verbs: - - update -- apiGroups: - - acme.cert-manager.io - resources: - - orders - verbs: - - create - - delete - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - update - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-orders -rules: -- apiGroups: - - acme.cert-manager.io - resources: - - orders - - orders/status - verbs: - - update -- apiGroups: - - acme.cert-manager.io - resources: - - orders - - challenges - verbs: - - get - - list - - watch -- apiGroups: - - cert-manager.io - resources: - - clusterissuers - - issuers - verbs: - - get - - list - - watch -- apiGroups: - - acme.cert-manager.io - resources: - - challenges - verbs: - - create - - delete -- apiGroups: - - acme.cert-manager.io - resources: - - orders/finalizers - verbs: - - update -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-challenges -rules: -- apiGroups: - - acme.cert-manager.io - resources: - - challenges - - challenges/status - verbs: - - update -- apiGroups: - - acme.cert-manager.io - resources: - - challenges - verbs: - - get - - list - - watch -- apiGroups: - - cert-manager.io - resources: - - issuers - - clusterissuers - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - "" - resources: - - pods - - services - verbs: - - get - - list - - watch - - create - - delete -- apiGroups: - - extensions - resources: - - ingresses - verbs: - - get - - list - - watch - - create - - delete - - update -- apiGroups: - - route.openshift.io - resources: - - routes/custom-host - verbs: - - create -- apiGroups: - - acme.cert-manager.io - resources: - - challenges/finalizers - verbs: - - update -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-ingress-shim -rules: -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificaterequests - verbs: - - create - - update - - delete -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificaterequests - - issuers - - clusterissuers - verbs: - - get - - list - - watch -- apiGroups: - - extensions - resources: - - ingresses - verbs: - - get - - list - - watch -- apiGroups: - - extensions - resources: - - ingresses/finalizers - verbs: - - update -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - rbac.authorization.k8s.io/aggregate-to-admin: "true" - rbac.authorization.k8s.io/aggregate-to-edit: "true" - rbac.authorization.k8s.io/aggregate-to-view: "true" - name: cert-manager-view -rules: -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificaterequests - - issuers - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - rbac.authorization.k8s.io/aggregate-to-admin: "true" - rbac.authorization.k8s.io/aggregate-to-edit: "true" - name: cert-manager-edit -rules: -- apiGroups: - - cert-manager.io - resources: - - certificates - - certificaterequests - - issuers - verbs: - - create - - delete - - deletecollection - - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-cainjector -subjects: -- kind: ServiceAccount - name: cert-manager-cainjector - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-issuers -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-issuers -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-clusterissuers -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-clusterissuers -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-certificates -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-certificates -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-orders -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-orders -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-challenges -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-challenges -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager-controller-ingress-shim -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-ingress-shim -subjects: -- kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector:leaderelection - namespace: kube-system -rules: -- apiGroups: - - "" - resourceNames: - - cert-manager-cainjector-leader-election - - cert-manager-cainjector-leader-election-core - resources: - - configmaps - verbs: - - get - - update - - patch -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager:leaderelection - namespace: kube-system -rules: -- apiGroups: - - "" - resourceNames: - - cert-manager-controller - resources: - - configmaps - verbs: - - get - - update - - patch -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook:dynamic-serving - namespace: cert-manager -rules: -- apiGroups: - - "" - resourceNames: - - cert-manager-webhook-ca - resources: - - secrets - verbs: - - get - - list - - watch - - update -- apiGroups: - - "" - resources: - - secrets - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector:leaderelection - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-cainjector:leaderelection -subjects: -- kind: ServiceAccount - name: cert-manager-cainjector - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager:leaderelection - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager:leaderelection -subjects: -- apiGroup: "" - kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook:dynamic-serving - namespace: cert-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-webhook:dynamic-serving -subjects: -- apiGroup: "" - kind: ServiceAccount - name: cert-manager-webhook - namespace: cert-manager ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager - namespace: cert-manager -spec: - ports: - - port: 9402 - protocol: TCP - targetPort: 9402 - selector: - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - type: ClusterIP ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook - namespace: cert-manager -spec: - ports: - - name: https - port: 443 - targetPort: 13622 - selector: - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - name: cert-manager-cainjector - namespace: cert-manager -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - template: - metadata: - labels: - app: cainjector - app.kubernetes.io/component: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cainjector - spec: - containers: - - args: - - --v=2 - - --leader-election-namespace=kube-system - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - image: quay.io/jetstack/cert-manager-cainjector:v1.1.0 - imagePullPolicy: IfNotPresent - name: cert-manager - resources: {} - serviceAccountName: cert-manager-cainjector ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - name: cert-manager - namespace: cert-manager -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - template: - metadata: - annotations: - prometheus.io/path: /metrics - prometheus.io/port: "9402" - prometheus.io/scrape: "true" - labels: - app: cert-manager - app.kubernetes.io/component: controller - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: cert-manager - spec: - containers: - - args: - - --v=2 - - --cluster-resource-namespace=$(POD_NAMESPACE) - - --leader-election-namespace=kube-system - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - image: quay.io/jetstack/cert-manager-controller:v1.1.0 - imagePullPolicy: IfNotPresent - name: cert-manager - ports: - - containerPort: 9402 - protocol: TCP - resources: {} - serviceAccountName: cert-manager ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook - namespace: cert-manager -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - template: - metadata: - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - spec: - containers: - - args: - - --v=2 - - --secure-port=13622 - - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca - - --dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - image: quay.io/jetstack/cert-manager-webhook:v1.1.0 - imagePullPolicy: IfNotPresent - livenessProbe: - failureThreshold: 3 - httpGet: - path: /livez - port: 6080 - scheme: HTTP - initialDelaySeconds: 60 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - name: cert-manager - ports: - - containerPort: 13622 - name: https - readinessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 6080 - scheme: HTTP - initialDelaySeconds: 5 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 1 - resources: {} - serviceAccountName: cert-manager-webhook ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - annotations: - cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook -webhooks: -- admissionReviewVersions: - - v1 - - v1beta1 - clientConfig: - service: - name: cert-manager-webhook - namespace: cert-manager - path: /mutate - failurePolicy: Fail - name: webhook.cert-manager.io - rules: - - apiGroups: - - cert-manager.io - - acme.cert-manager.io - apiVersions: - - '*' - operations: - - CREATE - - UPDATE - resources: - - '*/*' - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - annotations: - cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca - labels: - app: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/name: webhook - name: cert-manager-webhook -webhooks: -- admissionReviewVersions: - - v1 - - v1beta1 - clientConfig: - service: - name: cert-manager-webhook - namespace: cert-manager - path: /validate - failurePolicy: Fail - name: webhook.cert-manager.io - namespaceSelector: - matchExpressions: - - key: cert-manager.io/disable-validation - operator: NotIn - values: - - "true" - - key: name - operator: NotIn - values: - - cert-manager - rules: - - apiGroups: - - cert-manager.io - - acme.cert-manager.io - apiVersions: - - '*' - operations: - - CREATE - - UPDATE - resources: - - '*/*' - sideEffects: None ---- -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/charts/vela-core/templates/certmanager.yaml b/charts/vela-core/templates/certmanager.yaml new file mode 100644 index 000000000..a527d1e6e --- /dev/null +++ b/charts/vela-core/templates/certmanager.yaml @@ -0,0 +1,53 @@ +{{- if and .Values.admissionWebhooks.certManager.enabled -}} + +# The following manifests contain a self-signed issuer CR and a certificate CR. +# More document can be found at https://docs.cert-manager.io +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ template "kubevela.fullname" . }}-self-signed-issuer +spec: + selfSigned: {} + +--- +# Generate a CA Certificate used to sign certificates for the webhook +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ template "kubevela.fullname" . }}-root-cert +spec: + secretName: {{ template "kubevela.fullname" . }}-root-cert + duration: 43800h # 5y + issuerRef: + name: {{ template "kubevela.fullname" . }}-self-signed-issuer + commonName: "ca.webhook.kubevela" + isCA: true + +--- +# Create an Issuer that uses the above generated CA certificate to issue certs +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ template "kubevela.fullname" . }}-root-issuer + namespace: {{ .Release.Namespace }} +spec: + ca: + secretName: {{ template "kubevela.fullname" . }}-root-cert + +--- +# generate a serving certificate for the apiservices to use +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ template "kubevela.fullname" . }}-admission + namespace: {{ .Release.Namespace }} +spec: + secretName: {{ template "kubevela.fullname" . }}-admission + duration: 8760h # 1y + issuerRef: + name: {{ template "kubevela.fullname" . }}-root-issuer + dnsNames: + - {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc + - {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local + +{{- end }} diff --git a/charts/vela-core/templates/kubevela-controller.yaml b/charts/vela-core/templates/kubevela-controller.yaml index cf5378c7d..9e13fe192 100644 --- a/charts/vela-core/templates/kubevela-controller.yaml +++ b/charts/vela-core/templates/kubevela-controller.yaml @@ -107,10 +107,10 @@ spec: args: - "--metrics-addr=:8080" - "--enable-leader-election" - {{ if .Values.useWebhook }} + {{ if .Values.admissionWebhooks.enabled }} - "--use-webhook=true" - "--webhook-port={{ .Values.webhookService.port }}" - - "--webhook-cert-dir={{ .Values.certificate.mountPath }}" + - "--webhook-cert-dir={{ .Values.admissionWebhooks.certificate.mountPath }}" {{ end }} - "--health-addr=:{{ .Values.healthCheck.port }}" - "--apply-once-only={{ .Values.applyOnceOnly }}" @@ -121,7 +121,7 @@ spec: imagePullPolicy: {{ quote .Values.image.pullPolicy }} resources: {{- toYaml .Values.resources | nindent 12 }} - {{ if .Values.useWebhook }} + {{ if .Values.admissionWebhooks.enabled }} ports: - containerPort: {{ .Values.webhookService.port }} name: webhook-server @@ -142,16 +142,16 @@ spec: initialDelaySeconds: 90 periodSeconds: 5 volumeMounts: - - mountPath: {{ .Values.certificate.mountPath }} + - mountPath: {{ .Values.admissionWebhooks.certificate.mountPath }} name: tls-cert-vol readOnly: true {{ end }} - {{ if .Values.useWebhook }} + {{ if .Values.admissionWebhooks.enabled }} volumes: - name: tls-cert-vol secret: defaultMode: 420 - secretName: {{ .Values.certificate.secretName | quote }} + secretName: {{ template "kubevela.fullname" . }}-admission {{ end }} {{- with .Values.nodeSelector }} nodeSelector: diff --git a/charts/vela-core/templates/webhook.yaml b/charts/vela-core/templates/webhook.yaml deleted file mode 100644 index cafa1c831..000000000 --- a/charts/vela-core/templates/webhook.yaml +++ /dev/null @@ -1,249 +0,0 @@ -{{- if .Values.useWebhook -}} ---- -apiVersion: admissionregistration.k8s.io/v1beta1 -kind: MutatingWebhookConfiguration -metadata: - name: kubevela-mutating-webhook-configuration - namespace: {{ .Release.Namespace }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.certificate.certificateName }} -webhooks: - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /mutating-core-oam-dev-v1alpha2-applicationconfigurations - failurePolicy: Fail - name: mutating.core.oam.dev.v1alpha2.applicationconfigurations - rules: - - apiGroups: - - core.oam.dev - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - applicationconfigurations - scope: Namespaced - admissionReviewVersions: - - v1beta1 - timeoutSeconds: 5 - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /mutating-core-oam-dev-v1alpha2-components - failurePolicy: Fail - name: mutating.core.oam-dev.v1alpha2.components - rules: - - apiGroups: - - core.oam.dev - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - components - scope: Namespaced - admissionReviewVersions: - - v1beta1 - timeoutSeconds: 5 - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /mutate-standard-oam-dev-v1alpha1-metricstrait - failurePolicy: Fail - name: mmetricstrait.kb.io - rules: - - apiGroups: - - standard.oam.dev - apiVersions: - - v1alpha1 - operations: - - CREATE - - UPDATE - resources: - - metricstraits - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /mutate-standard-oam-dev-v1alpha1-podspecworkload - failurePolicy: Fail - name: mcontainerized.kb.io - rules: - - apiGroups: - - standard.oam.dev - apiVersions: - - v1alpha1 - operations: - - CREATE - - UPDATE - resources: - - podspecworkloads - ---- -apiVersion: admissionregistration.k8s.io/v1beta1 -kind: ValidatingWebhookConfiguration -metadata: - name: kubevela-validating-webhook-configuration - namespace: {{ .Release.Namespace }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.certificate.certificateName }} -webhooks: - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /validating-core-oam-dev-v1alpha2-applicationconfigurations - failurePolicy: Fail - name: validating.core.oam.dev.v1alpha2.applicationconfigurations - rules: - - apiGroups: - - core.oam.dev - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - applicationconfigurations - scope: Namespaced - admissionReviewVersions: - - v1beta1 - timeoutSeconds: 5 - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /validating-core-oam-dev-v1alpha2-components - failurePolicy: Fail - name: validating.core.oam.dev.v1alpha2.components - rules: - - apiGroups: - - core.oam.dev - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - components - scope: Namespaced - admissionReviewVersions: - - v1beta1 - timeoutSeconds: 5 - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /validating-core-oam-dev-v1alpha2-traitdefinitions - failurePolicy: Fail - name: validating.core.oam.dev.v1alpha2.traitdefinitions - rules: - - apiGroups: - - core.oam.dev - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - traitdefinitions - scope: Cluster - admissionReviewVersions: - - v1beta1 - timeoutSeconds: 5 - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /validate-standard-oam-dev-v1alpha1-metricstrait - failurePolicy: Fail - name: vmetricstrait.kb.io - rules: - - apiGroups: - - standard.oam.dev - apiVersions: - - v1alpha1 - operations: - - CREATE - - UPDATE - - DELETE - resources: - - metricstraits - - clientConfig: - caBundle: Cg== - service: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - path: /validate-standard-oam-dev-v1alpha1-podspecworkload - failurePolicy: Fail - name: vcontainerized.kb.io - rules: - - apiGroups: - - standard.oam.dev - apiVersions: - - v1alpha1 - operations: - - CREATE - - UPDATE - resources: - - podspecworkloads - ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ template "kubevela.name" . }}-webhook - namespace: {{ .Release.Namespace }} - labels: - {{- include "kubevela.labels" . | nindent 4 }} -spec: - type: {{ .Values.webhookService.type }} - ports: - - port: 443 - targetPort: {{ .Values.webhookService.port }} - protocol: TCP - name: https - selector: - {{ include "kubevela.selectorLabels" . | nindent 6 }} - ---- -# The following manifests contain a self-signed issuer CR and a certificate CR. -# More document can be found at https://docs.cert-manager.io -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: {{ .Values.certificate.issuerName | quote }} -spec: - selfSigned: {} - -# The following Certificate will generate a secret for vela-core -# This rely on the system has a installed cert-manager in it. ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ .Values.certificate.certificateName }} -spec: - dnsNames: - - {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc - - {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local - issuerRef: - kind: Issuer - name: {{ .Values.certificate.issuerName | default "selfsigned-issuer" | quote }} - secretName: {{ .Values.certificate.secretName | quote }} ---- -{{- end -}} diff --git a/charts/vela-core/values.yaml b/charts/vela-core/values.yaml index a055f1a0f..eb3bd9a2e 100644 --- a/charts/vela-core/values.yaml +++ b/charts/vela-core/values.yaml @@ -3,12 +3,11 @@ # Declare variables to be passed into your templates. replicaCount: 1 -installCertManager: false # Valid applyOnceOnly values: true/false/on/off/force applyOnceOnly: "off" -useWebhook: true -# By default, don't disable any builtin capabilities -disableCaps: "" + +# By default, metrics are disabled due the prometheus dependency +disableCaps: "metrics" image: repository: oamdev/vela-core tag: latest @@ -77,10 +76,22 @@ tolerations: [] affinity: {} -# certificate related to the webhook -certificate: - issuerName: selfsigned-issuer - certificateName: serving-cert - secretName: webhook-server-cert - mountPath: /etc/k8s-webhook-certs - caBundle: replace-me +rbac: + create: true + +admissionWebhooks: + enabled: true + failurePolicy: Fail + certificate: + mountPath: /etc/k8s-webhook-certs + patch: + enabled: true + image: + repository: jettech/kube-webhook-certgen + tag: v1.5.0 + pullPolicy: IfNotPresent + affinity: {} + tolerations: [] + certManager: + enabled: false + diff --git a/docs/en/install.md b/docs/en/install.md index 6107c6ce9..a64df185b 100644 --- a/docs/en/install.md +++ b/docs/en/install.md @@ -77,36 +77,18 @@ These steps will install KubeVela controller and its dependency. helm repo update ``` -3. Create Namespace for KubeVela controller +3. Install KubeVela ```shell script - kubectl create namespace vela-system - ``` - -4. Install KubeVela - ```shell script - helm install -n vela-system kubevela kubevela/vela-core - ``` - By default, it will enable webhook. KubeVela relies on [cert-manager](https://cert-manager.io/docs/) - to create certificates for webhook. - If cert-manager hasn't been installed, please refer to [cert-manager installation doc](https://cert-manager.io/docs/installation/kubernetes/). - - You can add an argument `--set useWebhook=false` after the command to disable the webhook if you don't want to rely on cert-manager. - If you just want to have a try this can also work: - ```shell script - helm install -n vela-system kubevela kubevela/vela-core --set useWebhook=false - ``` - - You can also install cert-manager via kubevela chart by adding the argument `--set installCertManager=true`. - ```shell script - helm install -n vela-system kubevela kubevela/vela-core --set installCertManager=true + helm install --create-namespace -n vela-system kubevela kubevela/vela-core ``` + By default, it will enable the webhook with a self-signed certificate provided by [kube-webhook-certgen](https://github.com/jet/kube-webhook-certgen) If you want to try the latest master branch, add flag `--devel` in command `helm search` to choose a pre-release version in format `-rc-master` which means the next release candidate version build on `master` branch, like `0.4.0-rc-master`. ```shell script - $ helm search repo kubevela/vela-core -l --devel + helm search repo kubevela/vela-core -l --devel NAME CHART VERSION APP VERSION DESCRIPTION kubevela/vela-core 0.4.0-rc-master 0.4.0-rc-master A Helm chart for KubeVela core kubevela/vela-core 0.3.2 0.3.2 A Helm chart for KubeVela core @@ -116,7 +98,23 @@ These steps will install KubeVela controller and its dependency. And try the following command to install it. ```shell script - helm install -n vela-system kubevela kubevela/vela-core --version -rc-master --set useWebhook=false + helm install --create-namespace -n vela-system kubevela kubevela/vela-core --version -rc-master + ``` + +4. Install Kubevela with cert-manager (optional) + + If cert-manager has been installed, it can be used to take care about generating certs. + + You need to install cert-manager before the kubevela chart. + ```shell script + helm repo add jetstack https://charts.jetstack.io + helm repo update + helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.2.0 --create-namespace --set installCRDs=true + ``` + + Install kubevela with enabled certmanager: + ```shell script + helm install --create-namespace -n vela-system --set admissionWebhooks.certManager.enabled=true kubevela kubevela/vela-core ``` ## 3. Get KubeVela CLI diff --git a/pkg/controller/standard.oam.dev/v1alpha1/metrics/suite_test.go b/pkg/controller/standard.oam.dev/v1alpha1/metrics/suite_test.go index f57e9b881..2c34db6b4 100644 --- a/pkg/controller/standard.oam.dev/v1alpha1/metrics/suite_test.go +++ b/pkg/controller/standard.oam.dev/v1alpha1/metrics/suite_test.go @@ -71,7 +71,8 @@ var _ = BeforeSuite(func(done Done) { useExistCluster := false testEnv = &envtest.Environment{ CRDDirectoryPaths: []string{ - filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs, + filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required oam CRDs, + filepath.Join("..", "testdata/crds"), }, UseExistingCluster: &useExistCluster, } diff --git a/pkg/controller/standard.oam.dev/v1alpha1/podspecworkload/suite_test.go b/pkg/controller/standard.oam.dev/v1alpha1/podspecworkload/suite_test.go index d2d9c07e7..a75712d86 100644 --- a/pkg/controller/standard.oam.dev/v1alpha1/podspecworkload/suite_test.go +++ b/pkg/controller/standard.oam.dev/v1alpha1/podspecworkload/suite_test.go @@ -56,7 +56,8 @@ var _ = BeforeSuite(func(done Done) { testEnv = &envtest.Environment{ CRDDirectoryPaths: []string{ filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs, - filepath.Join("..", "config", "crd", "bases")}, + filepath.Join("..", "testdata/crds"), + }, } var err error diff --git a/pkg/controller/standard.oam.dev/v1alpha1/routes/suite_test.go b/pkg/controller/standard.oam.dev/v1alpha1/routes/suite_test.go index 4aa838ca5..b745962bf 100644 --- a/pkg/controller/standard.oam.dev/v1alpha1/routes/suite_test.go +++ b/pkg/controller/standard.oam.dev/v1alpha1/routes/suite_test.go @@ -79,6 +79,7 @@ var _ = BeforeSuite(func(done Done) { testEnv = &envtest.Environment{ CRDDirectoryPaths: []string{ filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs, + filepath.Join("..", "testdata/crds"), }, UseExistingCluster: &useExistCluster, } diff --git a/charts/vela-core/crds/cert-manager.yaml b/pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/cert-manager.yaml similarity index 99% rename from charts/vela-core/crds/cert-manager.yaml rename to pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/cert-manager.yaml index ef93ac829..e52dd0b32 100644 --- a/charts/vela-core/crds/cert-manager.yaml +++ b/pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/cert-manager.yaml @@ -1,3 +1,16 @@ +# Copyright The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -907,6 +920,10 @@ spec: items: type: string type: array + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should + be present in the CertificateRequest + type: boolean ipAddresses: description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. @@ -1315,6 +1332,10 @@ spec: items: type: string type: array + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should + be present in the CertificateRequest + type: boolean ipAddresses: description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. @@ -1722,6 +1743,10 @@ spec: items: type: string type: array + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should + be present in the CertificateRequest + type: boolean ipAddresses: description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. @@ -2131,6 +2156,10 @@ spec: items: type: string type: array + encodeUsagesInRequest: + description: EncodeUsagesInRequest controls whether key usages should + be present in the CertificateRequest + type: boolean ipAddresses: description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. @@ -8589,6 +8618,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -10561,6 +10597,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -12533,6 +12576,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -14507,6 +14557,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -16517,6 +16574,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -18488,6 +18552,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -20459,6 +20530,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -22432,6 +22510,13 @@ spec: notification emails. This field may be updated after the account is initially registered. type: string + enableDurationFeature: + description: Enables requesting a Not After date on certificates + that matches the duration of the certificate. This is not supported + by all ACME servers like Let's Encrypt. If set to true when + the ACME server does not support it it will create an error + on the Order. Defaults to false. + type: boolean externalAccountBinding: description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager @@ -24426,9 +24511,9 @@ spec: properties: commonName: description: CommonName is the common name as specified on the DER - encoded CSR. If specified, this value must also be present in `dnsNames`. - This field must match the corresponding field on the DER encoded - CSR. + encoded CSR. If specified, this value must also be present in `dnsNames` + or `ipAddresses`. This field must match the corresponding field + on the DER encoded CSR. type: string csr: description: Certificate signing request bytes in DER encoding. This @@ -24443,6 +24528,18 @@ spec: items: type: string type: array + duration: + description: Duration is the duration for the not after date for the + requested certificate. this is set on order creation as pe the ACME + spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be + included as part of the Order validation process. This field must + match the corresponding field on the DER encoded CSR. + items: + type: string + type: array issuerRef: description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer @@ -24464,7 +24561,6 @@ spec: type: object required: - csr - - dnsNames - issuerRef type: object status: @@ -24634,9 +24730,9 @@ spec: properties: commonName: description: CommonName is the common name as specified on the DER - encoded CSR. If specified, this value must also be present in `dnsNames`. - This field must match the corresponding field on the DER encoded - CSR. + encoded CSR. If specified, this value must also be present in `dnsNames` + or `ipAddresses`. This field must match the corresponding field + on the DER encoded CSR. type: string csr: description: Certificate signing request bytes in DER encoding. This @@ -24651,6 +24747,18 @@ spec: items: type: string type: array + duration: + description: Duration is the duration for the not after date for the + requested certificate. this is set on order creation as pe the ACME + spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be + included as part of the Order validation process. This field must + match the corresponding field on the DER encoded CSR. + items: + type: string + type: array issuerRef: description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer @@ -24672,7 +24780,6 @@ spec: type: object required: - csr - - dnsNames - issuerRef type: object status: @@ -24842,9 +24949,9 @@ spec: properties: commonName: description: CommonName is the common name as specified on the DER - encoded CSR. If specified, this value must also be present in `dnsNames`. - This field must match the corresponding field on the DER encoded - CSR. + encoded CSR. If specified, this value must also be present in `dnsNames` + or `ipAddresses`. This field must match the corresponding field + on the DER encoded CSR. type: string dnsNames: description: DNSNames is a list of DNS names that should be included @@ -24853,6 +24960,18 @@ spec: items: type: string type: array + duration: + description: Duration is the duration for the not after date for the + requested certificate. this is set on order creation as pe the ACME + spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be + included as part of the Order validation process. This field must + match the corresponding field on the DER encoded CSR. + items: + type: string + type: array issuerRef: description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer @@ -24879,7 +24998,6 @@ spec: format: byte type: string required: - - dnsNames - issuerRef - request type: object @@ -25051,9 +25169,9 @@ spec: properties: commonName: description: CommonName is the common name as specified on the DER - encoded CSR. If specified, this value must also be present in `dnsNames`. - This field must match the corresponding field on the DER encoded - CSR. + encoded CSR. If specified, this value must also be present in `dnsNames` + or `ipAddresses`. This field must match the corresponding field + on the DER encoded CSR. type: string dnsNames: description: DNSNames is a list of DNS names that should be included @@ -25062,6 +25180,18 @@ spec: items: type: string type: array + duration: + description: Duration is the duration for the not after date for the + requested certificate. this is set on order creation as pe the ACME + spec. + type: string + ipAddresses: + description: IPAddresses is a list of IP addresses that should be + included as part of the Order validation process. This field must + match the corresponding field on the DER encoded CSR. + items: + type: string + type: array issuerRef: description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer @@ -25088,7 +25218,6 @@ spec: format: byte type: string required: - - dnsNames - issuerRef - request type: object @@ -25225,4 +25354,5 @@ status: kind: "" plural: "" conditions: [] - storedVersions: [] \ No newline at end of file + storedVersions: [] + diff --git a/pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/servicemonitors.yaml b/pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/servicemonitors.yaml new file mode 100644 index 000000000..6d6632d20 --- /dev/null +++ b/pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/servicemonitors.yaml @@ -0,0 +1,372 @@ + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: servicemonitors.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + kind: ServiceMonitor + listKind: ServiceMonitorList + plural: servicemonitors + singular: servicemonitor + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ServiceMonitor defines monitoring for a set of services. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of desired Service selection for target discovery by Prometheus. + properties: + endpoints: + description: A list of endpoints allowed as part of this ServiceMonitor. + items: + description: Endpoint defines a scrapeable endpoint serving Prometheus metrics. + properties: + basicAuth: + description: 'BasicAuth allow an endpoint to authenticate over basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints' + properties: + password: + description: The secret in the service monitor namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + username: + description: The secret in the service monitor namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + type: object + bearerTokenFile: + description: File to read bearer token for scraping targets. + type: string + bearerTokenSecret: + description: Secret to mount to read bearer token for scraping targets. The secret needs to be in the same namespace as the service monitor and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + honorLabels: + description: HonorLabels chooses the metric's labels on collisions with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped + type: string + metricRelabelings: + description: MetricRelabelConfigs to apply to samples before ingestion. + items: + description: 'RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines ``-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + description: Action to perform based on regex matching. Default is 'replace' + type: string + modulus: + description: Modulus to take of the hash of the source label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions. + items: + type: string + type: array + targetLabel: + description: Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. + type: string + port: + description: Name of the service port this endpoint refers to. Mutually exclusive with targetPort. + type: string + proxyUrl: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes to proxy through this endpoint. + type: string + relabelings: + description: 'RelabelConfigs to apply to samples before scraping. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config' + items: + description: 'RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines ``-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + description: Action to perform based on regex matching. Default is 'replace' + type: string + modulus: + description: Modulus to take of the hash of the source label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions. + items: + type: string + type: array + targetLabel: + description: Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available. + type: string + type: object + type: array + scheme: + description: HTTP scheme to use for scraping. + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port. + x-kubernetes-int-or-string: true + tlsConfig: + description: TLS configuration to use when scraping the endpoint + properties: + ca: + description: Struct containing the CA cert to use for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + type: object + caFile: + description: Path to the CA cert in the Prometheus container to use for the targets. + type: string + cert: + description: Struct containing the client cert file for the targets. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + type: object + certFile: + description: Path to the client cert file in the Prometheus container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the Prometheus container for the targets. + type: string + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + type: object + type: array + jobLabel: + description: The label to use to retrieve the job name from. + type: string + namespaceSelector: + description: Selector to select which namespaces the Endpoints objects are discovered from. + properties: + any: + description: Boolean describing whether all namespaces are selected in contrast to a list restricting them. + type: boolean + matchNames: + description: List of namespace names. + items: + type: string + type: array + type: object + podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod onto the target. + items: + type: string + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped samples that will be accepted. + format: int64 + type: integer + selector: + description: Selector to select Endpoints objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + targetLabels: + description: TargetLabels transfers labels on the Kubernetes Service onto the target. + items: + type: string + type: array + targetLimit: + description: TargetLimit defines a limit on the number of scraped targets that will be accepted. + format: int64 + type: integer + required: + - endpoints + - selector + type: object + required: + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] \ No newline at end of file