Skip to content

Commit ae4850d

Browse files
dprincedprince
committed
Enable keystone webhooks
1 parent b5e4bf5 commit ae4850d

3 files changed

Lines changed: 138 additions & 2 deletions

File tree

‎bindata/operator/keystone-operator-webhooks.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: webhook
6+
app.kubernetes.io/created-by: openstack-operator
7+
app.kubernetes.io/instance: webhook-service
8+
app.kubernetes.io/managed-by: kustomize
9+
app.kubernetes.io/name: service
10+
app.kubernetes.io/part-of: keystone-operator
11+
name: keystone-operator-webhook-service
12+
namespace: '{{ .OperatorNamespace }}'
13+
spec:
14+
ports:
15+
- port: 443
16+
protocol: TCP
17+
targetPort: 9443
18+
selector:
19+
openstack.org/operator-name: keystone
20+
---
21+
apiVersion: cert-manager.io/v1
22+
kind: Certificate
23+
metadata:
24+
labels:
25+
app.kubernetes.io/component: certificate
26+
app.kubernetes.io/created-by: openstack-operator
27+
app.kubernetes.io/instance: serving-cert
28+
app.kubernetes.io/managed-by: kustomize
29+
app.kubernetes.io/name: certificate
30+
app.kubernetes.io/part-of: keystone-operator
31+
name: keystone-operator-serving-cert
32+
namespace: '{{ .OperatorNamespace }}'
33+
spec:
34+
dnsNames:
35+
- keystone-operator-webhook-service.{{ .OperatorNamespace }}.svc
36+
- keystone-operator-webhook-service.{{ .OperatorNamespace }}.svc.cluster.local
37+
issuerRef:
38+
kind: Issuer
39+
name: keystone-operator-selfsigned-issuer
40+
secretName: keystone-operator-webhook-server-cert
41+
---
42+
apiVersion: cert-manager.io/v1
43+
kind: Issuer
44+
metadata:
45+
labels:
46+
app.kubernetes.io/component: certificate
47+
app.kubernetes.io/created-by: openstack-operator
48+
app.kubernetes.io/instance: selfsigned-issuer
49+
app.kubernetes.io/managed-by: kustomize
50+
app.kubernetes.io/name: issuer
51+
app.kubernetes.io/part-of: keystone-operator
52+
name: keystone-operator-selfsigned-issuer
53+
namespace: '{{ .OperatorNamespace }}'
54+
spec:
55+
selfSigned: {}
56+
---
57+
apiVersion: admissionregistration.k8s.io/v1
58+
kind: MutatingWebhookConfiguration
59+
metadata:
60+
annotations:
61+
cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/keystone-operator-serving-cert'
62+
creationTimestamp: null
63+
labels:
64+
app.kubernetes.io/component: webhook
65+
app.kubernetes.io/created-by: openstack-operator
66+
app.kubernetes.io/instance: mutating-webhook-configuration
67+
app.kubernetes.io/managed-by: kustomize
68+
app.kubernetes.io/name: mutatingwebhookconfiguration
69+
app.kubernetes.io/part-of: keystone-operator
70+
name: keystone-operator-mutating-webhook-configuration
71+
webhooks:
72+
- admissionReviewVersions:
73+
- v1
74+
failurePolicy: Fail
75+
name: mkeystoneapi.kb.io
76+
rules:
77+
- apiGroups:
78+
- keystone.openstack.org
79+
apiVersions:
80+
- v1beta2
81+
operations:
82+
- CREATE
83+
- UPDATE
84+
resources:
85+
- keystoneapis
86+
sideEffects: None
87+
clientConfig:
88+
service:
89+
name: keystone-operator-webhook-service
90+
namespace: '{{ .OperatorNamespace }}'
91+
path: /mutate-keystone-openstack-org-v1beta2-keystoneapi
92+
---
93+
apiVersion: admissionregistration.k8s.io/v1
94+
kind: ValidatingWebhookConfiguration
95+
metadata:
96+
annotations:
97+
cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/keystone-operator-serving-cert'
98+
creationTimestamp: null
99+
labels:
100+
app.kubernetes.io/component: webhook
101+
app.kubernetes.io/created-by: openstack-operator
102+
app.kubernetes.io/instance: validating-webhook-configuration
103+
app.kubernetes.io/managed-by: kustomize
104+
app.kubernetes.io/name: validatingwebhookconfiguration
105+
app.kubernetes.io/part-of: keystone-operator
106+
name: keystone-operator-validating-webhook-configuration
107+
webhooks:
108+
- admissionReviewVersions:
109+
- v1
110+
failurePolicy: Fail
111+
name: vkeystoneapi.kb.io
112+
rules:
113+
- apiGroups:
114+
- keystone.openstack.org
115+
apiVersions:
116+
- v1beta2
117+
operations:
118+
- CREATE
119+
- UPDATE
120+
resources:
121+
- keystoneapis
122+
sideEffects: None
123+
clientConfig:
124+
service:
125+
name: keystone-operator-webhook-service
126+
namespace: '{{ .OperatorNamespace }}'
127+
path: /validate-keystone-openstack-org-v1beta2-keystoneapi

‎controllers/operator/openstack_controller.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,7 @@ func containerImageMatch(instance *operatorv1beta1.OpenStack) bool {
394394

395395
func isWebhookEndpoint(name string) bool {
396396
// NOTE: this is a static list for all operators with webhooks enabled
397-
endpointNames := []string{"openstack-operator-webhook-service", "infra-operator-webhook-service", "openstack-baremetal-operator-webhook-service"}
397+
endpointNames := []string{"openstack-operator-webhook-service", "infra-operator-webhook-service", "keystone-operator-webhook-service", "openstack-baremetal-operator-webhook-service"}
398398
for _, prefix := range endpointNames {
399399
if strings.HasPrefix(name, prefix) {
400400
return true
@@ -594,6 +594,15 @@ func (r *OpenStackReconciler) applyOperator(ctx context.Context, instance *opera
594594
Name: "ENABLE_WEBHOOKS",
595595
Value: "true",
596596
})
597+
case operatorv1beta1.KeystoneOperatorName:
598+
// enable webhooks on the keystone-operator
599+
serviceOp.Deployment.Manager.Env = append(serviceOp.Deployment.Manager.Env,
600+
corev1.EnvVar{
601+
Name: "ENABLE_WEBHOOKS",
602+
Value: "true",
603+
})
604+
serviceOp.Deployment.Manager.Env = append(serviceOp.Deployment.Manager.Env,
605+
relatedImagesEnv...)
597606
default:
598607
// disable webhooks per default
599608
serviceOp.Deployment.Manager.Env = append(serviceOp.Deployment.Manager.Env,

‎hack/sync-bindata.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ for X in $(ls manifests/*clusterserviceversion.yaml); do
173173
CLUSTER_ROLE_RULES=$(cat $X | $LOCAL_BINARIES/yq -r .spec.install.spec.clusterPermissions| sed -e 's|- rules:|rules:|' | sed -e 's| ||' | sed -e '/ serviceAccountName.*/d'
174174
)
175175

176-
if [[ "$OPERATOR_NAME" == "infra-operator" || "$OPERATOR_NAME" == "openstack-baremetal-operator" ]]; then
176+
if [[ "$OPERATOR_NAME" == "infra-operator" || "$OPERATOR_NAME" == "openstack-baremetal-operator" || "$OPERATOR_NAME" == "keystone-operator" ]]; then
177177
write_webhooks "$X" "$OPERATOR_NAME"
178178
fi
179179

0 commit comments

Comments
 (0)