mirror of
https://github.com/storytold/irsa-manager.git
synced 2026-10-25 08:20:12 +00:00
webhook manifests
This commit is contained in:
kkb0318
@@ -6,188 +6,224 @@ import (
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/apimachinery/pkg/util/intstr"
|
||||
)
|
||||
|
||||
var mutatingWebhookConfiguration = v1beta1.MutatingWebhookConfiguration{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "admissionregistration.k8s.io/v1beta1",
|
||||
Kind: "MutatingWebhookConfiguration",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
},
|
||||
Webhooks: []v1beta1.MutatingWebhook{
|
||||
{
|
||||
Name: "pod-identity-webhook.amazonaws.com",
|
||||
ClientConfig: v1beta1.WebhookClientConfig{
|
||||
Service: &v1beta1.ServiceReference{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
Path: "/mutate",
|
||||
},
|
||||
CABundle: []byte("${CA_BUNDLE}"),
|
||||
},
|
||||
Rules: []v1beta1.RuleWithOperations{
|
||||
{
|
||||
Operations: []v1beta1.OperationType{"CREATE"},
|
||||
Rule: v1beta1.Rule{
|
||||
APIGroups: []string{""},
|
||||
APIVersions: []string{"v1"},
|
||||
Resources: []string{"pods"},
|
||||
},
|
||||
},
|
||||
},
|
||||
FailurePolicy: (*v1beta1.FailurePolicyType)(nil),
|
||||
},
|
||||
},
|
||||
type baseManifestFactory struct {
|
||||
deploymentMeta types.NamespacedName
|
||||
serviceMeta types.NamespacedName
|
||||
serviceAccountMeta types.NamespacedName
|
||||
mutatingWebhookConfigurationMeta types.NamespacedName
|
||||
podLabel map[string]string
|
||||
}
|
||||
|
||||
var deployment = appsv1.Deployment{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "apps/v1",
|
||||
Kind: "Deployment",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
func serviceNamespacedName() types.NamespacedName {
|
||||
return types.NamespacedName{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
},
|
||||
Spec: appsv1.DeploymentSpec{
|
||||
Replicas: 1,
|
||||
Selector: &metav1.LabelSelector{
|
||||
MatchLabels: map[string]string{"app": "pod-identity-webhook"},
|
||||
Namespace: WEBHOOK_NAMESPACE,
|
||||
}
|
||||
}
|
||||
|
||||
const WEBHOOK_NAMESPACE = "kube-system"
|
||||
|
||||
func newBaseManifestFactory() *baseManifestFactory {
|
||||
return &baseManifestFactory{
|
||||
deploymentMeta: types.NamespacedName{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: WEBHOOK_NAMESPACE,
|
||||
},
|
||||
Template: corev1.PodTemplateSpec{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Labels: map[string]string{"app": "pod-identity-webhook"},
|
||||
},
|
||||
Spec: corev1.PodSpec{
|
||||
ServiceAccountName: "pod-identity-webhook",
|
||||
Containers: []corev1.Container{
|
||||
serviceMeta: serviceNamespacedName(),
|
||||
serviceAccountMeta: types.NamespacedName{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: WEBHOOK_NAMESPACE,
|
||||
},
|
||||
mutatingWebhookConfigurationMeta: types.NamespacedName{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: WEBHOOK_NAMESPACE,
|
||||
},
|
||||
podLabel: map[string]string{"app": "pod-identity-webhook"},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) mutatingWebhookConfiguration() *v1beta1.MutatingWebhookConfiguration {
|
||||
path := "/mutate"
|
||||
failurePolicy := v1beta1.Ignore
|
||||
return &v1beta1.MutatingWebhookConfiguration{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: v1beta1.SchemeGroupVersion.String(),
|
||||
Kind: "MutatingWebhookConfiguration",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: b.mutatingWebhookConfigurationMeta.Name,
|
||||
Namespace: b.mutatingWebhookConfigurationMeta.Namespace,
|
||||
},
|
||||
Webhooks: []v1beta1.MutatingWebhook{
|
||||
{
|
||||
Name: "pod-identity-webhook.amazonaws.com",
|
||||
ClientConfig: v1beta1.WebhookClientConfig{
|
||||
Service: &v1beta1.ServiceReference{
|
||||
Name: b.serviceMeta.Name,
|
||||
Namespace: b.serviceMeta.Namespace,
|
||||
Path: &path,
|
||||
},
|
||||
},
|
||||
Rules: []v1beta1.RuleWithOperations{
|
||||
{
|
||||
Name: "pod-identity-webhook",
|
||||
Image: "quay.io/amis/pod-identity-webhook:v0.0.1",
|
||||
ImagePullPolicy: corev1.PullAlways,
|
||||
Command: []string{"/webhook", "--in-cluster", "--namespace=kube-system", "--service-name=pod-identity-webhook", "--tls-secret=pod-identity-webhook", "--annotation-prefix=eks.amazonaws.com", "--token-audience=sts.amazonaws.com", "--logtostderr"},
|
||||
VolumeMounts: []corev1.VolumeMount{
|
||||
{
|
||||
Name: "webhook-certs",
|
||||
MountPath: "/var/run/app/certs",
|
||||
ReadOnly: false,
|
||||
Operations: []v1beta1.OperationType{"CREATE"},
|
||||
Rule: v1beta1.Rule{
|
||||
APIGroups: []string{""},
|
||||
APIVersions: []string{"v1"},
|
||||
Resources: []string{"pods"},
|
||||
},
|
||||
},
|
||||
},
|
||||
FailurePolicy: &failurePolicy,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) deployment() *appsv1.Deployment {
|
||||
replicas := int32(1)
|
||||
return &appsv1.Deployment{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: appsv1.SchemeGroupVersion.String(),
|
||||
Kind: "Deployment",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: b.deploymentMeta.Name,
|
||||
Namespace: b.deploymentMeta.Namespace,
|
||||
},
|
||||
Spec: appsv1.DeploymentSpec{
|
||||
Replicas: &replicas,
|
||||
Selector: &metav1.LabelSelector{
|
||||
MatchLabels: b.podLabel,
|
||||
},
|
||||
Template: corev1.PodTemplateSpec{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Labels: b.podLabel,
|
||||
},
|
||||
Spec: corev1.PodSpec{
|
||||
ServiceAccountName: b.serviceAccountMeta.Name,
|
||||
Containers: []corev1.Container{
|
||||
{
|
||||
Name: "pod-identity-webhook",
|
||||
Image: "quay.io/amis/pod-identity-webhook:v0.0.1",
|
||||
ImagePullPolicy: corev1.PullAlways,
|
||||
// Command: []string{}, // Command must be patched
|
||||
VolumeMounts: []corev1.VolumeMount{
|
||||
{
|
||||
Name: "webhook-certs",
|
||||
MountPath: "/var/run/app/certs",
|
||||
ReadOnly: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Volumes: []corev1.Volume{
|
||||
{
|
||||
Name: "webhook-certs",
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
EmptyDir: &corev1.EmptyDirVolumeSource{},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Volumes: []corev1.Volume{
|
||||
{
|
||||
Name: "webhook-certs",
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
EmptyDir: &corev1.EmptyDirVolumeSource{},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) serviceAccount() *corev1.ServiceAccount {
|
||||
return &corev1.ServiceAccount{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: corev1.SchemeGroupVersion.String(),
|
||||
Kind: "ServiceAccount",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: b.serviceAccountMeta.Name,
|
||||
Namespace: b.serviceAccountMeta.Namespace,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) clusterRole() *rbacv1.ClusterRole {
|
||||
return &rbacv1.ClusterRole{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: rbacv1.SchemeGroupVersion.String(),
|
||||
Kind: "ClusterRole",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
Rules: []rbacv1.PolicyRule{
|
||||
{
|
||||
APIGroups: []string{""},
|
||||
Resources: []string{"secrets"},
|
||||
Verbs: []string{"create", "get", "update", "patch"},
|
||||
},
|
||||
{
|
||||
APIGroups: []string{""},
|
||||
Resources: []string{"serviceaccounts"},
|
||||
Verbs: []string{"get", "watch", "list"},
|
||||
},
|
||||
{
|
||||
APIGroups: []string{"certificates.k8s.io"},
|
||||
Resources: []string{"certificatesigningrequests"},
|
||||
Verbs: []string{"create", "get", "list", "watch"},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) clusterRoleBinding() *rbacv1.ClusterRoleBinding {
|
||||
return &rbacv1.ClusterRoleBinding{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: rbacv1.SchemeGroupVersion.String(),
|
||||
Kind: "ClusterRoleBinding",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: rbacv1.SchemeGroupVersion.Group,
|
||||
Kind: "ClusterRole",
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: b.serviceAccountMeta.Name,
|
||||
Namespace: b.serviceAccountMeta.Namespace,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (b *baseManifestFactory) service() *corev1.Service {
|
||||
return &corev1.Service{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: corev1.SchemeGroupVersion.String(),
|
||||
Kind: "Service",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: b.serviceMeta.Name,
|
||||
Namespace: b.serviceMeta.Namespace,
|
||||
Annotations: map[string]string{
|
||||
"prometheus.io/port": "443",
|
||||
"prometheus.io/scheme": "https",
|
||||
"prometheus.io/scrape": "true",
|
||||
},
|
||||
},
|
||||
Spec: corev1.ServiceSpec{
|
||||
Ports: []corev1.ServicePort{
|
||||
{
|
||||
Port: 443,
|
||||
TargetPort: intstr.FromInt(443),
|
||||
},
|
||||
},
|
||||
Selector: b.podLabel,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
var serviceAccount = corev1.ServiceAccount{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "v1",
|
||||
Kind: "ServiceAccount",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
},
|
||||
}
|
||||
|
||||
type ClusterRole struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||
Rules []rbacv1.PolicyRule `json:"rules,omitempty"`
|
||||
}
|
||||
|
||||
var clusterRole = ClusterRole{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "rbac.authorization.k8s.io/v1",
|
||||
Kind: "ClusterRole",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
Rules: []rbacv1.PolicyRule{
|
||||
{
|
||||
APIGroups: []string{""},
|
||||
Resources: []string{"secrets"},
|
||||
Verbs: []string{"create", "get", "update", "patch"},
|
||||
},
|
||||
{
|
||||
APIGroups: []string{""},
|
||||
Resources: []string{"serviceaccounts"},
|
||||
Verbs: []string{"get", "watch", "list"},
|
||||
},
|
||||
{
|
||||
APIGroups: []string{"certificates.k8s.io"},
|
||||
Resources: []string{"certificatesigningrequests"},
|
||||
Verbs: []string{"create", "get", "list", "watch"},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
type ClusterRoleBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||
RoleRef rbacv1.RoleRef `json:"roleRef"`
|
||||
Subjects []rbacv1.Subject `json:"subjects"`
|
||||
}
|
||||
|
||||
var clusterRoleBinding = ClusterRoleBinding{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "rbac.authorization.k8s.io/v1",
|
||||
Kind: "ClusterRoleBinding",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
Kind: "ClusterRole",
|
||||
Name: "pod-identity-webhook",
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
var service = corev1.Service{
|
||||
TypeMeta: metav1.TypeMeta{
|
||||
APIVersion: "v1",
|
||||
Kind: "Service",
|
||||
},
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "pod-identity-webhook",
|
||||
Namespace: "kube-system",
|
||||
Annotations: map[string]string{
|
||||
"prometheus.io/port": "443",
|
||||
"prometheus.io/scheme": "https",
|
||||
"prometheus.io/scrape": "true",
|
||||
},
|
||||
},
|
||||
Spec: corev1.ServiceSpec{
|
||||
Ports: []corev1.ServicePort{
|
||||
{
|
||||
Port: 443,
|
||||
TargetPort: intstr.FromInt(443),
|
||||
},
|
||||
},
|
||||
Selector: map[string]string{
|
||||
"app": "pod-identity-webhook",
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user