add role, webhook resource

internal/selfhosted/webhook/base_manifests.go

@@ -1,7 +1,7 @@
 package webhook
 
 import (
-	"k8s.io/api/admissionregistration/v1beta1"
+	regv1 "k8s.io/api/admissionregistration/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -46,39 +46,42 @@ func newBaseManifestFactory() *baseManifestFactory {
 	}
 }
 
-func (b *baseManifestFactory) mutatingWebhookConfiguration() *v1beta1.MutatingWebhookConfiguration {
+func (b *baseManifestFactory) mutatingWebhookConfiguration() *regv1.MutatingWebhookConfiguration {
 	path := "/mutate"
-	failurePolicy := v1beta1.Ignore
-	return &v1beta1.MutatingWebhookConfiguration{
+	failurePolicy := regv1.Ignore
+	sideEffects := regv1.SideEffectClassNone
+	return &regv1.MutatingWebhookConfiguration{
 		TypeMeta: metav1.TypeMeta{
-			APIVersion: v1beta1.SchemeGroupVersion.String(),
+			APIVersion: regv1.SchemeGroupVersion.String(),
 			Kind:       "MutatingWebhookConfiguration",
 		},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      b.mutatingWebhookConfigurationMeta.Name,
 			Namespace: b.mutatingWebhookConfigurationMeta.Namespace,
 		},
-		Webhooks: []v1beta1.MutatingWebhook{
+		Webhooks: []regv1.MutatingWebhook{
 			{
 				Name: "pod-identity-webhook.amazonaws.com",
-				ClientConfig: v1beta1.WebhookClientConfig{
-					Service: &v1beta1.ServiceReference{
+				ClientConfig: regv1.WebhookClientConfig{
+					Service: &regv1.ServiceReference{
 						Name:      b.serviceMeta.Name,
 						Namespace: b.serviceMeta.Namespace,
 						Path:      &path,
 					},
 				},
-				Rules: []v1beta1.RuleWithOperations{
+				Rules: []regv1.RuleWithOperations{
 					{
-						Operations: []v1beta1.OperationType{"CREATE"},
-						Rule: v1beta1.Rule{
+						Operations: []regv1.OperationType{"CREATE"},
+						Rule: regv1.Rule{
 							APIGroups:   []string{""},
 							APIVersions: []string{"v1"},
 							Resources:   []string{"pods"},
 						},
 					},
 				},
-				FailurePolicy: &failurePolicy,
+				FailurePolicy:           &failurePolicy,
+				SideEffects:             &sideEffects,
+				AdmissionReviewVersions: []string{"v1beta1"},
 			},
 		},
 	}

internal/selfhosted/webhook/base_manifests_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/goccy/go-yaml"
 	"github.com/stretchr/testify/assert"
-	"k8s.io/api/admissionregistration/v1beta1"
+	regv1 "k8s.io/api/admissionregistration/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -84,7 +84,7 @@ func TestBaseManifests(t *testing.T) {
 }
 
 func testMutatingWebhookConfiguration() client.Object {
-	return &v1beta1.MutatingWebhookConfiguration{}
+	return &regv1.MutatingWebhookConfiguration{}
 }
 
 func testService() client.Object {

internal/selfhosted/webhook/testdata/mutatingwebhook.yaml

@@ -1,4 +1,4 @@
-apiVersion: admissionregistration.k8s.io/v1beta1
+apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   name: pod-identity-webhook
@@ -16,3 +16,5 @@ webhooks:
         apiGroups: [""]
         apiVersions: ["v1"]
         resources: ["pods"]
+    sideEffects: None
+    admissionReviewVersions: ["v1beta1"]

internal/selfhosted/webhook/webhook.go

@@ -8,7 +8,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-type AwsWebhook struct {
+type WebhookSetup struct {
 	resources []client.Object
 }
 
@@ -19,13 +19,17 @@ func secretNamespacedName() types.NamespacedName {
 	}
 }
 
-func NewWebHook() (*AwsWebhook, error) {
+func (w *WebhookSetup) Resources() []client.Object {
+	return w.resources
+}
+
+func NewWebHookSetup() (*WebhookSetup, error) {
 	factory := newBaseManifestFactory()
 	resources, err := myCertificate(factory)
 	if err != nil {
 		return nil, err
 	}
-	return &AwsWebhook{resources}, nil
+	return &WebhookSetup{resources}, nil
 }
 
 func myCertificate(base *baseManifestFactory) ([]client.Object, error) {