Skip to content

Commit e239d66

Browse files
PhilippMatthesPhilippMatthes
authored
Revert moving webhook templates out of library chart (#805)
Commit 33cb060 moved webhook Kubernetes resources (Service, Certificate, ValidatingWebhookConfiguration) from the shared library chart into only the cortex-nova bundle, assuming non-nova bundles don't implement webhooks. In reality all bundles (manila, cinder, ironcore, pods) register pipeline validation webhooks in the Go code and need these resources deployed. Without them the manager crashes on startup trying to load TLS certs from /tmp/k8s-webhook-server/serving-certs/tls.crt. This reverts that commit to restore the webhook templates in the library chart and re-enables webhook/certmanager in all bundle values. Assisted-by: Claude Code:claude-opus-4-20250514 [Bash] [Read]
1 parent bed9f9a commit e239d66

11 files changed

Lines changed: 120 additions & 80 deletions

File tree

‎Tiltfile‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -60,25 +60,26 @@ helm_repo(
6060
)
6161

6262
########### Certmanager
63-
# Certmanager is required for the validating webhook in the cortex-nova bundle.
64-
def setup_certmanager():
65-
cache_dir = '.tilt/cert-manager'
66-
cert_manager_version = 'v1.19.3'
67-
if not os.path.exists(cache_dir):
68-
local('mkdir -p ' + cache_dir)
69-
if not os.path.exists(cache_dir + '/cert-manager-' + cert_manager_version + '.yaml'):
70-
url = 'https://github.com/cert-manager/cert-manager/releases/download/' + cert_manager_version + '/cert-manager.yaml'
71-
local('curl -L ' + url + ' -o ' + cache_dir + '/cert-manager-' + cert_manager_version + '.yaml')
72-
local('kubectl apply -f ' + cache_dir + '/cert-manager-' + cert_manager_version + '.yaml')
73-
# Patch all three cert-manager deployments to add runAsUser for Docker Desktop compatibility
74-
patch_json = '{"spec":{"template":{"spec":{"securityContext":{"runAsUser":1000}}}}}'
75-
local('kubectl patch deployment cert-manager -n cert-manager --type=strategic -p \'' + patch_json + '\'')
76-
local('kubectl patch deployment cert-manager-cainjector -n cert-manager --type=strategic -p \'' + patch_json + '\'')
77-
local('kubectl patch deployment cert-manager-webhook -n cert-manager --type=strategic -p \'' + patch_json + '\'')
78-
# Wait for all three deployments to be ready
79-
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager --timeout=120s')
80-
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-cainjector --timeout=120s')
81-
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-webhook --timeout=120s')
63+
# Certmanager is required for the validating webhooks in the cortex bundles, so
64+
# we need to deploy it before the bundles. If you don't need the webhooks locally,
65+
# you can disable them in the values.yaml and skip deploying certmanager.
66+
cache_dir = '.tilt/cert-manager'
67+
cert_manager_version = 'v1.19.3'
68+
if not os.path.exists(cache_dir):
69+
local('mkdir -p ' + cache_dir)
70+
if not os.path.exists(cache_dir + '/cert-manager-' + cert_manager_version + '.yaml'):
71+
url = 'https://github.com/cert-manager/cert-manager/releases/download/' + cert_manager_version + '/cert-manager.yaml'
72+
local('curl -L ' + url + ' -o ' + cache_dir + '/cert-manager-' + cert_manager_version + '.yaml')
73+
local('kubectl apply -f ' + cache_dir + '/cert-manager-' + cert_manager_version + '.yaml')
74+
# Patch all three cert-manager deployments to add runAsUser for Docker Desktop compatibility
75+
patch_json = '{"spec":{"template":{"spec":{"securityContext":{"runAsUser":1000}}}}}'
76+
local('kubectl patch deployment cert-manager -n cert-manager --type=strategic -p \'' + patch_json + '\'')
77+
local('kubectl patch deployment cert-manager-cainjector -n cert-manager --type=strategic -p \'' + patch_json + '\'')
78+
local('kubectl patch deployment cert-manager-webhook -n cert-manager --type=strategic -p \'' + patch_json + '\'')
79+
# Wait for all three deployments to be ready
80+
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager --timeout=120s')
81+
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-cainjector --timeout=120s')
82+
local('kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-webhook --timeout=120s')
8283

8384
########### Dependency CRDs
8485
# Make sure the local cluster is running if you are running into startup issues here.
@@ -194,7 +195,6 @@ k8s_yaml(helm('./helm/bundles/cortex-crds', name='cortex-crds', set=crd_extra_va
194195

195196
if 'nova' in ACTIVE_DEPLOYMENTS:
196197
print("Activating Cortex Nova bundle")
197-
setup_certmanager()
198198
k8s_yaml(helm('./helm/bundles/cortex-nova', name='cortex-nova', values=tilt_values, set=env_set_overrides))
199199
k8s_resource('cortex-nova-postgresql-v18', labels=['Cortex-Nova'], port_forwards=[
200200
port_forward(8000, 5432),

‎helm/bundles/cortex-cinder/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ cortex: &cortex
105105
cortex-scheduling-controllers:
106106
<<: *cortex
107107
namePrefix: cortex-cinder-scheduling
108+
# Enable webhook that will validate CRDs for the scheduling controllers.
109+
webhook: {enable: true}
110+
certmanager: {enable: true} # Needed for the webhook TLS certificates.
108111
conf:
109112
<<: *cortexConf
110113
leaderElectionID: cortex-cinder-scheduling

‎helm/bundles/cortex-ironcore/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ cortex:
2424
crd: {enable: false}
2525
# Use this to unambiguate multiple cortex deployments in the same cluster.
2626
namePrefix: cortex-ironcore
27+
# Enable webhook that will validate CRDs for the scheduling controllers.
28+
webhook: {enable: true}
29+
certmanager: {enable: true} # Needed for the webhook TLS certificates.
2730
conf:
2831
# The operator will only touch CRs with this scheduling domain name.
2932
schedulingDomain: machines

‎helm/bundles/cortex-manila/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ cortex: &cortex
105105
cortex-scheduling-controllers:
106106
<<: *cortex
107107
namePrefix: cortex-manila-scheduling
108+
# Enable webhook that will validate CRDs for the scheduling controllers.
109+
webhook: {enable: true}
110+
certmanager: {enable: true} # Needed for the webhook TLS certificates.
108111
conf:
109112
<<: *cortexConf
110113
leaderElectionID: cortex-manila-scheduling

‎helm/bundles/cortex-nova/templates/webhook.yaml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎helm/bundles/cortex-nova/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,9 +114,9 @@ cortex: &cortex
114114
cortex-scheduling-controllers:
115115
<<: *cortex
116116
namePrefix: cortex-nova-scheduling
117-
# Enable webhook port, args, and cert volume mounts on the manager container.
117+
# Enable webhook that will validate CRDs for the scheduling controllers.
118118
webhook: {enable: true}
119-
certmanager: {enable: true}
119+
certmanager: {enable: true} # Needed for the webhook TLS certificates.
120120
conf:
121121
<<: *cortexConf
122122
leaderElectionID: cortex-nova-scheduling

‎helm/bundles/cortex-pods/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ cortex:
2424
crd: { enable: false }
2525
# Use this to unambiguate multiple cortex deployments in the same cluster.
2626
namePrefix: cortex-pods
27+
# Enable webhook that will validate CRDs for the scheduling controllers.
28+
webhook: {enable: true}
29+
certmanager: {enable: true} # Needed for the webhook TLS certificates.
2730
conf:
2831
# The operator will only touch CRs with this scheduling domain name.
2932
schedulingDomain: pods

‎helm/library/cortex/templates/certmanager/certificate.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,23 @@ spec:
3333
name: {{ .Values.namePrefix }}-selfsigned-issuer
3434
secretName: metrics-server-cert
3535
{{- end }}
36+
{{- if .Values.webhook.enable }}
37+
---
38+
# Certificate for the webhook
39+
apiVersion: cert-manager.io/v1
40+
kind: Certificate
41+
metadata:
42+
labels:
43+
{{- include "chart.labels" . | nindent 4 }}
44+
name: {{ .Values.namePrefix }}-webhook-cert
45+
namespace: {{ .Release.Namespace }}
46+
spec:
47+
dnsNames:
48+
- {{ .Values.namePrefix }}-webhook-service.{{ .Release.Namespace }}.svc
49+
- {{ .Values.namePrefix }}-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
50+
issuerRef:
51+
kind: Issuer
52+
name: {{ .Values.namePrefix }}-selfsigned-issuer
53+
secretName: {{ .Values.namePrefix }}-webhook-server-cert
54+
{{- end }}
3655
{{- end }}

‎helm/library/cortex/templates/webhook/validating-webhook-configuration.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{{- if .Values.webhook.enable }}
2+
apiVersion: admissionregistration.k8s.io/v1
3+
kind: ValidatingWebhookConfiguration
4+
metadata:
5+
name: {{ .Values.namePrefix }}-validating-webhook-configuration
6+
labels:
7+
{{- include "chart.labels" . | nindent 4 }}
8+
{{- if .Values.certmanager.enable }}
9+
annotations:
10+
"cert-manager.io/inject-ca-from": {{ .Release.Namespace }}/{{ .Values.namePrefix }}-webhook-cert
11+
{{- end }}
12+
webhooks:
13+
# This webhook validates the creation and update of cortex pipelines.
14+
- name: {{ .Values.namePrefix }}-validate-v1alpha1-pipeline.cortex.cloud
15+
admissionReviewVersions: [v1]
16+
clientConfig:
17+
# If we want to talk to the cortex webhook in another kubernetes cluster,
18+
# we can template this out to use the ingress url provided by cortex. E.g.:
19+
# url: "https://<my ingress url>/validate-cortex-cloud-v1alpha1-pipeline" for cross-cluster
20+
service:
21+
name: {{ .Values.namePrefix }}-webhook-service
22+
namespace: {{ .Release.Namespace }}
23+
# This path is managed by controller-runtime. It will route to the
24+
# correct validating webhook handler based on the path.
25+
path: /validate-cortex-cloud-v1alpha1-pipeline
26+
{{- if not .Values.certmanager.enable }}
27+
{{- if .Values.webhook.caBundle }}
28+
caBundle: {{ .Values.webhook.caBundle }}
29+
{{- end }}
30+
{{- end }}
31+
timeoutSeconds: 10
32+
failurePolicy: Ignore
33+
rules:
34+
- apiGroups:
35+
- cortex.cloud
36+
apiVersions:
37+
- v1alpha1
38+
operations:
39+
- CREATE
40+
- UPDATE
41+
resources:
42+
- pipelines
43+
sideEffects: None
44+
{{- if .Values.webhook.namespaceSelector }}
45+
namespaceSelector:
46+
{{- toYaml .Values.webhook.namespaceSelector | nindent 6 }}
47+
{{- end }}
48+
{{- end }}

‎helm/library/cortex/templates/webhook/webhook-service.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.webhook.enable }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ .Values.namePrefix }}-webhook-service
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "chart.labels" . | nindent 4 }}
9+
spec:
10+
ports:
11+
- port: 443
12+
protocol: TCP
13+
targetPort: 9443
14+
selector:
15+
{{- include "chart.selectorLabels" . | nindent 4 }}
16+
control-plane: controller-manager
17+
{{- end }}

0 commit comments

Comments
 (0)