feat: Add conversion webhook

Author: Techassi

Tiltfile

@@ -17,11 +17,6 @@ custom_build(
     outputs_image_ref_to='result/ref',
 )
 
-# Load the latest CRDs from Nix
-watch_file('result')
-if os.path.exists('result'):
-   k8s_yaml('result/crds.yaml')
-
 # We need to set the correct image annotation on the operator Deployment to use e.g.
 # oci.stackable.tech/sandbox/opa-operator:7y19m3d8clwxlv34v5q2x4p7v536s00g instead of
 # oci.stackable.tech/sandbox/opa-operator:0.0.0-dev (which does not exist)
@@ -35,18 +30,12 @@ helm_values = settings.get('helm_values', None)
 
 helm_override_image_repository = 'image.repository=' + registry + '/' + operator_name
 
-# Exclude stale CRDs from Helm chart, and apply the rest
-helm_crds, helm_non_crds = filter_yaml(
-   helm(
-      'deploy/helm/' + operator_name,
-      name=operator_name,
-      namespace="stackable-operators",
-      set=[
-         helm_override_image_repository,
-      ],
-      values=helm_values,
-   ),
-   api_version = "^apiextensions\\.k8s\\.io/.*$",
-   kind = "^CustomResourceDefinition$",
-)
-k8s_yaml(helm_non_crds)
+k8s_yaml(helm(
+   'deploy/helm/' + operator_name,
+   name=operator_name,
+   namespace="stackable-operators",
+   set=[
+      helm_override_image_repository,
+   ],
+   values=helm_values,
+))

rust/operator-binary/src/main.rs

@@ -18,11 +18,11 @@ use stackable_operator::{
     telemetry::Tracing,
     utils::signal::SignalWatcher,
 };
-use webhook::create_webhook_server;
+use webhooks::create_webhook_server;
 
 mod restart_controller;
 mod utils;
-mod webhook;
+mod webhooks;
 
 mod built_info {
     include!(concat!(env!("OUT_DIR"), "/built.rs"));
@@ -124,6 +124,7 @@ async fn main() -> anyhow::Result<()> {
                 ctx,
                 &operator_environment,
                 disable_restarter_mutating_webhook,
+                maintenance.disable_crd_maintenance,
                 client.as_kube_client(),
             )
             .await?;

rust/operator-binary/src/webhooks/conversion.rs

@@ -0,0 +1,37 @@
+use stackable_operator::{
+    crd::{
+        authentication::core::{AuthenticationClass, AuthenticationClassVersion},
+        s3::{S3Bucket, S3BucketVersion, S3Connection, S3ConnectionVersion},
+    },
+    kube::Client,
+    webhook::webhooks::{ConversionWebhook, ConversionWebhookOptions, Webhook},
+};
+
+use crate::FIELD_MANAGER;
+
+pub fn create_webhook(disable_crd_maintenance: bool, client: Client) -> Box<impl Webhook> {
+    let crds_and_handlers = vec![
+        (
+            AuthenticationClass::merged_crd(AuthenticationClassVersion::V1Alpha1).unwrap(),
+            AuthenticationClass::try_convert as fn(_) -> _,
+        ),
+        (
+            S3Connection::merged_crd(S3ConnectionVersion::V1Alpha1).unwrap(),
+            S3Connection::try_convert as fn(_) -> _,
+        ),
+        (
+            S3Bucket::merged_crd(S3BucketVersion::V1Alpha1).unwrap(),
+            S3Bucket::try_convert as fn(_) -> _,
+        ),
+    ];
+
+    let conversion_webhook_options = ConversionWebhookOptions {
+        disable_crd_maintenance,
+        field_manager: FIELD_MANAGER.to_owned(),
+    };
+
+    let (conversion_webhook, _initial_reconcile_rx) =
+        ConversionWebhook::new(crds_and_handlers, client, conversion_webhook_options);
+
+    Box::new(conversion_webhook)
+}

rust/operator-binary/src/webhook/mod.rs rust/operator-binary/src/webhooks/mod.rsrust/operator-binary/src/webhook/mod.rs renamed to rust/operator-binary/src/webhooks/mod.rs

@@ -1,20 +1,15 @@
 use std::sync::Arc;
 
-use restarter_mutate_sts::{
-    add_sts_restarter_annotations_handler, get_sts_restarter_mutating_webhook_configuration,
-};
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     kube::Client,
-    webhook::{
-        WebhookServer, WebhookServerError, WebhookServerOptions,
-        webhooks::{MutatingWebhook, MutatingWebhookOptions, Webhook},
-    },
+    webhook::{WebhookServer, WebhookServerError, WebhookServerOptions, webhooks::Webhook},
 };
 
-use crate::{FIELD_MANAGER, restart_controller::statefulset::Ctx};
+use crate::restart_controller::statefulset::Ctx;
 
+mod conversion;
 mod restarter_mutate_sts;
 
 #[derive(Debug, Snafu)]
@@ -27,24 +22,23 @@ pub async fn create_webhook_server(
     ctx: Arc<Ctx>,
     operator_environment: &OperatorEnvironmentOptions,
     disable_restarter_mutating_webhook: bool,
+    disable_crd_maintenance: bool,
     client: Client,
 ) -> Result<WebhookServer, Error> {
     let mut webhooks: Vec<Box<dyn Webhook>> = vec![];
-    if !disable_restarter_mutating_webhook {
-        let mutating_webhook_options = MutatingWebhookOptions {
-            disable_mwc_maintenance: disable_restarter_mutating_webhook,
-            field_manager: FIELD_MANAGER.to_owned(),
-        };
-
-        webhooks.push(Box::new(MutatingWebhook::new(
-            get_sts_restarter_mutating_webhook_configuration(),
-            add_sts_restarter_annotations_handler,
-            ctx,
-            client,
-            mutating_webhook_options,
-        )));
+
+    if let Some(webhook) = restarter_mutate_sts::create_webhook(
+        ctx,
+        disable_restarter_mutating_webhook,
+        client.clone(),
+    ) {
+        webhooks.push(webhook);
     }
 
+    // TODO (@Techassi): The conversion webhook should also allow to be disabled, rework the
+    // granularity of these options.
+    webhooks.push(conversion::create_webhook(disable_crd_maintenance, client));
+
     let webhook_options = WebhookServerOptions {
         socket_addr: WebhookServer::DEFAULT_SOCKET_ADDRESS,
         webhook_namespace: operator_environment.operator_namespace.to_owned(),

…nary/src/webhook/restarter_mutate_sts.rs …ary/src/webhooks/restarter_mutate_sts.rsrust/operator-binary/src/webhook/restarter_mutate_sts.rs renamed to rust/operator-binary/src/webhooks/restarter_mutate_sts.rs rust/operator-binary/src/webhook/restarter_mutate_sts.rs renamed to rust/operator-binary/src/webhooks/restarter_mutate_sts.rs

@@ -1,4 +1,4 @@
-use std::{collections::BTreeMap, sync::Arc};
+use std::{collections::BTreeMap, ops::Not, sync::Arc};
 
 use json_patch::{AddOperation, Patch, PatchOperation, jsonptr::PointerBuf};
 use stackable_operator::{
@@ -13,16 +13,44 @@ use stackable_operator::{
         },
         apimachinery::pkg::apis::meta::v1::LabelSelector,
     },
-    kube::core::admission::{AdmissionRequest, AdmissionResponse},
+    kube::{
+        Client,
+        core::admission::{AdmissionRequest, AdmissionResponse},
+    },
     kvp::Label,
+    webhook::webhooks::{MutatingWebhookOptions, Webhook},
 };
 
 use crate::{
-    OPERATOR_NAME,
+    FIELD_MANAGER, OPERATOR_NAME,
     restart_controller::statefulset::{Ctx, get_updated_restarter_annotations},
 };
 
-pub fn get_sts_restarter_mutating_webhook_configuration() -> MutatingWebhookConfiguration {
+pub fn create_webhook(
+    ctx: Arc<Ctx>,
+    disable_restarter_mutating_webhook: bool,
+    client: Client,
+) -> Option<Box<impl Webhook>> {
+    disable_restarter_mutating_webhook.not().then(|| {
+        let mutating_webhook_options = MutatingWebhookOptions {
+            // TODO (@Techassi): Make disabling webhooks and maintenance options more granular.
+            // NOTE: Technically this can never not be "false", so we could hard-code it. I'll leave
+            // it as is for now.
+            disable_mwc_maintenance: disable_restarter_mutating_webhook,
+            field_manager: FIELD_MANAGER.to_owned(),
+        };
+
+        Box::new(stackable_operator::webhook::webhooks::MutatingWebhook::new(
+            get_sts_restarter_mutating_webhook_configuration(),
+            add_sts_restarter_annotations_handler,
+            ctx,
+            client,
+            mutating_webhook_options,
+        ))
+    })
+}
+
+fn get_sts_restarter_mutating_webhook_configuration() -> MutatingWebhookConfiguration {
     let webhook_name = "restarter-sts-enricher.stackable.tech";
     let metadata = ObjectMetaBuilder::new()
         .name(webhook_name)
@@ -75,7 +103,7 @@ pub fn get_sts_restarter_mutating_webhook_configuration() -> MutatingWebhookConf
     }
 }
 
-pub async fn add_sts_restarter_annotations_handler(
+async fn add_sts_restarter_annotations_handler(
     ctx: Arc<Ctx>,
     request: AdmissionRequest<StatefulSet>,
 ) -> AdmissionResponse {