From 9cac8fcd0bb081f1a03e2b33800b7e6fd198d857 Mon Sep 17 00:00:00 2001 From: kkb0318 Date: Sat, 11 May 2024 17:08:43 +0900 Subject: [PATCH] add role, webhook resource --- config/rbac/role.yaml | 60 +++++++++++++++++++ go.mod | 8 +-- go.sum | 16 ++--- internal/controller/irsasetup_controller.go | 15 +++++ internal/selfhosted/selfhosted.go | 4 +- internal/selfhosted/webhook/base_manifests.go | 27 +++++---- .../selfhosted/webhook/base_manifests_test.go | 4 +- .../webhook/testdata/mutatingwebhook.yaml | 4 +- internal/selfhosted/webhook/webhook.go | 10 +++- 9 files changed, 117 insertions(+), 31 deletions(-) diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index c622163..4997e4b 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -16,6 +16,42 @@ rules: - patch - update - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + resources: + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - irsa.kkb0318.github.io resources: @@ -42,3 +78,27 @@ rules: - get - patch - update +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/go.mod b/go.mod index ab71602..8a3f6fe 100644 --- a/go.mod +++ b/go.mod @@ -6,8 +6,8 @@ toolchain go1.22.2 require ( github.com/aws/aws-sdk-go-v2 v1.26.1 - github.com/aws/aws-sdk-go-v2/config v1.27.12 - github.com/aws/aws-sdk-go-v2/credentials v1.17.12 + github.com/aws/aws-sdk-go-v2/config v1.27.13 + github.com/aws/aws-sdk-go-v2/credentials v1.17.13 github.com/aws/aws-sdk-go-v2/service/iam v1.32.1 github.com/aws/aws-sdk-go-v2/service/s3 v1.53.2 github.com/aws/aws-sdk-go-v2/service/sts v1.28.7 @@ -43,7 +43,7 @@ require ( github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.20.6 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect @@ -74,7 +74,7 @@ require ( github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/prometheus/client_golang v1.19.0 // indirect + github.com/prometheus/client_golang v1.19.1 // indirect github.com/prometheus/client_model v0.6.1 // indirect github.com/prometheus/common v0.53.0 // indirect github.com/prometheus/procfs v0.14.0 // indirect diff --git a/go.sum b/go.sum index 7e3aed1..1727905 100644 --- a/go.sum +++ b/go.sum @@ -2,10 +2,10 @@ github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+ github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg= -github.com/aws/aws-sdk-go-v2/config v1.27.12 h1:vq88mBaZI4NGLXk8ierArwSILmYHDJZGJOeAc/pzEVQ= -github.com/aws/aws-sdk-go-v2/config v1.27.12/go.mod h1:IOrsf4IiN68+CgzyuyGUYTpCrtUQTbbMEAtR/MR/4ZU= -github.com/aws/aws-sdk-go-v2/credentials v1.17.12 h1:PVbKQ0KjDosI5+nEdRMU8ygEQDmkJTSHBqPjEX30lqc= -github.com/aws/aws-sdk-go-v2/credentials v1.17.12/go.mod h1:jlWtGFRtKsqc5zqerHZYmKmRkUXo3KPM14YJ13ZEjwE= +github.com/aws/aws-sdk-go-v2/config v1.27.13 h1:WbKW8hOzrWoOA/+35S5okqO/2Ap8hkkFUzoW8Hzq24A= +github.com/aws/aws-sdk-go-v2/config v1.27.13/go.mod h1:XLiyiTMnguytjRER7u5RIkhIqS8Nyz41SwAWb4xEjxs= +github.com/aws/aws-sdk-go-v2/credentials v1.17.13 h1:XDCJDzk/u5cN7Aple7D/MiAhx1Rjo/0nueJ0La8mRuE= +github.com/aws/aws-sdk-go-v2/credentials v1.17.13/go.mod h1:FMNcjQrmuBYvOTZDtOLCIu0esmxjF7RuA/89iSXWzQI= github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4= github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg= github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg= @@ -30,8 +30,8 @@ github.com/aws/aws-sdk-go-v2/service/s3 v1.53.2 h1:rq2hglTQM3yHZvOPVMtNvLS5x6hij github.com/aws/aws-sdk-go-v2/service/s3 v1.53.2/go.mod h1:qmdkIIAC+GCLASF7R2whgNrJADz0QZPX+Seiw/i4S3o= github.com/aws/aws-sdk-go-v2/service/sso v1.20.6 h1:o5cTaeunSpfXiLTIBx5xo2enQmiChtu1IBbzXnfU9Hs= github.com/aws/aws-sdk-go-v2/service/sso v1.20.6/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5 h1:Ciiz/plN+Z+pPO1G0W2zJoYIIl0KtKzY0LJ78NXYTws= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.5/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.0 h1:Qe0r0lVURDDeBQJ4yP+BOrJkvkiCo/3FH/t+wY11dmw= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.0/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak= github.com/aws/aws-sdk-go-v2/service/sts v1.28.7 h1:et3Ta53gotFR4ERLXXHIHl/Uuk1qYpP5uU7cvNql8ns= github.com/aws/aws-sdk-go-v2/service/sts v1.28.7/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw= github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q= @@ -130,8 +130,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU= -github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k= +github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE= +github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho= github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E= github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY= github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+aLCE= diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go index 1769687..7cd8b6a 100644 --- a/internal/controller/irsasetup_controller.go +++ b/internal/controller/irsasetup_controller.go @@ -32,6 +32,7 @@ import ( "github.com/kkb0318/irsa-manager/internal/manifests" "github.com/kkb0318/irsa-manager/internal/selfhosted" "github.com/kkb0318/irsa-manager/internal/selfhosted/oidc" + "github.com/kkb0318/irsa-manager/internal/selfhosted/webhook" ) const irsamanagerFinalizer = "irsa.kkb0318.github.io/finalizers" @@ -47,6 +48,11 @@ type IRSASetupReconciler struct { //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/status,verbs=get;update;patch //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/finalizers,verbs=update //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="apps",resources=deployments,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterroles,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterrolebindings,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="admissionregistration.k8s.io",resources=mutatingwebhookconfigurations,verbs=get;list;watch;create;update;patch;delete // Reconcile is part of the main kubernetes reconciliation loop which aims to // move the current state of the cluster closer to the desired state. @@ -170,6 +176,15 @@ func reconcileSelfhosted(ctx context.Context, obj *irsav1alpha1.IRSASetup, awsCl kubeHandler := handler.NewKubernetesHandler(kubeClient) kubeHandler.Append(secret) + // for webhook setup + webhookSetup, err := webhook.NewWebHookSetup() + if err != nil { + return err + } + for _, r := range webhookSetup.Resources() { + kubeHandler.Append(r) + } + var e error var reason irsav1alpha1.SelfHostedReason defer func() { diff --git a/internal/selfhosted/selfhosted.go b/internal/selfhosted/selfhosted.go index 12f8fd2..b113ffe 100644 --- a/internal/selfhosted/selfhosted.go +++ b/internal/selfhosted/selfhosted.go @@ -1,6 +1,8 @@ package selfhosted -import "context" +import ( + "context" +) func Execute(ctx context.Context, idpComponentsFactory OIDCIdPFactory, forceUpdate bool) error { issuerMeta := idpComponentsFactory.IssuerMeta() diff --git a/internal/selfhosted/webhook/base_manifests.go b/internal/selfhosted/webhook/base_manifests.go index 9044a34..f6184ed 100644 --- a/internal/selfhosted/webhook/base_manifests.go +++ b/internal/selfhosted/webhook/base_manifests.go @@ -1,7 +1,7 @@ package webhook import ( - "k8s.io/api/admissionregistration/v1beta1" + regv1 "k8s.io/api/admissionregistration/v1" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" @@ -46,39 +46,42 @@ func newBaseManifestFactory() *baseManifestFactory { } } -func (b *baseManifestFactory) mutatingWebhookConfiguration() *v1beta1.MutatingWebhookConfiguration { +func (b *baseManifestFactory) mutatingWebhookConfiguration() *regv1.MutatingWebhookConfiguration { path := "/mutate" - failurePolicy := v1beta1.Ignore - return &v1beta1.MutatingWebhookConfiguration{ + failurePolicy := regv1.Ignore + sideEffects := regv1.SideEffectClassNone + return ®v1.MutatingWebhookConfiguration{ TypeMeta: metav1.TypeMeta{ - APIVersion: v1beta1.SchemeGroupVersion.String(), + APIVersion: regv1.SchemeGroupVersion.String(), Kind: "MutatingWebhookConfiguration", }, ObjectMeta: metav1.ObjectMeta{ Name: b.mutatingWebhookConfigurationMeta.Name, Namespace: b.mutatingWebhookConfigurationMeta.Namespace, }, - Webhooks: []v1beta1.MutatingWebhook{ + Webhooks: []regv1.MutatingWebhook{ { Name: "pod-identity-webhook.amazonaws.com", - ClientConfig: v1beta1.WebhookClientConfig{ - Service: &v1beta1.ServiceReference{ + ClientConfig: regv1.WebhookClientConfig{ + Service: ®v1.ServiceReference{ Name: b.serviceMeta.Name, Namespace: b.serviceMeta.Namespace, Path: &path, }, }, - Rules: []v1beta1.RuleWithOperations{ + Rules: []regv1.RuleWithOperations{ { - Operations: []v1beta1.OperationType{"CREATE"}, - Rule: v1beta1.Rule{ + Operations: []regv1.OperationType{"CREATE"}, + Rule: regv1.Rule{ APIGroups: []string{""}, APIVersions: []string{"v1"}, Resources: []string{"pods"}, }, }, }, - FailurePolicy: &failurePolicy, + FailurePolicy: &failurePolicy, + SideEffects: &sideEffects, + AdmissionReviewVersions: []string{"v1beta1"}, }, }, } diff --git a/internal/selfhosted/webhook/base_manifests_test.go b/internal/selfhosted/webhook/base_manifests_test.go index 6d93e12..6f4b3ee 100644 --- a/internal/selfhosted/webhook/base_manifests_test.go +++ b/internal/selfhosted/webhook/base_manifests_test.go @@ -6,7 +6,7 @@ import ( "github.com/goccy/go-yaml" "github.com/stretchr/testify/assert" - "k8s.io/api/admissionregistration/v1beta1" + regv1 "k8s.io/api/admissionregistration/v1" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" @@ -84,7 +84,7 @@ func TestBaseManifests(t *testing.T) { } func testMutatingWebhookConfiguration() client.Object { - return &v1beta1.MutatingWebhookConfiguration{} + return ®v1.MutatingWebhookConfiguration{} } func testService() client.Object { diff --git a/internal/selfhosted/webhook/testdata/mutatingwebhook.yaml b/internal/selfhosted/webhook/testdata/mutatingwebhook.yaml index c1820eb..f288c50 100644 --- a/internal/selfhosted/webhook/testdata/mutatingwebhook.yaml +++ b/internal/selfhosted/webhook/testdata/mutatingwebhook.yaml @@ -1,4 +1,4 @@ -apiVersion: admissionregistration.k8s.io/v1beta1 +apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: pod-identity-webhook @@ -16,3 +16,5 @@ webhooks: apiGroups: [""] apiVersions: ["v1"] resources: ["pods"] + sideEffects: None + admissionReviewVersions: ["v1beta1"] diff --git a/internal/selfhosted/webhook/webhook.go b/internal/selfhosted/webhook/webhook.go index 7930b39..70d617f 100644 --- a/internal/selfhosted/webhook/webhook.go +++ b/internal/selfhosted/webhook/webhook.go @@ -8,7 +8,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" ) -type AwsWebhook struct { +type WebhookSetup struct { resources []client.Object } @@ -19,13 +19,17 @@ func secretNamespacedName() types.NamespacedName { } } -func NewWebHook() (*AwsWebhook, error) { +func (w *WebhookSetup) Resources() []client.Object { + return w.resources +} + +func NewWebHookSetup() (*WebhookSetup, error) { factory := newBaseManifestFactory() resources, err := myCertificate(factory) if err != nil { return nil, err } - return &AwsWebhook{resources}, nil + return &WebhookSetup{resources}, nil } func myCertificate(base *baseManifestFactory) ([]client.Object, error) {