From fb81666e5679ee92507dd96eeb4dcc40f37afdec Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 1 Oct 2021 15:02:25 +0100 Subject: [PATCH 01/18] Add config.cert-manager.io API group Signed-off-by: James Munnelly --- hack/update-codegen.sh | 4 ++ internal/apis/config/BUILD.bazel | 37 ++++++++++ internal/apis/config/doc.go | 21 ++++++ internal/apis/config/install/BUILD.bazel | 47 +++++++++++++ internal/apis/config/install/install.go | 33 +++++++++ internal/apis/config/install/pruning_test.go | 32 +++++++++ .../apis/config/install/roundtrip_test.go | 29 ++++++++ internal/apis/config/register.go | 46 +++++++++++++ internal/apis/config/types_webhook.go | 9 +++ internal/apis/config/v1alpha1/BUILD.bazel | 37 ++++++++++ internal/apis/config/v1alpha1/conversion.go | 17 +++++ internal/apis/config/v1alpha1/defaults.go | 25 +++++++ internal/apis/config/v1alpha1/doc.go | 23 +++++++ internal/apis/config/v1alpha1/register.go | 44 ++++++++++++ .../v1alpha1/zz_generated.conversion.go | 67 +++++++++++++++++++ .../config/v1alpha1/zz_generated.defaults.go | 33 +++++++++ internal/apis/config/zz_generated.deepcopy.go | 51 ++++++++++++++ pkg/apis/BUILD.bazel | 1 + pkg/apis/config/BUILD.bazel | 25 +++++++ pkg/apis/config/doc.go | 22 ++++++ pkg/apis/config/v1alpha1/BUILD.bazel | 33 +++++++++ pkg/apis/config/v1alpha1/doc.go | 22 ++++++ pkg/apis/config/v1alpha1/register.go | 56 ++++++++++++++++ pkg/apis/config/v1alpha1/types_webhook.go | 9 +++ .../config/v1alpha1/zz_generated.deepcopy.go | 51 ++++++++++++++ 25 files changed, 774 insertions(+) create mode 100644 internal/apis/config/BUILD.bazel create mode 100644 internal/apis/config/doc.go create mode 100644 internal/apis/config/install/BUILD.bazel create mode 100644 internal/apis/config/install/install.go create mode 100644 internal/apis/config/install/pruning_test.go create mode 100644 internal/apis/config/install/roundtrip_test.go create mode 100644 internal/apis/config/register.go create mode 100644 internal/apis/config/types_webhook.go create mode 100644 internal/apis/config/v1alpha1/BUILD.bazel create mode 100644 internal/apis/config/v1alpha1/conversion.go create mode 100644 internal/apis/config/v1alpha1/defaults.go create mode 100644 internal/apis/config/v1alpha1/doc.go create mode 100644 internal/apis/config/v1alpha1/register.go create mode 100644 internal/apis/config/v1alpha1/zz_generated.conversion.go create mode 100644 internal/apis/config/v1alpha1/zz_generated.defaults.go create mode 100644 internal/apis/config/zz_generated.deepcopy.go create mode 100644 pkg/apis/config/BUILD.bazel create mode 100644 pkg/apis/config/doc.go create mode 100644 pkg/apis/config/v1alpha1/BUILD.bazel create mode 100644 pkg/apis/config/v1alpha1/doc.go create mode 100644 pkg/apis/config/v1alpha1/register.go create mode 100644 pkg/apis/config/v1alpha1/types_webhook.go create mode 100644 pkg/apis/config/v1alpha1/zz_generated.deepcopy.go diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh index 6461f1e82..1bfdfe541 100755 --- a/hack/update-codegen.sh +++ b/hack/update-codegen.sh @@ -44,6 +44,8 @@ deepcopy_inputs=( pkg/apis/acme/v1beta1 \ pkg/apis/acme/v1 \ internal/apis/acme \ + pkg/apis/config/v1alpha1 \ + internal/apis/config \ pkg/apis/meta/v1 \ internal/apis/meta \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ @@ -76,6 +78,7 @@ defaulter_inputs=( internal/apis/acme/v1alpha3 \ internal/apis/acme/v1beta1 \ internal/apis/acme/v1 \ + internal/apis/config/v1alpha1 \ internal/apis/meta/v1 \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ pkg/webhook/handlers/testdata/apis/testgroup/v1 \ @@ -91,6 +94,7 @@ conversion_inputs=( internal/apis/acme/v1alpha3 \ internal/apis/acme/v1beta1 \ internal/apis/acme/v1 \ + internal/apis/config/v1alpha1 \ internal/apis/meta/v1 \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ pkg/webhook/handlers/testdata/apis/testgroup/v1 \ diff --git a/internal/apis/config/BUILD.bazel b/internal/apis/config/BUILD.bazel new file mode 100644 index 000000000..3ecf484b1 --- /dev/null +++ b/internal/apis/config/BUILD.bazel @@ -0,0 +1,37 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = [ + "doc.go", + "register.go", + "types_webhook.go", + "zz_generated.deepcopy.go", + ], + importpath = "github.com/jetstack/cert-manager/internal/apis/config", + visibility = ["//pkg:__subpackages__"], + deps = [ + "//pkg/apis/config:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [ + ":package-srcs", + "//internal/apis/config/install:all-srcs", + "//internal/apis/config/v1alpha1:all-srcs", + ], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/internal/apis/config/doc.go b/internal/apis/config/doc.go new file mode 100644 index 000000000..8e6aca8ca --- /dev/null +++ b/internal/apis/config/doc.go @@ -0,0 +1,21 @@ +/* +Copyright 2020 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// +k8s:deepcopy-gen=package,register + +// Package config is the internal version of the API. +// +groupName=config.cert-manager.io +package config diff --git a/internal/apis/config/install/BUILD.bazel b/internal/apis/config/install/BUILD.bazel new file mode 100644 index 000000000..b8c56c2ce --- /dev/null +++ b/internal/apis/config/install/BUILD.bazel @@ -0,0 +1,47 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test") + +go_library( + name = "go_default_library", + srcs = ["install.go"], + importpath = "github.com/jetstack/cert-manager/internal/apis/config/install", + visibility = ["//visibility:public"], + deps = [ + "//internal/apis/config:go_default_library", + "//internal/apis/config/v1alpha1:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_apimachinery//pkg/util/runtime:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) + +go_test( + name = "go_default_test", + srcs = [ + "pruning_test.go", + "roundtrip_test.go", + ], + data = [ + "//deploy/crds:templated_files", + ], + embed = [":go_default_library"], + deps = [ + "//pkg/api:go_default_library", + "//pkg/api/testing:go_default_library", + "//internal/apis/acme/fuzzer:go_default_library", + "@com_github_munnerz_crd_schema_fuzz//:go_default_library", + "@io_k8s_apimachinery//pkg/api/apitesting/roundtrip:go_default_library", + ], +) diff --git a/internal/apis/config/install/install.go b/internal/apis/config/install/install.go new file mode 100644 index 000000000..8edb703d2 --- /dev/null +++ b/internal/apis/config/install/install.go @@ -0,0 +1,33 @@ +/* +Copyright 2020 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package install installs the API group, making it available as an option to +// all of the API encoding/decoding machinery. +package install + +import ( + "k8s.io/apimachinery/pkg/runtime" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + + "github.com/jetstack/cert-manager/internal/apis/config" + "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1" +) + +// Install registers the API group and adds types to a scheme +func Install(scheme *runtime.Scheme) { + utilruntime.Must(config.AddToScheme(scheme)) + utilruntime.Must(v1alpha1.AddToScheme(scheme)) +} diff --git a/internal/apis/config/install/pruning_test.go b/internal/apis/config/install/pruning_test.go new file mode 100644 index 000000000..9c82bdb00 --- /dev/null +++ b/internal/apis/config/install/pruning_test.go @@ -0,0 +1,32 @@ +/* +Copyright 2020 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package install + +import ( + "testing" + + crdfuzz "github.com/munnerz/crd-schema-fuzz" + + acmefuzzer "github.com/jetstack/cert-manager/internal/apis/acme/fuzzer" + "github.com/jetstack/cert-manager/pkg/api" + apitesting "github.com/jetstack/cert-manager/pkg/api/testing" +) + +func TestPruneTypes(t *testing.T) { + crdfuzz.SchemaFuzzTestForCRDWithPath(t, api.Scheme, apitesting.PathForCRD(t, "orders"), acmefuzzer.Funcs) + crdfuzz.SchemaFuzzTestForCRDWithPath(t, api.Scheme, apitesting.PathForCRD(t, "challenges"), acmefuzzer.Funcs) +} diff --git a/internal/apis/config/install/roundtrip_test.go b/internal/apis/config/install/roundtrip_test.go new file mode 100644 index 000000000..c634f2f00 --- /dev/null +++ b/internal/apis/config/install/roundtrip_test.go @@ -0,0 +1,29 @@ +/* +Copyright 2020 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package install + +import ( + "testing" + + "k8s.io/apimachinery/pkg/api/apitesting/roundtrip" + + acmefuzzer "github.com/jetstack/cert-manager/internal/apis/acme/fuzzer" +) + +func TestRoundTripTypes(t *testing.T) { + roundtrip.RoundTripTestForAPIGroup(t, Install, acmefuzzer.Funcs) +} diff --git a/internal/apis/config/register.go b/internal/apis/config/register.go new file mode 100644 index 000000000..f4875d621 --- /dev/null +++ b/internal/apis/config/register.go @@ -0,0 +1,46 @@ +/* +Copyright 2020 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package config + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/jetstack/cert-manager/pkg/apis/config" +) + +var ( + SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) + AddToScheme = SchemeBuilder.AddToScheme +) + +// SchemeGroupVersion is group version used to register these objects +var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: runtime.APIVersionInternal} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} + +// Adds the list of known types to api.Scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &WebhookConfiguration{}, + // Add new kinds to be registered here + ) + return nil +} diff --git a/internal/apis/config/types_webhook.go b/internal/apis/config/types_webhook.go new file mode 100644 index 000000000..80ac8909c --- /dev/null +++ b/internal/apis/config/types_webhook.go @@ -0,0 +1,9 @@ +package config + +import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +type WebhookConfiguration struct { + metav1.TypeMeta `json:",inline"` +} diff --git a/internal/apis/config/v1alpha1/BUILD.bazel b/internal/apis/config/v1alpha1/BUILD.bazel new file mode 100644 index 000000000..8d2e5fd2e --- /dev/null +++ b/internal/apis/config/v1alpha1/BUILD.bazel @@ -0,0 +1,37 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = [ + "conversion.go", + "defaults.go", + "doc.go", + "register.go", + "zz_generated.conversion.go", + "zz_generated.defaults.go", + ], + importpath = "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1", + visibility = ["//pkg:__subpackages__"], + deps = [ + "//pkg/apis/config:go_default_library", + "//pkg/apis/config/v1alpha1:go_default_library", + "//internal/apis/config:go_default_library", + "@io_k8s_apimachinery//pkg/conversion:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/internal/apis/config/v1alpha1/conversion.go b/internal/apis/config/v1alpha1/conversion.go new file mode 100644 index 000000000..335956697 --- /dev/null +++ b/internal/apis/config/v1alpha1/conversion.go @@ -0,0 +1,17 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 diff --git a/internal/apis/config/v1alpha1/defaults.go b/internal/apis/config/v1alpha1/defaults.go new file mode 100644 index 000000000..f79f2d48e --- /dev/null +++ b/internal/apis/config/v1alpha1/defaults.go @@ -0,0 +1,25 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/runtime" +) + +func addDefaultingFuncs(scheme *runtime.Scheme) error { + return RegisterDefaults(scheme) +} diff --git a/internal/apis/config/v1alpha1/doc.go b/internal/apis/config/v1alpha1/doc.go new file mode 100644 index 000000000..6e719c1cc --- /dev/null +++ b/internal/apis/config/v1alpha1/doc.go @@ -0,0 +1,23 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config +// +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1 +// +k8s:defaulter-gen=TypeMeta +// +k8s:defaulter-gen-input=../../../../apis/config/v1alpha1 + +// +groupName=config.cert-manager.io +package v1alpha1 diff --git a/internal/apis/config/v1alpha1/register.go b/internal/apis/config/v1alpha1/register.go new file mode 100644 index 000000000..4b4d4c4bb --- /dev/null +++ b/internal/apis/config/v1alpha1/register.go @@ -0,0 +1,44 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/jetstack/cert-manager/pkg/apis/config" + "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" +) + +// SchemeGroupVersion is group version used to register these objects +var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: "v1alpha1"} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} + +var ( + localSchemeBuilder = &v1alpha1.SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addDefaultingFuncs) +} diff --git a/internal/apis/config/v1alpha1/zz_generated.conversion.go b/internal/apis/config/v1alpha1/zz_generated.conversion.go new file mode 100644 index 000000000..56fd8f5bb --- /dev/null +++ b/internal/apis/config/v1alpha1/zz_generated.conversion.go @@ -0,0 +1,67 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by conversion-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "github.com/jetstack/cert-manager/internal/apis/config" + v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" + conversion "k8s.io/apimachinery/pkg/conversion" + runtime "k8s.io/apimachinery/pkg/runtime" +) + +func init() { + localSchemeBuilder.Register(RegisterConversions) +} + +// RegisterConversions adds conversion functions to the given scheme. +// Public to allow building arbitrary schemes. +func RegisterConversions(s *runtime.Scheme) error { + if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookConfiguration)(nil), (*config.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(a.(*v1alpha1.WebhookConfiguration), b.(*config.WebhookConfiguration), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*config.WebhookConfiguration)(nil), (*v1alpha1.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(a.(*config.WebhookConfiguration), b.(*v1alpha1.WebhookConfiguration), scope) + }); err != nil { + return err + } + return nil +} + +func autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *config.WebhookConfiguration, s conversion.Scope) error { + return nil +} + +// Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration is an autogenerated conversion function. +func Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *config.WebhookConfiguration, s conversion.Scope) error { + return autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in, out, s) +} + +func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { + return nil +} + +// Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration is an autogenerated conversion function. +func Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { + return autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in, out, s) +} diff --git a/internal/apis/config/v1alpha1/zz_generated.defaults.go b/internal/apis/config/v1alpha1/zz_generated.defaults.go new file mode 100644 index 000000000..48c7e75b4 --- /dev/null +++ b/internal/apis/config/v1alpha1/zz_generated.defaults.go @@ -0,0 +1,33 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by defaulter-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// RegisterDefaults adds defaulters functions to the given scheme. +// Public to allow building arbitrary schemes. +// All generated defaulters are covering - they call all nested defaulters. +func RegisterDefaults(scheme *runtime.Scheme) error { + return nil +} diff --git a/internal/apis/config/zz_generated.deepcopy.go b/internal/apis/config/zz_generated.deepcopy.go new file mode 100644 index 000000000..efd5df937 --- /dev/null +++ b/internal/apis/config/zz_generated.deepcopy.go @@ -0,0 +1,51 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package config + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { + *out = *in + out.TypeMeta = in.TypeMeta + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConfiguration. +func (in *WebhookConfiguration) DeepCopy() *WebhookConfiguration { + if in == nil { + return nil + } + out := new(WebhookConfiguration) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} diff --git a/pkg/apis/BUILD.bazel b/pkg/apis/BUILD.bazel index f045e68a8..012210456 100644 --- a/pkg/apis/BUILD.bazel +++ b/pkg/apis/BUILD.bazel @@ -20,6 +20,7 @@ filegroup( ":package-srcs", "//pkg/apis/acme:all-srcs", "//pkg/apis/certmanager:all-srcs", + "//pkg/apis/config:all-srcs", "//pkg/apis/experimental:all-srcs", "//pkg/apis/meta:all-srcs", ], diff --git a/pkg/apis/config/BUILD.bazel b/pkg/apis/config/BUILD.bazel new file mode 100644 index 000000000..08d473549 --- /dev/null +++ b/pkg/apis/config/BUILD.bazel @@ -0,0 +1,25 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["doc.go"], + importpath = "github.com/jetstack/cert-manager/pkg/apis/config", + visibility = ["//visibility:public"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [ + ":package-srcs", + "//pkg/apis/config/v1alpha1:all-srcs", + ], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/pkg/apis/config/doc.go b/pkg/apis/config/doc.go new file mode 100644 index 000000000..590999204 --- /dev/null +++ b/pkg/apis/config/doc.go @@ -0,0 +1,22 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// +groupName=config.cert-manager.io + +// Package config contains types used to configure cert-manager components +package config + +const GroupName = "config.cert-manager.io" diff --git a/pkg/apis/config/v1alpha1/BUILD.bazel b/pkg/apis/config/v1alpha1/BUILD.bazel new file mode 100644 index 000000000..4c8995b22 --- /dev/null +++ b/pkg/apis/config/v1alpha1/BUILD.bazel @@ -0,0 +1,33 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = [ + "doc.go", + "register.go", + "types_webhook.go", + "zz_generated.deepcopy.go", + ], + importpath = "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1", + visibility = ["//visibility:public"], + deps = [ + "//pkg/apis/config:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/pkg/apis/config/v1alpha1/doc.go b/pkg/apis/config/v1alpha1/doc.go new file mode 100644 index 000000000..faac8e388 --- /dev/null +++ b/pkg/apis/config/v1alpha1/doc.go @@ -0,0 +1,22 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package v1alpha1 is the v1alpha1 version of the API. +// +k8s:deepcopy-gen=package,register +// +k8s:conversion-gen=github.com/jetstack/cert-manager/pkg/apis/config +// +k8s:defaulter-gen=TypeMeta +// +groupName=config.cert-manager.io +package v1alpha1 diff --git a/pkg/apis/config/v1alpha1/register.go b/pkg/apis/config/v1alpha1/register.go new file mode 100644 index 000000000..608f9d7c4 --- /dev/null +++ b/pkg/apis/config/v1alpha1/register.go @@ -0,0 +1,56 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/jetstack/cert-manager/pkg/apis/config" +) + +// SchemeGroupVersion is group version used to register these objects +var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: "v1alpha1"} + +// Resource takes an unqualified resource and returns a Group qualified GroupResource +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} + +var ( + SchemeBuilder runtime.SchemeBuilder + localSchemeBuilder = &SchemeBuilder + AddToScheme = localSchemeBuilder.AddToScheme +) + +func init() { + // We only register manually written functions here. The registration of the + // generated functions takes place in the generated files. The separation + // makes the code compile even when the generated files are missing. + localSchemeBuilder.Register(addKnownTypes) +} + +// Adds the list of known types to api.Scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &WebhookConfiguration{}, + // Add new kinds to be registered here + ) + metav1.AddToGroupVersion(scheme, SchemeGroupVersion) + return nil +} diff --git a/pkg/apis/config/v1alpha1/types_webhook.go b/pkg/apis/config/v1alpha1/types_webhook.go new file mode 100644 index 000000000..8a8927710 --- /dev/null +++ b/pkg/apis/config/v1alpha1/types_webhook.go @@ -0,0 +1,9 @@ +package v1alpha1 + +import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +type WebhookConfiguration struct { + metav1.TypeMeta `json:",inline"` +} diff --git a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 000000000..b32dcdb60 --- /dev/null +++ b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,51 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { + *out = *in + out.TypeMeta = in.TypeMeta + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConfiguration. +func (in *WebhookConfiguration) DeepCopy() *WebhookConfiguration { + if in == nil { + return nil + } + out := new(WebhookConfiguration) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} From afa8e5a3046cf6544e3dd85d8161baee5457de1d Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 21 Oct 2021 12:11:40 +0100 Subject: [PATCH 02/18] Refactoring webhook initialisation to support early config handling Signed-off-by: James Munnelly --- cmd/webhook/app/BUILD.bazel | 3 + cmd/webhook/app/options/BUILD.bazel | 4 +- cmd/webhook/app/options/options.go | 118 ++++++----------- cmd/webhook/app/testing/BUILD.bazel | 2 + cmd/webhook/app/testing/testwebhook.go | 16 ++- cmd/webhook/app/webhook.go | 120 +++++++++++++----- internal/BUILD.bazel | 1 + internal/apis/config/BUILD.bazel | 3 +- internal/apis/config/install/BUILD.bazel | 4 +- internal/apis/config/scheme/BUILD.bazel | 28 ++++ internal/apis/config/scheme/scheme.go | 24 ++++ internal/apis/config/types_webhook.go | 93 +++++++++++++- internal/apis/config/v1alpha1/BUILD.bazel | 5 +- internal/apis/config/v1alpha1/defaults.go | 14 ++ internal/apis/config/v1alpha1/doc.go | 2 +- .../config/v1alpha1/zz_generated.defaults.go | 6 + internal/apis/config/zz_generated.deepcopy.go | 61 +++++++++ pkg/apis/config/v1alpha1/types_webhook.go | 77 +++++++++++ .../config/v1alpha1/zz_generated.deepcopy.go | 61 +++++++++ 19 files changed, 522 insertions(+), 120 deletions(-) create mode 100644 internal/apis/config/scheme/BUILD.bazel create mode 100644 internal/apis/config/scheme/scheme.go diff --git a/cmd/webhook/app/BUILD.bazel b/cmd/webhook/app/BUILD.bazel index 12f803dcd..44faa0067 100644 --- a/cmd/webhook/app/BUILD.bazel +++ b/cmd/webhook/app/BUILD.bazel @@ -8,6 +8,7 @@ go_library( deps = [ "//cmd/util:go_default_library", "//cmd/webhook/app/options:go_default_library", + "//internal/apis/config:go_default_library", "//pkg/logs:go_default_library", "//pkg/util:go_default_library", "//pkg/webhook:go_default_library", @@ -17,8 +18,10 @@ go_library( "//pkg/webhook/server/tls:go_default_library", "@com_github_go_logr_logr//:go_default_library", "@com_github_spf13_cobra//:go_default_library", + "@com_github_spf13_pflag//:go_default_library", "@io_k8s_client_go//kubernetes:go_default_library", "@io_k8s_client_go//tools/clientcmd:go_default_library", + "@io_k8s_component_base//cli/flag:go_default_library", ], ) diff --git a/cmd/webhook/app/options/BUILD.bazel b/cmd/webhook/app/options/BUILD.bazel index 1d01de9a4..114d757f1 100644 --- a/cmd/webhook/app/options/BUILD.bazel +++ b/cmd/webhook/app/options/BUILD.bazel @@ -6,7 +6,9 @@ go_library( importpath = "github.com/jetstack/cert-manager/cmd/webhook/app/options", visibility = ["//visibility:public"], deps = [ - "//cmd/util:go_default_library", + "//internal/apis/config:go_default_library", + "//internal/apis/config/scheme:go_default_library", + "//pkg/apis/config/v1alpha1:go_default_library", "@com_github_spf13_pflag//:go_default_library", "@io_k8s_component_base//cli/flag:go_default_library", ], diff --git a/cmd/webhook/app/options/options.go b/cmd/webhook/app/options/options.go index f94efa15a..cb76eb1cc 100644 --- a/cmd/webhook/app/options/options.go +++ b/cmd/webhook/app/options/options.go @@ -22,97 +22,63 @@ import ( "github.com/spf13/pflag" cliflag "k8s.io/component-base/cli/flag" - cmdutil "github.com/jetstack/cert-manager/cmd/util" + "github.com/jetstack/cert-manager/internal/apis/config" + configscheme "github.com/jetstack/cert-manager/internal/apis/config/scheme" + configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" ) -const ( - // Default port on which /validate, /mutate, /convert endpoints will be served - defaultListeningPort = 6443 - // Default health check port - defaultHealthPort = 6080 -) +// WebhookFlags defines options that can only be configured via flags. +type WebhookFlags struct{} -type WebhookOptions struct { - ListenPort int - HealthzPort int - - // Path to TLS certificate and private key on disk. - // Both must be specified if either is. - // May not be specified if DynamicServingCASecretNamespace and - // DynamicServingCASecretName are set. - TLSCertFile string - TLSKeyFile string - - // Namespace and name of the Secret resource containing the TLS certificate - // used as a CA to sign dynamic serving certificates. - // Both must be specified if either is. - // May not be specified if TLSCertFile and TLSKeyFile are set. - DynamicServingCASecretNamespace string - DynamicServingCASecretName string - // List of DNSNames that must be present on serving certificates. - DynamicServingDNSNames []string - - // Optional path to the kubeconfig used to connect to the apiserver when - // using the 'dynamic serving' certificate sources. - // If not specified, in cluster config will be used. - Kubeconfig string - APIServerHost string - - // TLSCipherSuites is the list of allowed cipher suites for the server. - // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). - TLSCipherSuites []string - - // MinTLSVersion is the minimum TLS version supported. - // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). - MinTLSVersion string - - // EnablePprof determines whether pprof is enabled. - EnablePprof bool - - // Address on which /debug/pprof endpoint will be served if enabled. Default is - // localhost:6060. - PprofAddress string +func NewWebhookFlags() *WebhookFlags { + return &WebhookFlags{} } -func (o *WebhookOptions) AddFlags(fs *pflag.FlagSet) { - // TODO: rename secure-port to listen-port - fs.IntVar(&o.ListenPort, "secure-port", defaultListeningPort, "port number to listen on for secure TLS connections") - fs.IntVar(&o.HealthzPort, "healthz-port", defaultHealthPort, "port number to listen on for insecure healthz connections") - fs.StringVar(&o.TLSCertFile, "tls-cert-file", "", "path to the file containing the TLS certificate to serve with") - fs.StringVar(&o.TLSKeyFile, "tls-private-key-file", "", "path to the file containing the TLS private key to serve with") - fs.StringVar(&o.DynamicServingCASecretNamespace, "dynamic-serving-ca-secret-namespace", "", "namespace of the secret used to store the CA that signs serving certificates") - fs.StringVar(&o.DynamicServingCASecretName, "dynamic-serving-ca-secret-name", "", "name of the secret used to store the CA that signs serving certificates certificates") - fs.StringSliceVar(&o.DynamicServingDNSNames, "dynamic-serving-dns-names", []string{""}, "DNS names that should be present on certificates generated by the dynamic serving CA") - fs.StringVar(&o.Kubeconfig, "kubeconfig", "", "optional path to the kubeconfig used to connect to the apiserver. If not specified, in-cluster-config will be used") - fs.StringVar(&o.APIServerHost, "api-server-host", "", ""+ +func (f *WebhookFlags) AddFlags(fs *pflag.FlagSet) { + // noop +} + +func NewWebhookConfiguration() (*config.WebhookConfiguration, error) { + scheme, _, err := configscheme.NewSchemeAndCodecs() + if err != nil { + return nil, err + } + versioned := &configv1alpha1.WebhookConfiguration{} + scheme.Default(versioned) + config := &config.WebhookConfiguration{} + if err := scheme.Convert(versioned, config, nil); err != nil { + return nil, err + } + return config, nil +} + +func AddConfigFlags(fs *pflag.FlagSet, c *config.WebhookConfiguration) { + fs.IntVar(c.SecurePort, "secure-port", *c.SecurePort, "port number to listen on for secure TLS connections") + fs.IntVar(c.HealthzPort, "healthz-port", *c.HealthzPort, "port number to listen on for insecure healthz connections") + + fs.StringVar(&c.TLSConfig.Filesystem.CertFile, "tls-cert-file", c.TLSConfig.Filesystem.CertFile, "path to the file containing the TLS certificate to serve with") + fs.StringVar(&c.TLSConfig.Filesystem.KeyFile, "tls-private-key-file", c.TLSConfig.Filesystem.KeyFile, "path to the file containing the TLS private key to serve with") + + fs.StringVar(&c.TLSConfig.Dynamic.SecretNamespace, "dynamic-serving-ca-secret-namespace", c.TLSConfig.Dynamic.SecretNamespace, "namespace of the secret used to store the CA that signs serving certificates") + fs.StringVar(&c.TLSConfig.Dynamic.SecretName, "dynamic-serving-ca-secret-name", c.TLSConfig.Dynamic.SecretName, "name of the secret used to store the CA that signs serving certificates certificates") + fs.StringSliceVar(&c.TLSConfig.Dynamic.DNSNames, "dynamic-serving-dns-names", c.TLSConfig.Dynamic.DNSNames, "DNS names that should be present on certificates generated by the dynamic serving CA") + + fs.StringVar(&c.KubeConfig, "kubeconfig", c.KubeConfig, "optional path to the kubeconfig used to connect to the apiserver. If not specified, in-cluster-config will be used") + fs.StringVar(&c.APIServerHost, "api-server-host", c.APIServerHost, ""+ "Optional apiserver host address to connect to. If not specified, autoconfiguration "+ "will be attempted.") - fs.BoolVar(&o.EnablePprof, "enable-profiling", cmdutil.DefaultEnableProfiling, ""+ + fs.BoolVar(&c.EnablePprof, "enable-profiling", c.EnablePprof, ""+ "Enable profiling for controller.") - fs.StringVar(&o.PprofAddress, "profiler-address", cmdutil.DefaultProfilerAddr, + fs.StringVar(&c.PprofAddress, "profiler-address", c.PprofAddress, "Address of the Go profiler (pprof). This should never be exposed on a public interface. If this flag is not set, the profiler is not run.") tlsCipherPossibleValues := cliflag.TLSCipherPossibleValues() - fs.StringSliceVar(&o.TLSCipherSuites, "tls-cipher-suites", o.TLSCipherSuites, + fs.StringSliceVar(&c.TLSConfig.CipherSuites, "tls-cipher-suites", c.TLSConfig.CipherSuites, "Comma-separated list of cipher suites for the server. "+ "If omitted, the default Go cipher suites will be use. "+ "Possible values: "+strings.Join(tlsCipherPossibleValues, ",")) tlsPossibleVersions := cliflag.TLSPossibleVersions() - fs.StringVar(&o.MinTLSVersion, "tls-min-version", o.MinTLSVersion, + fs.StringVar(&c.TLSConfig.MinTLSVersion, "tls-min-version", c.TLSConfig.MinTLSVersion, "Minimum TLS version supported. "+ "Possible values: "+strings.Join(tlsPossibleVersions, ", ")) } - -func FileTLSSourceEnabled(o WebhookOptions) bool { - if o.TLSCertFile != "" || o.TLSKeyFile != "" { - return true - } - return false -} - -func DynamicTLSSourceEnabled(o WebhookOptions) bool { - if o.DynamicServingCASecretNamespace != "" || o.DynamicServingCASecretName != "" { - return true - } - return false -} diff --git a/cmd/webhook/app/testing/BUILD.bazel b/cmd/webhook/app/testing/BUILD.bazel index 96040395d..778282c46 100644 --- a/cmd/webhook/app/testing/BUILD.bazel +++ b/cmd/webhook/app/testing/BUILD.bazel @@ -8,11 +8,13 @@ go_library( deps = [ "//cmd/webhook/app:go_default_library", "//cmd/webhook/app/options:go_default_library", + "//pkg/apis/config/v1alpha1:go_default_library", "//pkg/logs:go_default_library", "//pkg/util/pki:go_default_library", "//pkg/webhook/server:go_default_library", "@com_github_spf13_pflag//:go_default_library", "@io_k8s_apimachinery//pkg/util/wait:go_default_library", + "@io_k8s_utils//pointer:go_default_library", ], ) diff --git a/cmd/webhook/app/testing/testwebhook.go b/cmd/webhook/app/testing/testwebhook.go index 12ca600a8..7faa0594e 100644 --- a/cmd/webhook/app/testing/testwebhook.go +++ b/cmd/webhook/app/testing/testwebhook.go @@ -33,9 +33,11 @@ import ( "github.com/spf13/pflag" "k8s.io/apimachinery/pkg/util/wait" + "k8s.io/utils/pointer" "github.com/jetstack/cert-manager/cmd/webhook/app" "github.com/jetstack/cert-manager/cmd/webhook/app/options" + configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" logf "github.com/jetstack/cert-manager/pkg/logs" "github.com/jetstack/cert-manager/pkg/util/pki" "github.com/jetstack/cert-manager/pkg/webhook/server" @@ -59,9 +61,9 @@ type ServerOptions struct { func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (ServerOptions, StopFunc) { // Allow user to override options using flags - var opts options.WebhookOptions + var opts configv1alpha1.WebhookConfiguration fs := pflag.NewFlagSet("testset", pflag.ExitOnError) - opts.AddFlags(fs) + options.AddFlags(fs, &opts) // Parse the arguments passed in into the WebhookOptions struct fs.Parse(args) @@ -70,7 +72,7 @@ func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (Serve if err != nil { t.Fatal(err) } - if !options.FileTLSSourceEnabled(opts) && !options.DynamicTLSSourceEnabled(opts) { + if !opts.TLSConfig.FilesystemConfigProvided() && !opts.TLSConfig.DynamicConfigProvided() { // Generate a CA and serving certificate ca, certificatePEM, privateKeyPEM, err := generateTLSAssets() if err != nil { @@ -85,13 +87,13 @@ func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (Serve t.Fatal(err) } - opts.TLSKeyFile = filepath.Join(tempDir, "tls.key") - opts.TLSCertFile = filepath.Join(tempDir, "tls.crt") + opts.TLSConfig.Filesystem.KeyFile = filepath.Join(tempDir, "tls.key") + opts.TLSConfig.Filesystem.CertFile = filepath.Join(tempDir, "tls.crt") } // Listen on a random port number - opts.ListenPort = 0 - opts.HealthzPort = 0 + opts.SecurePort = pointer.Int(0) + opts.HealthzPort = pointer.Int(0) stopCh := make(chan struct{}) errCh := make(chan error) diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go index bf2c56791..0f1a61fc3 100644 --- a/cmd/webhook/app/webhook.go +++ b/cmd/webhook/app/webhook.go @@ -19,14 +19,18 @@ package app import ( "context" "fmt" + "os" "github.com/go-logr/logr" "github.com/spf13/cobra" + "github.com/spf13/pflag" "k8s.io/client-go/kubernetes" "k8s.io/client-go/tools/clientcmd" + cliflag "k8s.io/component-base/cli/flag" cmdutil "github.com/jetstack/cert-manager/cmd/util" "github.com/jetstack/cert-manager/cmd/webhook/app/options" + "github.com/jetstack/cert-manager/internal/apis/config" logf "github.com/jetstack/cert-manager/pkg/logs" "github.com/jetstack/cert-manager/pkg/util" "github.com/jetstack/cert-manager/pkg/webhook" @@ -40,8 +44,8 @@ var validationHook handlers.ValidatingAdmissionHook = handlers.NewRegistryBacked var mutationHook handlers.MutatingAdmissionHook = handlers.NewRegistryBackedMutator(logf.Log, webhook.Scheme, webhook.MutationRegistry) var conversionHook handlers.ConversionHook = handlers.NewSchemeBackedConverter(logf.Log, webhook.Scheme) -func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server.Server, error) { - restcfg, err := clientcmd.BuildConfigFromFlags(opts.APIServerHost, opts.Kubeconfig) +func NewServerWithOptions(log logr.Logger, _ options.WebhookFlags, opts config.WebhookConfiguration) (*server.Server, error) { + restcfg, err := clientcmd.BuildConfigFromFlags(opts.APIServerHost, opts.KubeConfig) if err != nil { return nil, err } @@ -54,25 +58,25 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server var source tls.CertificateSource switch { - case options.FileTLSSourceEnabled(opts): - log.V(logf.InfoLevel).Info("using TLS certificate from local filesystem", "private_key_path", opts.TLSKeyFile, "certificate", opts.TLSCertFile) + case opts.TLSConfig.FilesystemConfigProvided(): + log.V(logf.InfoLevel).Info("using TLS certificate from local filesystem", "private_key_path", opts.TLSConfig.Filesystem.KeyFile, "certificate", opts.TLSConfig.Filesystem.CertFile) source = &tls.FileCertificateSource{ - CertPath: opts.TLSCertFile, - KeyPath: opts.TLSKeyFile, + CertPath: opts.TLSConfig.Filesystem.CertFile, + KeyPath: opts.TLSConfig.Filesystem.KeyFile, Log: log, } - case options.DynamicTLSSourceEnabled(opts): - restcfg, err := clientcmd.BuildConfigFromFlags("", opts.Kubeconfig) + case opts.TLSConfig.DynamicConfigProvided(): + restcfg, err := clientcmd.BuildConfigFromFlags("", opts.KubeConfig) if err != nil { return nil, err } - log.V(logf.InfoLevel).Info("using dynamic certificate generating using CA stored in Secret resource", "secret_namespace", opts.DynamicServingCASecretNamespace, "secret_name", opts.DynamicServingCASecretName) + log.V(logf.InfoLevel).Info("using dynamic certificate generating using CA stored in Secret resource", "secret_namespace", opts.TLSConfig.Dynamic.SecretNamespace, "secret_name", opts.TLSConfig.Dynamic.SecretName) source = &tls.DynamicSource{ - DNSNames: opts.DynamicServingDNSNames, + DNSNames: opts.TLSConfig.Dynamic.DNSNames, Authority: &authority.DynamicAuthority{ - SecretNamespace: opts.DynamicServingCASecretNamespace, - SecretName: opts.DynamicServingCASecretName, + SecretNamespace: opts.TLSConfig.Dynamic.SecretNamespace, + SecretName: opts.TLSConfig.Dynamic.SecretName, RESTConfig: restcfg, Log: log, }, @@ -83,13 +87,13 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server } return &server.Server{ - ListenAddr: fmt.Sprintf(":%d", opts.ListenPort), - HealthzAddr: fmt.Sprintf(":%d", opts.HealthzPort), - PprofAddr: opts.PprofAddress, + ListenAddr: fmt.Sprintf(":%d", *opts.SecurePort), + HealthzAddr: fmt.Sprintf(":%d", *opts.HealthzPort), EnablePprof: opts.EnablePprof, + PprofAddr: opts.PprofAddress, CertificateSource: source, - CipherSuites: opts.TLSCipherSuites, - MinTLSVersion: opts.MinTLSVersion, + CipherSuites: opts.TLSConfig.CipherSuites, + MinTLSVersion: opts.TLSConfig.MinTLSVersion, ValidationWebhook: validationHook, MutationWebhook: mutationHook, ConversionWebhook: conversionHook, @@ -97,27 +101,85 @@ func NewServerWithOptions(log logr.Logger, opts options.WebhookOptions) (*server }, nil } +const componentWebhook = "webhook" + func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { - var opts options.WebhookOptions + ctx := cmdutil.ContextWithStopCh(context.Background(), stopCh) + ctx = logf.NewContext(ctx, nil, "webhook") + log := logf.FromContext(ctx) + + cleanFlagSet := pflag.NewFlagSet(componentWebhook, pflag.ContinueOnError) + // Replaces all instances of `_` in flag names with `-` + cleanFlagSet.SetNormalizeFunc(cliflag.WordSepNormalizeFunc) + webhookFlags := options.NewWebhookFlags() + webhookConfig, err := options.NewWebhookConfiguration() + if err != nil { + log.Error(err, "Failed to create new webhook configuration") + os.Exit(1) + } cmd := &cobra.Command{ - Use: "webhook", + Use: componentWebhook, Short: fmt.Sprintf("Webhook component providing API validation, mutation and conversion functionality for cert-manager (%s) (%s)", util.AppVersion, util.AppGitCommit), - RunE: func(cmd *cobra.Command, args []string) error { - ctx := cmdutil.ContextWithStopCh(context.Background(), stopCh) - ctx = logf.NewContext(ctx, nil, "webhook") - log := logf.FromContext(ctx) - - srv, err := NewServerWithOptions(log, opts) - if err != nil { - return err + // The webhook has special flag parsing requirements to handle precedence of providing + // configuration via versioned configuration files and flag values. + // Setting DisableFlagParsing=true prevents Cobra from interfering with flag parsing + // at all, and instead we handle it all in the RunE below. + DisableFlagParsing: true, + Run: func(cmd *cobra.Command, args []string) { + // initial flag parse, since we disable cobra's flag parsing + if err := cleanFlagSet.Parse(args); err != nil { + log.Error(err, "Failed to parse kubelet flag") + cmd.Usage() + os.Exit(1) } - return srv.Run(stopCh) + // check if there are non-flag arguments in the command line + cmds := cleanFlagSet.Args() + if len(cmds) > 0 { + log.Error(nil, "Unknown command", "command", cmds[0]) + cmd.Usage() + os.Exit(1) + } + + // short-circuit on help + help, err := cleanFlagSet.GetBool("help") + if err != nil { + log.Info(`"help" flag is non-bool, programmer error, please correct`) + os.Exit(1) + } + if help { + cmd.Help() + return + } + + srv, err := NewServerWithOptions(log, *webhookFlags, *webhookConfig) + if err != nil { + log.Error(err, "Failed initialising server") + os.Exit(1) + } + + if err := srv.Run(stopCh); err != nil { + log.Error(err, "Failed running server") + os.Exit(1) + } }, } - opts.AddFlags(cmd.Flags()) + webhookFlags.AddFlags(cleanFlagSet) + options.AddConfigFlags(cleanFlagSet, webhookConfig) + + cleanFlagSet.BoolP("help", "h", false, fmt.Sprintf("help for %s", cmd.Name())) + + // ugly, but necessary, because Cobra's default UsageFunc and HelpFunc pollute the flagset with global flags + const usageFmt = "Usage:\n %s\n\nFlags:\n%s" + cmd.SetUsageFunc(func(cmd *cobra.Command) error { + fmt.Fprintf(cmd.OutOrStderr(), usageFmt, cmd.UseLine(), cleanFlagSet.FlagUsagesWrapped(2)) + return nil + }) + cmd.SetHelpFunc(func(cmd *cobra.Command, args []string) { + fmt.Fprintf(cmd.OutOrStdout(), "%s\n\n"+usageFmt, cmd.Long, cmd.UseLine(), cleanFlagSet.FlagUsagesWrapped(2)) + }) return cmd } diff --git a/internal/BUILD.bazel b/internal/BUILD.bazel index 5f55442e9..be7f45a01 100644 --- a/internal/BUILD.bazel +++ b/internal/BUILD.bazel @@ -13,6 +13,7 @@ filegroup( "//internal/api/validation:all-srcs", "//internal/apis/acme:all-srcs", "//internal/apis/certmanager:all-srcs", + "//internal/apis/config:all-srcs", "//internal/apis/meta:all-srcs", "//internal/ingress:all-srcs", "//internal/vault:all-srcs", diff --git a/internal/apis/config/BUILD.bazel b/internal/apis/config/BUILD.bazel index 3ecf484b1..77cbc7a6e 100644 --- a/internal/apis/config/BUILD.bazel +++ b/internal/apis/config/BUILD.bazel @@ -9,7 +9,7 @@ go_library( "zz_generated.deepcopy.go", ], importpath = "github.com/jetstack/cert-manager/internal/apis/config", - visibility = ["//pkg:__subpackages__"], + visibility = ["//:__subpackages__"], deps = [ "//pkg/apis/config:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", @@ -30,6 +30,7 @@ filegroup( srcs = [ ":package-srcs", "//internal/apis/config/install:all-srcs", + "//internal/apis/config/scheme:all-srcs", "//internal/apis/config/v1alpha1:all-srcs", ], tags = ["automanaged"], diff --git a/internal/apis/config/install/BUILD.bazel b/internal/apis/config/install/BUILD.bazel index b8c56c2ce..05f0a4549 100644 --- a/internal/apis/config/install/BUILD.bazel +++ b/internal/apis/config/install/BUILD.bazel @@ -4,7 +4,7 @@ go_library( name = "go_default_library", srcs = ["install.go"], importpath = "github.com/jetstack/cert-manager/internal/apis/config/install", - visibility = ["//visibility:public"], + visibility = ["//:__subpackages__"], deps = [ "//internal/apis/config:go_default_library", "//internal/apis/config/v1alpha1:go_default_library", @@ -38,9 +38,9 @@ go_test( ], embed = [":go_default_library"], deps = [ + "//internal/apis/acme/fuzzer:go_default_library", "//pkg/api:go_default_library", "//pkg/api/testing:go_default_library", - "//internal/apis/acme/fuzzer:go_default_library", "@com_github_munnerz_crd_schema_fuzz//:go_default_library", "@io_k8s_apimachinery//pkg/api/apitesting/roundtrip:go_default_library", ], diff --git a/internal/apis/config/scheme/BUILD.bazel b/internal/apis/config/scheme/BUILD.bazel new file mode 100644 index 000000000..d2b3fdd30 --- /dev/null +++ b/internal/apis/config/scheme/BUILD.bazel @@ -0,0 +1,28 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["scheme.go"], + importpath = "github.com/jetstack/cert-manager/internal/apis/config/scheme", + visibility = ["//:__subpackages__"], + deps = [ + "//internal/apis/config:go_default_library", + "//internal/apis/config/v1alpha1:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/internal/apis/config/scheme/scheme.go b/internal/apis/config/scheme/scheme.go new file mode 100644 index 000000000..ecf9f2962 --- /dev/null +++ b/internal/apis/config/scheme/scheme.go @@ -0,0 +1,24 @@ +package scheme + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/serializer" + + "github.com/jetstack/cert-manager/internal/apis/config" + configv1alpha1 "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1" +) + +// NewSchemeAndCodecs is a utility function that returns a Scheme and CodecFactory +// that understand the types in the config.cert-manager.io API group. Passing mutators allows +// for adjusting the behavior of the CodecFactory, for example enable strict decoding. +func NewSchemeAndCodecs(mutators ...serializer.CodecFactoryOptionsMutator) (*runtime.Scheme, *serializer.CodecFactory, error) { + scheme := runtime.NewScheme() + if err := config.AddToScheme(scheme); err != nil { + return nil, nil, err + } + if err := configv1alpha1.AddToScheme(scheme); err != nil { + return nil, nil, err + } + codecs := serializer.NewCodecFactory(scheme, mutators...) + return scheme, &codecs, nil +} diff --git a/internal/apis/config/types_webhook.go b/internal/apis/config/types_webhook.go index 80ac8909c..d3c4c2081 100644 --- a/internal/apis/config/types_webhook.go +++ b/internal/apis/config/types_webhook.go @@ -5,5 +5,96 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object type WebhookConfiguration struct { - metav1.TypeMeta `json:",inline"` + metav1.TypeMeta + + // securePort is the port number to listen on for secure TLS connections from the kube-apiserver. + // Defaults to 6443. + SecurePort *int + + // healthzPort is the port number to listen on (using plaintext HTTP) for healthz connections. + // Defaults to 6080. + HealthzPort *int + + // tlsConfig is used to configure the secure listener's TLS settings. + TLSConfig WebhookTLSConfig + + // kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver. + // If not specified, the webhook will attempt to load the in-cluster-config. + KubeConfig string + + // apiServerHost is used to override the API server connection address. + // Deprecated: use `kubeConfig` instead. + APIServerHost string + + // enablePprof configures whether pprof is enabled. + EnablePprof bool + + // pprofAddress configures the address on which /debug/pprof endpoint will be served if enabled. + // Defaults to 'localhost:6060'. + PprofAddress string +} + +// WebhookTLSConfig configures how TLS certificates are sourced for serving. +// Only one of 'filesystem' or 'dynamic' may be specified. +type WebhookTLSConfig struct { + // cipherSuites is the list of allowed cipher suites for the server. + // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). + // If not specified, the default for the Go version will be used and may change over time. + CipherSuites []string + + // minTLSVersion is the minimum TLS version supported. + // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). + // If not specified, the default for the Go version will be used and may change over time. + MinTLSVersion string + + // Filesystem enables using a certificate and private key found on the local filesystem. + // These files will be periodically polled in case they have changed, and dynamically reloaded. + Filesystem WebhookFilesystemServingConfig + + // When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook + // certificates and persist it into a Kubernetes Secret resource (for other replicas of the + // webhook to consume). + // It will then generate a certificate in-memory for itself using this CA to serve with. + // The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion + // webhook configuration objects (typically by cainjector). + Dynamic WebhookDynamicServingConfig +} + +func (c *WebhookTLSConfig) FilesystemConfigProvided() bool { + if c.Filesystem.KeyFile != "" || c.Filesystem.CertFile != "" { + return true + } + return false +} + +func (c *WebhookTLSConfig) DynamicConfigProvided() bool { + if c.Dynamic.SecretNamespace != "" || c.Dynamic.SecretName != "" || len(c.Dynamic.DNSNames) > 0 { + return true + } + return false +} + +// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. +// This CA will be used by all instances of the webhook for signing serving certificates. +type WebhookDynamicServingConfig struct { + // Namespace of the Kubernetes Secret resource containing the TLS certificate + // used as a CA to sign dynamic serving certificates. + SecretNamespace string + + // Namespace of the Kubernetes Secret resource containing the TLS certificate + // used as a CA to sign dynamic serving certificates. + SecretName string + + // DNSNames that must be present on serving certificates signed by the CA. + DNSNames []string +} + +// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem. +// These files will be periodically polled in case they have changed, and dynamically reloaded. +type WebhookFilesystemServingConfig struct { + // Path to a file containing TLS certificate & chain to serve with + CertFile string + + // Path to a file containing a TLS private key to server with + KeyFile string } diff --git a/internal/apis/config/v1alpha1/BUILD.bazel b/internal/apis/config/v1alpha1/BUILD.bazel index 8d2e5fd2e..486f4e54d 100644 --- a/internal/apis/config/v1alpha1/BUILD.bazel +++ b/internal/apis/config/v1alpha1/BUILD.bazel @@ -11,14 +11,15 @@ go_library( "zz_generated.defaults.go", ], importpath = "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1", - visibility = ["//pkg:__subpackages__"], + visibility = ["//:__subpackages__"], deps = [ + "//internal/apis/config:go_default_library", "//pkg/apis/config:go_default_library", "//pkg/apis/config/v1alpha1:go_default_library", - "//internal/apis/config:go_default_library", "@io_k8s_apimachinery//pkg/conversion:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", + "@io_k8s_utils//pointer:go_default_library", ], ) diff --git a/internal/apis/config/v1alpha1/defaults.go b/internal/apis/config/v1alpha1/defaults.go index f79f2d48e..60cb83552 100644 --- a/internal/apis/config/v1alpha1/defaults.go +++ b/internal/apis/config/v1alpha1/defaults.go @@ -17,9 +17,23 @@ limitations under the License. package v1alpha1 import ( + "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" "k8s.io/apimachinery/pkg/runtime" + "k8s.io/utils/pointer" ) func addDefaultingFuncs(scheme *runtime.Scheme) error { return RegisterDefaults(scheme) } + +func SetDefaults_WebhookConfiguration(obj *v1alpha1.WebhookConfiguration) { + if obj.SecurePort == nil { + obj.SecurePort = pointer.Int(6443) + } + if obj.HealthzPort == nil { + obj.HealthzPort = pointer.Int(6080) + } + if obj.PprofAddress == "" { + obj.PprofAddress = "localhost:6060" + } +} diff --git a/internal/apis/config/v1alpha1/doc.go b/internal/apis/config/v1alpha1/doc.go index 6e719c1cc..4cb5b49c1 100644 --- a/internal/apis/config/v1alpha1/doc.go +++ b/internal/apis/config/v1alpha1/doc.go @@ -17,7 +17,7 @@ limitations under the License. // +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config // +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1 // +k8s:defaulter-gen=TypeMeta -// +k8s:defaulter-gen-input=../../../../apis/config/v1alpha1 +// +k8s:defaulter-gen-input=../../../../pkg/apis/config/v1alpha1 // +groupName=config.cert-manager.io package v1alpha1 diff --git a/internal/apis/config/v1alpha1/zz_generated.defaults.go b/internal/apis/config/v1alpha1/zz_generated.defaults.go index 48c7e75b4..c51a47bee 100644 --- a/internal/apis/config/v1alpha1/zz_generated.defaults.go +++ b/internal/apis/config/v1alpha1/zz_generated.defaults.go @@ -22,6 +22,7 @@ limitations under the License. package v1alpha1 import ( + v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" runtime "k8s.io/apimachinery/pkg/runtime" ) @@ -29,5 +30,10 @@ import ( // Public to allow building arbitrary schemes. // All generated defaulters are covering - they call all nested defaulters. func RegisterDefaults(scheme *runtime.Scheme) error { + scheme.AddTypeDefaultingFunc(&v1alpha1.WebhookConfiguration{}, func(obj interface{}) { SetObjectDefaults_WebhookConfiguration(obj.(*v1alpha1.WebhookConfiguration)) }) return nil } + +func SetObjectDefaults_WebhookConfiguration(in *v1alpha1.WebhookConfiguration) { + SetDefaults_WebhookConfiguration(in) +} diff --git a/internal/apis/config/zz_generated.deepcopy.go b/internal/apis/config/zz_generated.deepcopy.go index efd5df937..819309fe8 100644 --- a/internal/apis/config/zz_generated.deepcopy.go +++ b/internal/apis/config/zz_generated.deepcopy.go @@ -29,6 +29,7 @@ import ( func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in out.TypeMeta = in.TypeMeta + in.TLSConfig.DeepCopyInto(&out.TLSConfig) return } @@ -49,3 +50,63 @@ func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { } return nil } + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookDynamicServingConfig) DeepCopyInto(out *WebhookDynamicServingConfig) { + *out = *in + if in.DNSNames != nil { + in, out := &in.DNSNames, &out.DNSNames + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookDynamicServingConfig. +func (in *WebhookDynamicServingConfig) DeepCopy() *WebhookDynamicServingConfig { + if in == nil { + return nil + } + out := new(WebhookDynamicServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookFilesystemServingConfig) DeepCopyInto(out *WebhookFilesystemServingConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookFilesystemServingConfig. +func (in *WebhookFilesystemServingConfig) DeepCopy() *WebhookFilesystemServingConfig { + if in == nil { + return nil + } + out := new(WebhookFilesystemServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookTLSConfig) DeepCopyInto(out *WebhookTLSConfig) { + *out = *in + if in.CipherSuites != nil { + in, out := &in.CipherSuites, &out.CipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.Filesystem = in.Filesystem + in.Dynamic.DeepCopyInto(&out.Dynamic) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookTLSConfig. +func (in *WebhookTLSConfig) DeepCopy() *WebhookTLSConfig { + if in == nil { + return nil + } + out := new(WebhookTLSConfig) + in.DeepCopyInto(out) + return out +} diff --git a/pkg/apis/config/v1alpha1/types_webhook.go b/pkg/apis/config/v1alpha1/types_webhook.go index 8a8927710..89455be66 100644 --- a/pkg/apis/config/v1alpha1/types_webhook.go +++ b/pkg/apis/config/v1alpha1/types_webhook.go @@ -6,4 +6,81 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" type WebhookConfiguration struct { metav1.TypeMeta `json:",inline"` + + // securePort is the port number to listen on for secure TLS connections from the kube-apiserver. + // Defaults to 6443. + SecurePort *int `json:"securePort,omitempty"` + + // healthzPort is the port number to listen on (using plaintext HTTP) for healthz connections. + // Defaults to 6080. + HealthzPort *int `json:"healthzPort,omitempty"` + + // tlsConfig is used to configure the secure listener's TLS settings. + TLSConfig WebhookTLSConfig `json:"tlsConfig"` + + // kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver. + // If not specified, the webhook will attempt to load the in-cluster-config. + KubeConfig string `json:"kubeConfig,omitempty"` + + // apiServerHost is used to override the API server connection address. + // Deprecated: use `kubeConfig` instead. + APIServerHost string `json:"apiServerHost,omitempty"` + + // enablePprof configures whether pprof is enabled. + EnablePprof bool `json:"enablePprof"` + + // pprofAddress configures the address on which /debug/pprof endpoint will be served if enabled. + // Defaults to 'localhost:6060'. + PprofAddress string `json:"pprofAddress,omitempty"` +} + +// WebhookTLSConfig configures how TLS certificates are sourced for serving. +// Only one of 'filesystem' or 'dynamic' may be specified. +type WebhookTLSConfig struct { + // cipherSuites is the list of allowed cipher suites for the server. + // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). + // If not specified, the default for the Go version will be used and may change over time. + CipherSuites []string `json:"cipherSuites,omitempty"` + + // minTLSVersion is the minimum TLS version supported. + // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). + // If not specified, the default for the Go version will be used and may change over time. + MinTLSVersion string `json:"minTLSVersion,omitempty"` + + // Filesystem enables using a certificate and private key found on the local filesystem. + // These files will be periodically polled in case they have changed, and dynamically reloaded. + Filesystem WebhookFilesystemServingConfig `json:"filesystem"` + + // When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook + // certificates and persist it into a Kubernetes Secret resource (for other replicas of the + // webhook to consume). + // It will then generate a certificate in-memory for itself using this CA to serve with. + // The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion + // webhook configuration objects (typically by cainjector). + Dynamic WebhookDynamicServingConfig `json:"dynamic"` +} + +// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. +// This CA will be used by all instances of the webhook for signing serving certificates. +type WebhookDynamicServingConfig struct { + // Namespace of the Kubernetes Secret resource containing the TLS certificate + // used as a CA to sign dynamic serving certificates. + SecretNamespace string `json:"secretNamespace,omitempty"` + + // Namespace of the Kubernetes Secret resource containing the TLS certificate + // used as a CA to sign dynamic serving certificates. + SecretName string `json:"secretName,omitempty"` + + // DNSNames that must be present on serving certificates signed by the CA. + DNSNames []string `json:"dnsNames,omitempty"` +} + +// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem. +// These files will be periodically polled in case they have changed, and dynamically reloaded. +type WebhookFilesystemServingConfig struct { + // Path to a file containing TLS certificate & chain to serve with + CertFile string `json:"certFile,omitempty"` + + // Path to a file containing a TLS private key to server with + KeyFile string `json:"keyFile,omitempty"` } diff --git a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go index b32dcdb60..d180a822d 100644 --- a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go @@ -29,6 +29,7 @@ import ( func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in out.TypeMeta = in.TypeMeta + in.TLSConfig.DeepCopyInto(&out.TLSConfig) return } @@ -49,3 +50,63 @@ func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { } return nil } + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookDynamicServingConfig) DeepCopyInto(out *WebhookDynamicServingConfig) { + *out = *in + if in.DNSNames != nil { + in, out := &in.DNSNames, &out.DNSNames + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookDynamicServingConfig. +func (in *WebhookDynamicServingConfig) DeepCopy() *WebhookDynamicServingConfig { + if in == nil { + return nil + } + out := new(WebhookDynamicServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookFilesystemServingConfig) DeepCopyInto(out *WebhookFilesystemServingConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookFilesystemServingConfig. +func (in *WebhookFilesystemServingConfig) DeepCopy() *WebhookFilesystemServingConfig { + if in == nil { + return nil + } + out := new(WebhookFilesystemServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *WebhookTLSConfig) DeepCopyInto(out *WebhookTLSConfig) { + *out = *in + if in.CipherSuites != nil { + in, out := &in.CipherSuites, &out.CipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.Filesystem = in.Filesystem + in.Dynamic.DeepCopyInto(&out.Dynamic) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookTLSConfig. +func (in *WebhookTLSConfig) DeepCopy() *WebhookTLSConfig { + if in == nil { + return nil + } + out := new(WebhookTLSConfig) + in.DeepCopyInto(out) + return out +} From 97863d245f8e8e2bc49bedfbb7aa54eddc5739da Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 21 Oct 2021 18:13:31 +0100 Subject: [PATCH 03/18] Regenerate files Signed-off-by: James Munnelly --- .../v1alpha1/zz_generated.conversion.go | 128 +++++++++++++++++- internal/apis/config/zz_generated.deepcopy.go | 10 ++ pkg/apis/config/v1alpha1/doc.go | 2 - .../config/v1alpha1/zz_generated.deepcopy.go | 10 ++ 4 files changed, 147 insertions(+), 3 deletions(-) diff --git a/internal/apis/config/v1alpha1/zz_generated.conversion.go b/internal/apis/config/v1alpha1/zz_generated.conversion.go index 56fd8f5bb..ae5165ff5 100644 --- a/internal/apis/config/v1alpha1/zz_generated.conversion.go +++ b/internal/apis/config/v1alpha1/zz_generated.conversion.go @@ -22,7 +22,9 @@ limitations under the License. package v1alpha1 import ( - "github.com/jetstack/cert-manager/internal/apis/config" + unsafe "unsafe" + + config "github.com/jetstack/cert-manager/internal/apis/config" v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" conversion "k8s.io/apimachinery/pkg/conversion" runtime "k8s.io/apimachinery/pkg/runtime" @@ -45,10 +47,47 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } + if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookDynamicServingConfig)(nil), (*config.WebhookDynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(a.(*v1alpha1.WebhookDynamicServingConfig), b.(*config.WebhookDynamicServingConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*config.WebhookDynamicServingConfig)(nil), (*v1alpha1.WebhookDynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(a.(*config.WebhookDynamicServingConfig), b.(*v1alpha1.WebhookDynamicServingConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookFilesystemServingConfig)(nil), (*config.WebhookFilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(a.(*v1alpha1.WebhookFilesystemServingConfig), b.(*config.WebhookFilesystemServingConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*config.WebhookFilesystemServingConfig)(nil), (*v1alpha1.WebhookFilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(a.(*config.WebhookFilesystemServingConfig), b.(*v1alpha1.WebhookFilesystemServingConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookTLSConfig)(nil), (*config.WebhookTLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(a.(*v1alpha1.WebhookTLSConfig), b.(*config.WebhookTLSConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*config.WebhookTLSConfig)(nil), (*v1alpha1.WebhookTLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(a.(*config.WebhookTLSConfig), b.(*v1alpha1.WebhookTLSConfig), scope) + }); err != nil { + return err + } return nil } func autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *config.WebhookConfiguration, s conversion.Scope) error { + out.SecurePort = (*int)(unsafe.Pointer(in.SecurePort)) + out.HealthzPort = (*int)(unsafe.Pointer(in.HealthzPort)) + if err := Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { + return err + } + out.KubeConfig = in.KubeConfig + out.APIServerHost = in.APIServerHost return nil } @@ -58,6 +97,13 @@ func Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1 } func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { + out.SecurePort = (*int)(unsafe.Pointer(in.SecurePort)) + out.HealthzPort = (*int)(unsafe.Pointer(in.HealthzPort)) + if err := Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { + return err + } + out.KubeConfig = in.KubeConfig + out.APIServerHost = in.APIServerHost return nil } @@ -65,3 +111,83 @@ func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in func Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { return autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in, out, s) } + +func autoConvert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in *v1alpha1.WebhookDynamicServingConfig, out *config.WebhookDynamicServingConfig, s conversion.Scope) error { + out.SecretNamespace = in.SecretNamespace + out.SecretName = in.SecretName + out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) + return nil +} + +// Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig is an autogenerated conversion function. +func Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in *v1alpha1.WebhookDynamicServingConfig, out *config.WebhookDynamicServingConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in, out, s) +} + +func autoConvert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in *config.WebhookDynamicServingConfig, out *v1alpha1.WebhookDynamicServingConfig, s conversion.Scope) error { + out.SecretNamespace = in.SecretNamespace + out.SecretName = in.SecretName + out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) + return nil +} + +// Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig is an autogenerated conversion function. +func Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in *config.WebhookDynamicServingConfig, out *v1alpha1.WebhookDynamicServingConfig, s conversion.Scope) error { + return autoConvert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in, out, s) +} + +func autoConvert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in *v1alpha1.WebhookFilesystemServingConfig, out *config.WebhookFilesystemServingConfig, s conversion.Scope) error { + out.CertFile = in.CertFile + out.KeyFile = in.KeyFile + return nil +} + +// Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig is an autogenerated conversion function. +func Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in *v1alpha1.WebhookFilesystemServingConfig, out *config.WebhookFilesystemServingConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in, out, s) +} + +func autoConvert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in *config.WebhookFilesystemServingConfig, out *v1alpha1.WebhookFilesystemServingConfig, s conversion.Scope) error { + out.CertFile = in.CertFile + out.KeyFile = in.KeyFile + return nil +} + +// Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig is an autogenerated conversion function. +func Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in *config.WebhookFilesystemServingConfig, out *v1alpha1.WebhookFilesystemServingConfig, s conversion.Scope) error { + return autoConvert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in, out, s) +} + +func autoConvert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in *v1alpha1.WebhookTLSConfig, out *config.WebhookTLSConfig, s conversion.Scope) error { + out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) + out.MinTLSVersion = in.MinTLSVersion + if err := Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { + return err + } + if err := Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { + return err + } + return nil +} + +// Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig is an autogenerated conversion function. +func Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in *v1alpha1.WebhookTLSConfig, out *config.WebhookTLSConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in, out, s) +} + +func autoConvert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in *config.WebhookTLSConfig, out *v1alpha1.WebhookTLSConfig, s conversion.Scope) error { + out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) + out.MinTLSVersion = in.MinTLSVersion + if err := Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { + return err + } + if err := Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { + return err + } + return nil +} + +// Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig is an autogenerated conversion function. +func Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in *config.WebhookTLSConfig, out *v1alpha1.WebhookTLSConfig, s conversion.Scope) error { + return autoConvert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in, out, s) +} diff --git a/internal/apis/config/zz_generated.deepcopy.go b/internal/apis/config/zz_generated.deepcopy.go index 819309fe8..4ea458478 100644 --- a/internal/apis/config/zz_generated.deepcopy.go +++ b/internal/apis/config/zz_generated.deepcopy.go @@ -29,6 +29,16 @@ import ( func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in out.TypeMeta = in.TypeMeta + if in.SecurePort != nil { + in, out := &in.SecurePort, &out.SecurePort + *out = new(int) + **out = **in + } + if in.HealthzPort != nil { + in, out := &in.HealthzPort, &out.HealthzPort + *out = new(int) + **out = **in + } in.TLSConfig.DeepCopyInto(&out.TLSConfig) return } diff --git a/pkg/apis/config/v1alpha1/doc.go b/pkg/apis/config/v1alpha1/doc.go index faac8e388..eb719f670 100644 --- a/pkg/apis/config/v1alpha1/doc.go +++ b/pkg/apis/config/v1alpha1/doc.go @@ -16,7 +16,5 @@ limitations under the License. // Package v1alpha1 is the v1alpha1 version of the API. // +k8s:deepcopy-gen=package,register -// +k8s:conversion-gen=github.com/jetstack/cert-manager/pkg/apis/config -// +k8s:defaulter-gen=TypeMeta // +groupName=config.cert-manager.io package v1alpha1 diff --git a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go index d180a822d..7f7818cd1 100644 --- a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go @@ -29,6 +29,16 @@ import ( func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in out.TypeMeta = in.TypeMeta + if in.SecurePort != nil { + in, out := &in.SecurePort, &out.SecurePort + *out = new(int) + **out = **in + } + if in.HealthzPort != nil { + in, out := &in.HealthzPort, &out.HealthzPort + *out = new(int) + **out = **in + } in.TLSConfig.DeepCopyInto(&out.TLSConfig) return } From 2e3eb29327e0dc46786e0052a1b42e7eaec50ce2 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 21 Oct 2021 18:18:48 +0100 Subject: [PATCH 04/18] Register logger flags Signed-off-by: James Munnelly --- cmd/webhook/app/options/BUILD.bazel | 6 ++++- cmd/webhook/app/options/globalflags.go | 36 ++++++++++++++++++++++++++ cmd/webhook/app/webhook.go | 5 ++-- 3 files changed, 44 insertions(+), 3 deletions(-) create mode 100644 cmd/webhook/app/options/globalflags.go diff --git a/cmd/webhook/app/options/BUILD.bazel b/cmd/webhook/app/options/BUILD.bazel index 114d757f1..34b828dd3 100644 --- a/cmd/webhook/app/options/BUILD.bazel +++ b/cmd/webhook/app/options/BUILD.bazel @@ -2,13 +2,17 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", - srcs = ["options.go"], + srcs = [ + "globalflags.go", + "options.go", + ], importpath = "github.com/jetstack/cert-manager/cmd/webhook/app/options", visibility = ["//visibility:public"], deps = [ "//internal/apis/config:go_default_library", "//internal/apis/config/scheme:go_default_library", "//pkg/apis/config/v1alpha1:go_default_library", + "//pkg/logs:go_default_library", "@com_github_spf13_pflag//:go_default_library", "@io_k8s_component_base//cli/flag:go_default_library", ], diff --git a/cmd/webhook/app/options/globalflags.go b/cmd/webhook/app/options/globalflags.go new file mode 100644 index 000000000..d442f267c --- /dev/null +++ b/cmd/webhook/app/options/globalflags.go @@ -0,0 +1,36 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package options + +import ( + "flag" + "os" + + "github.com/spf13/pflag" + + "github.com/jetstack/cert-manager/pkg/logs" +) + +func AddGlobalFlags(fs *pflag.FlagSet) { + addKlogFlags(fs) +} + +func addKlogFlags(fs *pflag.FlagSet) { + local := flag.NewFlagSet(os.Args[0], flag.ExitOnError) + logs.InitLogs(local) + fs.AddGoFlagSet(local) +} diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go index 0f1a61fc3..f6fbdf62f 100644 --- a/cmd/webhook/app/webhook.go +++ b/cmd/webhook/app/webhook.go @@ -119,8 +119,8 @@ func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { } cmd := &cobra.Command{ - Use: componentWebhook, - Short: fmt.Sprintf("Webhook component providing API validation, mutation and conversion functionality for cert-manager (%s) (%s)", util.AppVersion, util.AppGitCommit), + Use: componentWebhook, + Long: fmt.Sprintf("Webhook component providing API validation, mutation and conversion functionality for cert-manager (%s) (%s)", util.AppVersion, util.AppGitCommit), // The webhook has special flag parsing requirements to handle precedence of providing // configuration via versioned configuration files and flag values. // Setting DisableFlagParsing=true prevents Cobra from interfering with flag parsing @@ -168,6 +168,7 @@ func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { webhookFlags.AddFlags(cleanFlagSet) options.AddConfigFlags(cleanFlagSet, webhookConfig) + options.AddGlobalFlags(cleanFlagSet) cleanFlagSet.BoolP("help", "h", false, fmt.Sprintf("help for %s", cmd.Name())) From 0e1d603c93a54961f326a788724e7958c28c45ff Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 21 Oct 2021 20:57:17 +0100 Subject: [PATCH 05/18] Add support for reading config from WebhookConfiguration object Signed-off-by: James Munnelly --- cmd/webhook/app/BUILD.bazel | 1 + cmd/webhook/app/options/options.go | 12 +- cmd/webhook/app/testing/BUILD.bazel | 1 - cmd/webhook/app/testing/testwebhook.go | 23 ++-- cmd/webhook/app/webhook.go | 81 ++++++++++++- internal/apis/config/BUILD.bazel | 1 + internal/apis/config/validation/BUILD.bazel | 26 +++++ internal/apis/config/validation/validation.go | 58 ++++++++++ pkg/webhook/BUILD.bazel | 1 + pkg/webhook/configfile/BUILD.bazel | 27 +++++ pkg/webhook/configfile/configfile.go | 106 ++++++++++++++++++ 11 files changed, 323 insertions(+), 14 deletions(-) create mode 100644 internal/apis/config/validation/BUILD.bazel create mode 100644 internal/apis/config/validation/validation.go create mode 100644 pkg/webhook/configfile/BUILD.bazel create mode 100644 pkg/webhook/configfile/configfile.go diff --git a/cmd/webhook/app/BUILD.bazel b/cmd/webhook/app/BUILD.bazel index 44faa0067..ba2d11752 100644 --- a/cmd/webhook/app/BUILD.bazel +++ b/cmd/webhook/app/BUILD.bazel @@ -13,6 +13,7 @@ go_library( "//pkg/util:go_default_library", "//pkg/webhook:go_default_library", "//pkg/webhook/authority:go_default_library", + "//pkg/webhook/configfile:go_default_library", "//pkg/webhook/handlers:go_default_library", "//pkg/webhook/server:go_default_library", "//pkg/webhook/server/tls:go_default_library", diff --git a/cmd/webhook/app/options/options.go b/cmd/webhook/app/options/options.go index cb76eb1cc..b2adccd55 100644 --- a/cmd/webhook/app/options/options.go +++ b/cmd/webhook/app/options/options.go @@ -28,14 +28,22 @@ import ( ) // WebhookFlags defines options that can only be configured via flags. -type WebhookFlags struct{} +type WebhookFlags struct { + // Path to a file containing a WebhookConfiguration resource + Config string +} func NewWebhookFlags() *WebhookFlags { return &WebhookFlags{} } func (f *WebhookFlags) AddFlags(fs *pflag.FlagSet) { - // noop + fs.StringVar(&f.Config, "config", "", "Path to a file containing a WebhookConfiguration object used to configure the webhook") +} + +func ValidateWebhookFlags(f *WebhookFlags) error { + // No validation needed today + return nil } func NewWebhookConfiguration() (*config.WebhookConfiguration, error) { diff --git a/cmd/webhook/app/testing/BUILD.bazel b/cmd/webhook/app/testing/BUILD.bazel index 778282c46..af0f15c3b 100644 --- a/cmd/webhook/app/testing/BUILD.bazel +++ b/cmd/webhook/app/testing/BUILD.bazel @@ -8,7 +8,6 @@ go_library( deps = [ "//cmd/webhook/app:go_default_library", "//cmd/webhook/app/options:go_default_library", - "//pkg/apis/config/v1alpha1:go_default_library", "//pkg/logs:go_default_library", "//pkg/util/pki:go_default_library", "//pkg/webhook/server:go_default_library", diff --git a/cmd/webhook/app/testing/testwebhook.go b/cmd/webhook/app/testing/testwebhook.go index 7faa0594e..1f116db1c 100644 --- a/cmd/webhook/app/testing/testwebhook.go +++ b/cmd/webhook/app/testing/testwebhook.go @@ -37,7 +37,6 @@ import ( "github.com/jetstack/cert-manager/cmd/webhook/app" "github.com/jetstack/cert-manager/cmd/webhook/app/options" - configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" logf "github.com/jetstack/cert-manager/pkg/logs" "github.com/jetstack/cert-manager/pkg/util/pki" "github.com/jetstack/cert-manager/pkg/webhook/server" @@ -60,10 +59,14 @@ type ServerOptions struct { } func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (ServerOptions, StopFunc) { - // Allow user to override options using flags - var opts configv1alpha1.WebhookConfiguration fs := pflag.NewFlagSet("testset", pflag.ExitOnError) - options.AddFlags(fs, &opts) + webhookFlags := options.NewWebhookFlags() + webhookConfig, err := options.NewWebhookConfiguration() + if err != nil { + t.Fatalf("Failed building test webhook config: %v", err) + } + webhookFlags.AddFlags(fs) + options.AddConfigFlags(fs, webhookConfig) // Parse the arguments passed in into the WebhookOptions struct fs.Parse(args) @@ -72,7 +75,7 @@ func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (Serve if err != nil { t.Fatal(err) } - if !opts.TLSConfig.FilesystemConfigProvided() && !opts.TLSConfig.DynamicConfigProvided() { + if !webhookConfig.TLSConfig.FilesystemConfigProvided() && !webhookConfig.TLSConfig.DynamicConfigProvided() { // Generate a CA and serving certificate ca, certificatePEM, privateKeyPEM, err := generateTLSAssets() if err != nil { @@ -87,17 +90,17 @@ func StartWebhookServer(t *testing.T, ctx context.Context, args []string) (Serve t.Fatal(err) } - opts.TLSConfig.Filesystem.KeyFile = filepath.Join(tempDir, "tls.key") - opts.TLSConfig.Filesystem.CertFile = filepath.Join(tempDir, "tls.crt") + webhookConfig.TLSConfig.Filesystem.KeyFile = filepath.Join(tempDir, "tls.key") + webhookConfig.TLSConfig.Filesystem.CertFile = filepath.Join(tempDir, "tls.crt") } // Listen on a random port number - opts.SecurePort = pointer.Int(0) - opts.HealthzPort = pointer.Int(0) + webhookConfig.SecurePort = pointer.Int(0) + webhookConfig.HealthzPort = pointer.Int(0) stopCh := make(chan struct{}) errCh := make(chan error) - srv, err := app.NewServerWithOptions(log, opts) + srv, err := app.NewServerWithOptions(log, *webhookFlags, *webhookConfig) if err != nil { t.Fatal(err) } diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go index f6fbdf62f..8945b07b6 100644 --- a/cmd/webhook/app/webhook.go +++ b/cmd/webhook/app/webhook.go @@ -20,6 +20,7 @@ import ( "context" "fmt" "os" + "path/filepath" "github.com/go-logr/logr" "github.com/spf13/cobra" @@ -35,6 +36,7 @@ import ( "github.com/jetstack/cert-manager/pkg/util" "github.com/jetstack/cert-manager/pkg/webhook" "github.com/jetstack/cert-manager/pkg/webhook/authority" + "github.com/jetstack/cert-manager/pkg/webhook/configfile" "github.com/jetstack/cert-manager/pkg/webhook/handlers" "github.com/jetstack/cert-manager/pkg/webhook/server" "github.com/jetstack/cert-manager/pkg/webhook/server/tls" @@ -129,7 +131,7 @@ func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { Run: func(cmd *cobra.Command, args []string) { // initial flag parse, since we disable cobra's flag parsing if err := cleanFlagSet.Parse(args); err != nil { - log.Error(err, "Failed to parse kubelet flag") + log.Error(err, "Failed to parse webhook flag") cmd.Usage() os.Exit(1) } @@ -153,6 +155,24 @@ func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { return } + if err := options.ValidateWebhookFlags(webhookFlags); err != nil { + log.Error(err, "Failed to validate webhook flags") + os.Exit(1) + } + + if configFile := webhookFlags.Config; len(configFile) > 0 { + webhookConfig, err = loadConfigFile(configFile) + if err != nil { + log.Error(err, "Failed to load webhook config file", "path", configFile) + os.Exit(1) + } + + if err := webhookConfigFlagPrecedence(webhookConfig, args); err != nil { + log.Error(err, "Failed to merge flags with config file values") + os.Exit(1) + } + } + srv, err := NewServerWithOptions(log, *webhookFlags, *webhookConfig) if err != nil { log.Error(err, "Failed initialising server") @@ -184,3 +204,62 @@ func NewServerCommand(stopCh <-chan struct{}) *cobra.Command { return cmd } + +// newFlagSetWithGlobals constructs a new pflag.FlagSet with global flags registered +// on it. +func newFlagSetWithGlobals() *pflag.FlagSet { + fs := pflag.NewFlagSet("", pflag.ExitOnError) + // set the normalize func, similar to k8s.io/component-base/cli//flags.go:InitFlags + fs.SetNormalizeFunc(cliflag.WordSepNormalizeFunc) + // explicitly add flags from libs that register global flags + options.AddGlobalFlags(fs) + return fs +} + +// newFakeFlagSet constructs a pflag.FlagSet with the same flags as fs, but where +// all values have noop Set implementations +func newFakeFlagSet(fs *pflag.FlagSet) *pflag.FlagSet { + ret := pflag.NewFlagSet("", pflag.ExitOnError) + ret.SetNormalizeFunc(fs.GetNormalizeFunc()) + fs.VisitAll(func(f *pflag.Flag) { + ret.VarP(cliflag.NoOp{}, f.Name, f.Shorthand, f.Usage) + }) + return ret +} + +// webhookConfigFlagPrecedence re-parses flags over the WebhookConfiguration object. +// We must enforce flag precedence by re-parsing the command line into the new object. +// This is necessary to preserve backwards-compatibility across binary upgrades. +// See issue #56171 for more details. +func webhookConfigFlagPrecedence(cfg *config.WebhookConfiguration, args []string) error { + // We use a throwaway webhookFlags and a fake global flagset to avoid double-parses, + // as some Set implementations accumulate values from multiple flag invocations. + fs := newFakeFlagSet(newFlagSetWithGlobals()) + // register throwaway KubeletFlags + options.NewWebhookFlags().AddFlags(fs) + // register new WebhookConfiguration + options.AddConfigFlags(fs, cfg) + // re-parse flags + if err := fs.Parse(args); err != nil { + return err + } + return nil +} + +func loadConfigFile(name string) (*config.WebhookConfiguration, error) { + const errFmt = "failed to load webhook config file %s, error %v" + // compute absolute path based on current working dir + webhookConfigFile, err := filepath.Abs(name) + if err != nil { + return nil, fmt.Errorf(errFmt, name, err) + } + loader, err := configfile.NewFSLoader(webhookConfigFile) + if err != nil { + return nil, fmt.Errorf(errFmt, name, err) + } + cfg, err := loader.Load() + if err != nil { + return nil, fmt.Errorf(errFmt, name, err) + } + return cfg, nil +} diff --git a/internal/apis/config/BUILD.bazel b/internal/apis/config/BUILD.bazel index 77cbc7a6e..4839c0dfa 100644 --- a/internal/apis/config/BUILD.bazel +++ b/internal/apis/config/BUILD.bazel @@ -32,6 +32,7 @@ filegroup( "//internal/apis/config/install:all-srcs", "//internal/apis/config/scheme:all-srcs", "//internal/apis/config/v1alpha1:all-srcs", + "//internal/apis/config/validation:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/internal/apis/config/validation/BUILD.bazel b/internal/apis/config/validation/BUILD.bazel new file mode 100644 index 000000000..f6b482bbb --- /dev/null +++ b/internal/apis/config/validation/BUILD.bazel @@ -0,0 +1,26 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["validation.go"], + importpath = "github.com/jetstack/cert-manager/internal/apis/config/validation", + visibility = ["//:__subpackages__"], + deps = [ + "//internal/apis/config:go_default_library", + "@io_k8s_apimachinery//pkg/util/errors:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/internal/apis/config/validation/validation.go b/internal/apis/config/validation/validation.go new file mode 100644 index 000000000..1ef8bb182 --- /dev/null +++ b/internal/apis/config/validation/validation.go @@ -0,0 +1,58 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package validation + +import ( + "fmt" + + utilerrors "k8s.io/apimachinery/pkg/util/errors" + + "github.com/jetstack/cert-manager/internal/apis/config" +) + +func ValidateWebhookConfiguration(cfg *config.WebhookConfiguration) error { + var allErrors []error + if cfg.TLSConfig.FilesystemConfigProvided() && cfg.TLSConfig.DynamicConfigProvided() { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: cannot specify both filesystem based and dynamic TLS configuration")) + } else { + if cfg.TLSConfig.FilesystemConfigProvided() { + if cfg.TLSConfig.Filesystem.KeyFile == "" { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: tlsConfig.filesystem.keyFile (--tls-private-key-file) must be specified when using filesystem based TLS config")) + } + if cfg.TLSConfig.Filesystem.CertFile == "" { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: tlsConfig.filesystem.certFile (--tls-cert-file) must be specified when using filesystem based TLS config")) + } + } else if cfg.TLSConfig.DynamicConfigProvided() { + if cfg.TLSConfig.Dynamic.SecretNamespace == "" { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: tlsConfig.dynamic.secretNamespace (--dynamic-serving-ca-secret-namespace) must be specified when using dynamic TLS config")) + } + if cfg.TLSConfig.Dynamic.SecretName == "" { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: tlsConfig.dynamic.secretName (--dynamic-serving-ca-secret-name) must be specified when using dynamic TLS config")) + } + if len(cfg.TLSConfig.Dynamic.DNSNames) == 0 { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: tlsConfig.dynamic.dnsNames (--dynamic-serving-dns-names) must be specified when using dynamic TLS config")) + } + } + } + if cfg.HealthzPort == nil { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: healthzPort must be specified")) + } + if cfg.SecurePort == nil { + allErrors = append(allErrors, fmt.Errorf("invalid configuration: securePort must be specified")) + } + return utilerrors.NewAggregate(allErrors) +} diff --git a/pkg/webhook/BUILD.bazel b/pkg/webhook/BUILD.bazel index 894cc84b5..033dd304d 100644 --- a/pkg/webhook/BUILD.bazel +++ b/pkg/webhook/BUILD.bazel @@ -27,6 +27,7 @@ filegroup( srcs = [ ":package-srcs", "//pkg/webhook/authority:all-srcs", + "//pkg/webhook/configfile:all-srcs", "//pkg/webhook/handlers:all-srcs", "//pkg/webhook/server:all-srcs", ], diff --git a/pkg/webhook/configfile/BUILD.bazel b/pkg/webhook/configfile/BUILD.bazel new file mode 100644 index 000000000..66c7c3594 --- /dev/null +++ b/pkg/webhook/configfile/BUILD.bazel @@ -0,0 +1,27 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["configfile.go"], + importpath = "github.com/jetstack/cert-manager/pkg/webhook/configfile", + visibility = ["//visibility:public"], + deps = [ + "//internal/apis/config:go_default_library", + "//internal/apis/config/scheme:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/pkg/webhook/configfile/configfile.go b/pkg/webhook/configfile/configfile.go new file mode 100644 index 000000000..4d9f70cc6 --- /dev/null +++ b/pkg/webhook/configfile/configfile.go @@ -0,0 +1,106 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package configfile + +import ( + "fmt" + "io/ioutil" + "path/filepath" + + "k8s.io/apimachinery/pkg/runtime/serializer" + + "github.com/jetstack/cert-manager/internal/apis/config" + "github.com/jetstack/cert-manager/internal/apis/config/scheme" +) + +type Loader interface { + Load() (*config.WebhookConfiguration, error) +} + +type fsLoader struct { + filename string + codec *serializer.CodecFactory +} + +var _ Loader = &fsLoader{} + +func (f *fsLoader) Load() (*config.WebhookConfiguration, error) { + data, err := ioutil.ReadFile(f.filename) + if err != nil { + return nil, fmt.Errorf("failed to read webhook config file %q, error: %v", f.filename, err) + } + + if len(data) == 0 { + return nil, fmt.Errorf("webhook config file %q was empty", f.filename) + } + + cfg, err := decodeWebhookConfiguration(f.codec, data) + if err != nil { + return nil, err + } + + // make all paths absolute + resolveRelativePaths(webhookConfigurationPathRefs(cfg), filepath.Dir(f.filename)) + return cfg, nil +} + +func NewFSLoader(name string) (Loader, error) { + _, webhookCodec, err := scheme.NewSchemeAndCodecs(serializer.EnableStrict) + if err != nil { + return nil, err + } + + return &fsLoader{ + filename: name, + codec: webhookCodec, + }, nil +} + +func resolveRelativePaths(paths []*string, root string) { + for _, path := range paths { + // leave empty paths alone, "no path" is a valid input + // do not attempt to resolve paths that are already absolute + if len(*path) > 0 && !filepath.IsAbs(*path) { + *path = filepath.Join(root, *path) + } + } +} + +func decodeWebhookConfiguration(codec *serializer.CodecFactory, data []byte) (*config.WebhookConfiguration, error) { + obj, gvk, err := codec.UniversalDecoder().Decode(data, nil, nil) + if err != nil { + return nil, fmt.Errorf("failed to decode: %w", err) + } + + internalObj, ok := obj.(*config.WebhookConfiguration) + if !ok { + return nil, fmt.Errorf("failed to cast object to WebhookConfiguration, unexpected type: %v", gvk) + } + + return internalObj, nil +} + +// webhookConfigurationPathRefs returns pointers to all the WebhookConfiguration fields that contain filepaths. +// You might use this, for example, to resolve all relative paths against some common root before +// passing the configuration to the application. This method must be kept up to date as new fields are added. +func webhookConfigurationPathRefs(cfg *config.WebhookConfiguration) []*string { + return []*string{ + &cfg.TLSConfig.Filesystem.KeyFile, + &cfg.TLSConfig.Filesystem.CertFile, + &cfg.KubeConfig, + } +} From 415ca569332172b40a7edfef57b03dc9f3f722e5 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 22 Oct 2021 11:00:33 +0100 Subject: [PATCH 06/18] config API: fix up fuzz tests Signed-off-by: James Munnelly --- internal/apis/config/BUILD.bazel | 1 + internal/apis/config/fuzzer/BUILD.bazel | 28 +++++++++++++ internal/apis/config/fuzzer/fuzzer.go | 41 +++++++++++++++++++ internal/apis/config/install/BUILD.bazel | 10 +---- internal/apis/config/install/pruning_test.go | 32 --------------- .../apis/config/install/roundtrip_test.go | 4 +- 6 files changed, 74 insertions(+), 42 deletions(-) create mode 100644 internal/apis/config/fuzzer/BUILD.bazel create mode 100644 internal/apis/config/fuzzer/fuzzer.go delete mode 100644 internal/apis/config/install/pruning_test.go diff --git a/internal/apis/config/BUILD.bazel b/internal/apis/config/BUILD.bazel index 4839c0dfa..0059bb914 100644 --- a/internal/apis/config/BUILD.bazel +++ b/internal/apis/config/BUILD.bazel @@ -29,6 +29,7 @@ filegroup( name = "all-srcs", srcs = [ ":package-srcs", + "//internal/apis/config/fuzzer:all-srcs", "//internal/apis/config/install:all-srcs", "//internal/apis/config/scheme:all-srcs", "//internal/apis/config/v1alpha1:all-srcs", diff --git a/internal/apis/config/fuzzer/BUILD.bazel b/internal/apis/config/fuzzer/BUILD.bazel new file mode 100644 index 000000000..5445eab14 --- /dev/null +++ b/internal/apis/config/fuzzer/BUILD.bazel @@ -0,0 +1,28 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["fuzzer.go"], + importpath = "github.com/jetstack/cert-manager/internal/apis/config/fuzzer", + visibility = ["//:__subpackages__"], + deps = [ + "//internal/apis/config:go_default_library", + "@com_github_google_gofuzz//:go_default_library", + "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", + "@io_k8s_utils//pointer:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/internal/apis/config/fuzzer/fuzzer.go b/internal/apis/config/fuzzer/fuzzer.go new file mode 100644 index 000000000..ce0307a8a --- /dev/null +++ b/internal/apis/config/fuzzer/fuzzer.go @@ -0,0 +1,41 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package fuzzer + +import ( + fuzz "github.com/google/gofuzz" + runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer" + "k8s.io/utils/pointer" + + "github.com/jetstack/cert-manager/internal/apis/config" +) + +// Funcs returns the fuzzer functions for the apps api group. +var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} { + return []interface{}{ + func(s *config.WebhookConfiguration, c fuzz.Continue) { + c.FuzzNoCustom(s) // fuzz self without calling this function again + + if s.HealthzPort == nil { + s.HealthzPort = pointer.Int(12) + } + if s.SecurePort == nil { + s.SecurePort = pointer.Int(123) + } + }, + } +} diff --git a/internal/apis/config/install/BUILD.bazel b/internal/apis/config/install/BUILD.bazel index 05f0a4549..5cc101baf 100644 --- a/internal/apis/config/install/BUILD.bazel +++ b/internal/apis/config/install/BUILD.bazel @@ -29,19 +29,13 @@ filegroup( go_test( name = "go_default_test", - srcs = [ - "pruning_test.go", - "roundtrip_test.go", - ], + srcs = ["roundtrip_test.go"], data = [ "//deploy/crds:templated_files", ], embed = [":go_default_library"], deps = [ - "//internal/apis/acme/fuzzer:go_default_library", - "//pkg/api:go_default_library", - "//pkg/api/testing:go_default_library", - "@com_github_munnerz_crd_schema_fuzz//:go_default_library", + "//internal/apis/config/fuzzer:go_default_library", "@io_k8s_apimachinery//pkg/api/apitesting/roundtrip:go_default_library", ], ) diff --git a/internal/apis/config/install/pruning_test.go b/internal/apis/config/install/pruning_test.go deleted file mode 100644 index 9c82bdb00..000000000 --- a/internal/apis/config/install/pruning_test.go +++ /dev/null @@ -1,32 +0,0 @@ -/* -Copyright 2020 The cert-manager Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package install - -import ( - "testing" - - crdfuzz "github.com/munnerz/crd-schema-fuzz" - - acmefuzzer "github.com/jetstack/cert-manager/internal/apis/acme/fuzzer" - "github.com/jetstack/cert-manager/pkg/api" - apitesting "github.com/jetstack/cert-manager/pkg/api/testing" -) - -func TestPruneTypes(t *testing.T) { - crdfuzz.SchemaFuzzTestForCRDWithPath(t, api.Scheme, apitesting.PathForCRD(t, "orders"), acmefuzzer.Funcs) - crdfuzz.SchemaFuzzTestForCRDWithPath(t, api.Scheme, apitesting.PathForCRD(t, "challenges"), acmefuzzer.Funcs) -} diff --git a/internal/apis/config/install/roundtrip_test.go b/internal/apis/config/install/roundtrip_test.go index c634f2f00..29c588600 100644 --- a/internal/apis/config/install/roundtrip_test.go +++ b/internal/apis/config/install/roundtrip_test.go @@ -21,9 +21,9 @@ import ( "k8s.io/apimachinery/pkg/api/apitesting/roundtrip" - acmefuzzer "github.com/jetstack/cert-manager/internal/apis/acme/fuzzer" + configfuzzer "github.com/jetstack/cert-manager/internal/apis/config/fuzzer" ) func TestRoundTripTypes(t *testing.T) { - roundtrip.RoundTripTestForAPIGroup(t, Install, acmefuzzer.Funcs) + roundtrip.RoundTripTestForAPIGroup(t, Install, configfuzzer.Funcs) } From e21c6e6272a2f1a7c31678ad5328edf173da0a23 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 22 Oct 2021 11:01:10 +0100 Subject: [PATCH 07/18] Add test for flag precedence Signed-off-by: James Munnelly --- cmd/webhook/app/BUILD.bazel | 9 +++++- cmd/webhook/app/webhook_test.go | 57 +++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 cmd/webhook/app/webhook_test.go diff --git a/cmd/webhook/app/BUILD.bazel b/cmd/webhook/app/BUILD.bazel index ba2d11752..1be144d04 100644 --- a/cmd/webhook/app/BUILD.bazel +++ b/cmd/webhook/app/BUILD.bazel @@ -1,4 +1,4 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_library") +load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test") go_library( name = "go_default_library", @@ -43,3 +43,10 @@ filegroup( tags = ["automanaged"], visibility = ["//visibility:public"], ) + +go_test( + name = "go_default_test", + srcs = ["webhook_test.go"], + embed = [":go_default_library"], + deps = ["//cmd/webhook/app/options:go_default_library"], +) diff --git a/cmd/webhook/app/webhook_test.go b/cmd/webhook/app/webhook_test.go new file mode 100644 index 000000000..7535dcb4f --- /dev/null +++ b/cmd/webhook/app/webhook_test.go @@ -0,0 +1,57 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package app + +import ( + "testing" + + "github.com/jetstack/cert-manager/cmd/webhook/app/options" +) + +// Test to ensure flags take precedence over config options. +func TestWebhookConfigFlagPrecedence_FlagsTakePrecedence(t *testing.T) { + cfg, err := options.NewWebhookConfiguration() + if err != nil { + t.Fatal(err) + } + + cfg.KubeConfig = "" + if err := webhookConfigFlagPrecedence(cfg, []string{"--kubeconfig=valid"}); err != nil { + t.Fatal(err) + } + + if cfg.KubeConfig != "valid" { + t.Errorf("unexpected field value %q, expected %q", cfg.KubeConfig, "valid") + } +} + +// Test to ensure that when flags are not provided, config provided values are preserved. +func TestWebhookConfigFlagPrecedence_ConfigPersistsWithoutFlags(t *testing.T) { + cfg, err := options.NewWebhookConfiguration() + if err != nil { + t.Fatal(err) + } + + cfg.KubeConfig = "valid" + if err := webhookConfigFlagPrecedence(cfg, []string{}); err != nil { + t.Fatal(err) + } + + if cfg.KubeConfig != "valid" { + t.Errorf("unexpected field value %q, expected %q", cfg.KubeConfig, "valid") + } +} From 48a5efea5d694c3f6852fc0fe2c3a0e67d0b5c15 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 22 Oct 2021 11:01:30 +0100 Subject: [PATCH 08/18] Fix copyright headers Signed-off-by: James Munnelly --- internal/apis/config/doc.go | 2 +- internal/apis/config/install/install.go | 2 +- internal/apis/config/install/roundtrip_test.go | 2 +- internal/apis/config/register.go | 2 +- internal/apis/config/scheme/scheme.go | 16 ++++++++++++++++ internal/apis/config/types_webhook.go | 16 ++++++++++++++++ pkg/apis/config/v1alpha1/types_webhook.go | 16 ++++++++++++++++ 7 files changed, 52 insertions(+), 4 deletions(-) diff --git a/internal/apis/config/doc.go b/internal/apis/config/doc.go index 8e6aca8ca..dba76ef4c 100644 --- a/internal/apis/config/doc.go +++ b/internal/apis/config/doc.go @@ -1,5 +1,5 @@ /* -Copyright 2020 The cert-manager Authors. +Copyright 2021 The cert-manager Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/internal/apis/config/install/install.go b/internal/apis/config/install/install.go index 8edb703d2..3c0a3bc3c 100644 --- a/internal/apis/config/install/install.go +++ b/internal/apis/config/install/install.go @@ -1,5 +1,5 @@ /* -Copyright 2020 The cert-manager Authors. +Copyright 2021 The cert-manager Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/internal/apis/config/install/roundtrip_test.go b/internal/apis/config/install/roundtrip_test.go index 29c588600..ce7cd163b 100644 --- a/internal/apis/config/install/roundtrip_test.go +++ b/internal/apis/config/install/roundtrip_test.go @@ -1,5 +1,5 @@ /* -Copyright 2020 The cert-manager Authors. +Copyright 2021 The cert-manager Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/internal/apis/config/register.go b/internal/apis/config/register.go index f4875d621..ad71dbe3e 100644 --- a/internal/apis/config/register.go +++ b/internal/apis/config/register.go @@ -1,5 +1,5 @@ /* -Copyright 2020 The cert-manager Authors. +Copyright 2021 The cert-manager Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/internal/apis/config/scheme/scheme.go b/internal/apis/config/scheme/scheme.go index ecf9f2962..3f301134a 100644 --- a/internal/apis/config/scheme/scheme.go +++ b/internal/apis/config/scheme/scheme.go @@ -1,3 +1,19 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package scheme import ( diff --git a/internal/apis/config/types_webhook.go b/internal/apis/config/types_webhook.go index d3c4c2081..2c4a3ba59 100644 --- a/internal/apis/config/types_webhook.go +++ b/internal/apis/config/types_webhook.go @@ -1,3 +1,19 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package config import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" diff --git a/pkg/apis/config/v1alpha1/types_webhook.go b/pkg/apis/config/v1alpha1/types_webhook.go index 89455be66..20064b59f 100644 --- a/pkg/apis/config/v1alpha1/types_webhook.go +++ b/pkg/apis/config/v1alpha1/types_webhook.go @@ -1,3 +1,19 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package v1alpha1 import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" From 71a69cc48851a04043e9f8c0b95c7dd965c22bb7 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 22 Oct 2021 11:16:09 +0100 Subject: [PATCH 09/18] Add unit tests for configfile loading Signed-off-by: James Munnelly --- cmd/webhook/app/webhook.go | 2 +- pkg/webhook/configfile/BUILD.bazel | 8 ++- pkg/webhook/configfile/configfile.go | 22 +++++++- pkg/webhook/configfile/configfile_test.go | 63 +++++++++++++++++++++++ 4 files changed, 91 insertions(+), 4 deletions(-) create mode 100644 pkg/webhook/configfile/configfile_test.go diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go index 8945b07b6..57dfb5b04 100644 --- a/cmd/webhook/app/webhook.go +++ b/cmd/webhook/app/webhook.go @@ -253,7 +253,7 @@ func loadConfigFile(name string) (*config.WebhookConfiguration, error) { if err != nil { return nil, fmt.Errorf(errFmt, name, err) } - loader, err := configfile.NewFSLoader(webhookConfigFile) + loader, err := configfile.NewFSLoader(configfile.NewRealFS(), webhookConfigFile) if err != nil { return nil, fmt.Errorf(errFmt, name, err) } diff --git a/pkg/webhook/configfile/BUILD.bazel b/pkg/webhook/configfile/BUILD.bazel index 66c7c3594..763c62dbc 100644 --- a/pkg/webhook/configfile/BUILD.bazel +++ b/pkg/webhook/configfile/BUILD.bazel @@ -1,4 +1,4 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_library") +load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test") go_library( name = "go_default_library", @@ -25,3 +25,9 @@ filegroup( tags = ["automanaged"], visibility = ["//visibility:public"], ) + +go_test( + name = "go_default_test", + srcs = ["configfile_test.go"], + embed = [":go_default_library"], +) diff --git a/pkg/webhook/configfile/configfile.go b/pkg/webhook/configfile/configfile.go index 4d9f70cc6..f7a31996d 100644 --- a/pkg/webhook/configfile/configfile.go +++ b/pkg/webhook/configfile/configfile.go @@ -27,11 +27,28 @@ import ( "github.com/jetstack/cert-manager/internal/apis/config/scheme" ) +// Filesystem is an interface used to mock out calls to ReadFile +type Filesystem interface { + ReadFile(filename string) ([]byte, error) +} + +type realFS struct{} + +func (fs realFS) ReadFile(filename string) ([]byte, error) { + return ioutil.ReadFile(filename) +} + +// NewRealFS builds a Filesystem that wraps around `ioutil.ReadFile`. +func NewRealFS() Filesystem { + return realFS{} +} + type Loader interface { Load() (*config.WebhookConfiguration, error) } type fsLoader struct { + fs Filesystem filename string codec *serializer.CodecFactory } @@ -39,7 +56,7 @@ type fsLoader struct { var _ Loader = &fsLoader{} func (f *fsLoader) Load() (*config.WebhookConfiguration, error) { - data, err := ioutil.ReadFile(f.filename) + data, err := f.fs.ReadFile(f.filename) if err != nil { return nil, fmt.Errorf("failed to read webhook config file %q, error: %v", f.filename, err) } @@ -58,13 +75,14 @@ func (f *fsLoader) Load() (*config.WebhookConfiguration, error) { return cfg, nil } -func NewFSLoader(name string) (Loader, error) { +func NewFSLoader(fs Filesystem, name string) (Loader, error) { _, webhookCodec, err := scheme.NewSchemeAndCodecs(serializer.EnableStrict) if err != nil { return nil, err } return &fsLoader{ + fs: fs, filename: name, codec: webhookCodec, }, nil diff --git a/pkg/webhook/configfile/configfile_test.go b/pkg/webhook/configfile/configfile_test.go new file mode 100644 index 000000000..29e2019e6 --- /dev/null +++ b/pkg/webhook/configfile/configfile_test.go @@ -0,0 +1,63 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package configfile + +import ( + "fmt" + "testing" +) + +func TestFSLoader_Load(t *testing.T) { + const expectedFilename = "/path/to/config/file" + const kubeConfigPath = "path/to/kubeconfig/file" + + loader, err := NewFSLoader(newFakeFS(func(filename string) ([]byte, error) { + if filename != expectedFilename { + t.Fatalf("unexpected filename %q passed to ReadFile", filename) + return nil, fmt.Errorf("unexpected filename %q", filename) + } + return []byte(fmt.Sprintf(`apiVersion: config.cert-manager.io/v1alpha1 +kind: WebhookConfiguration +kubeConfig: %s`, kubeConfigPath)), nil + }), expectedFilename) + if err != nil { + t.Fatal(err) + } + + cfg, err := loader.Load() + if err != nil { + t.Fatal(err) + } + + // the config loader will force paths to be 'absolute' if they are provided as relative. + absKubeConfigPath := "/path/to/config/path/to/kubeconfig/file" + if cfg.KubeConfig != absKubeConfigPath { + t.Errorf("expected kubeConfig to be set to %q but got %q", absKubeConfigPath, cfg.KubeConfig) + } +} + +func newFakeFS(readFileFunc func(string) ([]byte, error)) Filesystem { + return fakeFS{readFileFunc: readFileFunc} +} + +type fakeFS struct { + readFileFunc func(string) ([]byte, error) +} + +func (f fakeFS) ReadFile(filename string) ([]byte, error) { + return f.readFileFunc(filename) +} From d5133a166883e6145cccea38c4b71546dec1f853 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 25 Nov 2021 12:20:30 +0000 Subject: [PATCH 10/18] Run update-codegen.sh Signed-off-by: James Munnelly --- internal/apis/config/v1alpha1/zz_generated.conversion.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/apis/config/v1alpha1/zz_generated.conversion.go b/internal/apis/config/v1alpha1/zz_generated.conversion.go index ae5165ff5..05d1e8bcd 100644 --- a/internal/apis/config/v1alpha1/zz_generated.conversion.go +++ b/internal/apis/config/v1alpha1/zz_generated.conversion.go @@ -88,6 +88,8 @@ func autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in } out.KubeConfig = in.KubeConfig out.APIServerHost = in.APIServerHost + out.EnablePprof = in.EnablePprof + out.PprofAddress = in.PprofAddress return nil } @@ -104,6 +106,8 @@ func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in } out.KubeConfig = in.KubeConfig out.APIServerHost = in.APIServerHost + out.EnablePprof = in.EnablePprof + out.PprofAddress = in.PprofAddress return nil } From 553e1e0536e7ee68ef847c305531bdaf888e12ea Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 26 Nov 2021 14:07:23 +0000 Subject: [PATCH 11/18] Add ability to configure WebhookConfiguration via the Helm chart Signed-off-by: James Munnelly --- deploy/charts/cert-manager/README.template.md | 1 + .../templates/webhook-config.yaml | 24 +++++++++++++++++++ .../templates/webhook-deployment.yaml | 20 +++++++++++++++- deploy/charts/cert-manager/values.yaml | 9 +++++++ 4 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 deploy/charts/cert-manager/templates/webhook-config.yaml diff --git a/deploy/charts/cert-manager/README.template.md b/deploy/charts/cert-manager/README.template.md index fcd4e61f4..3d452e970 100644 --- a/deploy/charts/cert-manager/README.template.md +++ b/deploy/charts/cert-manager/README.template.md @@ -136,6 +136,7 @@ The following table lists the configurable parameters of the cert-manager chart | `webhook.mutatingWebhookConfigurationAnnotations` | Annotations to add to the mutating webhook configuration | `{}` | | `webhook.validatingWebhookConfigurationAnnotations` | Annotations to add to the validating webhook configuration | `{}` | | `webhook.serviceAnnotations` | Annotations to add to the webhook service | `{}` | +| `webhook.config` | WebhookConfiguration YAML used to configure flags for the webhook. Generates a ConfigMap containing contents of the field. See `values.yaml` for example. | `{}` | | `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` | | `webhook.serviceAccount.create` | If `true`, create a new service account for the webhook component | `true` | | `webhook.serviceAccount.name` | Service account for the webhook component to be used. If not set and `webhook.serviceAccount.create` is `true`, a name is generated using the fullname template | | diff --git a/deploy/charts/cert-manager/templates/webhook-config.yaml b/deploy/charts/cert-manager/templates/webhook-config.yaml new file mode 100644 index 000000000..29558e91a --- /dev/null +++ b/deploy/charts/cert-manager/templates/webhook-config.yaml @@ -0,0 +1,24 @@ +{{- if .Values.webhook.config -}} + {{- if not .Values.webhook.config.apiVersion -}} + {{- fail "webhook.config.apiVersion must be set" -}} + {{- end -}} + + {{- if not .Values.webhook.config.kind -}} + {{- fail "webhook.config.kind must be set" -}} + {{- end -}} +{{- end -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + app.kubernetes.io/name: {{ include "webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "webhook" +data: + {{- if .Values.webhook.config }} + config.yaml: | + {{ .Values.webhook.config | toYaml | nindent 4 }} + {{- end }} diff --git a/deploy/charts/cert-manager/templates/webhook-deployment.yaml b/deploy/charts/cert-manager/templates/webhook-deployment.yaml index 4822fdbff..6d0cf07a6 100644 --- a/deploy/charts/cert-manager/templates/webhook-deployment.yaml +++ b/deploy/charts/cert-manager/templates/webhook-deployment.yaml @@ -61,10 +61,18 @@ spec: {{- if .Values.global.logLevel }} - --v={{ .Values.global.logLevel }} {{- end }} + {{- if .Values.webhook.config }} + - --config=/var/cert-manager/config/config.yaml + {{- end }} + {{- $config := default .Values.webhook.config "" }} + {{ if not $config.securePort -}} - --secure-port={{ .Values.webhook.securePort }} + {{- end }} + {{ if not $config.tlsConfig -}} - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - --dynamic-serving-ca-secret-name={{ template "webhook.fullname" . }}-ca - --dynamic-serving-dns-names={{ template "webhook.fullname" . }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }}.svc{{ if .Values.webhook.url.host }},{{ .Values.webhook.url.host }}{{ end }} + {{- end }} {{- with .Values.webhook.extraArgs }} {{- toYaml . | nindent 10 }} {{- end }} @@ -105,6 +113,11 @@ spec: resources: {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.webhook.config }} + volumeMounts: + - name: config + mountPath: /var/cert-manager/config + {{- end }} {{- with .Values.webhook.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -117,4 +130,9 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} - + {{- if .Values.webhook.config }} + volumes: + - name: config + configMap: + name: {{ include "webhook.fullname" . }} + {{- end }} diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index d800d4832..336e80f62 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -206,6 +206,14 @@ webhook: replicaCount: 1 timeoutSeconds: 10 + # Used to configure options for the webhook pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + config: + # apiVersion: config.cert-manager.io/v1alpha1 + # kind: WebhookConfiguration + strategy: {} # type: RollingUpdate # rollingUpdate: @@ -308,6 +316,7 @@ webhook: # talk to the cluster nodes only on 443 and 10250. so configuring # securePort: 10250, will work out of the box without needing to add firewall # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000 + # DEPRECATED: use webhook.config.securePort instead. securePort: 10250 # Specifies if the webhook should be started in hostNetwork mode. From 9fce2ba5b0c3189301aafe52de724e5b2b4c63f7 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 26 Nov 2021 15:15:44 +0000 Subject: [PATCH 12/18] Move files to create config.webhook.cert-manager.io Signed-off-by: James Munnelly --- internal/apis/config/{ => webhook}/BUILD.bazel | 0 internal/apis/config/{ => webhook}/doc.go | 0 internal/apis/config/{ => webhook}/fuzzer/BUILD.bazel | 0 internal/apis/config/{ => webhook}/fuzzer/fuzzer.go | 0 internal/apis/config/{ => webhook}/install/BUILD.bazel | 0 internal/apis/config/{ => webhook}/install/install.go | 0 .../apis/config/{ => webhook}/install/roundtrip_test.go | 0 internal/apis/config/{ => webhook}/register.go | 5 ++--- internal/apis/config/{ => webhook}/scheme/BUILD.bazel | 0 internal/apis/config/{ => webhook}/scheme/scheme.go | 0 .../apis/config/{types_webhook.go => webhook/types.go} | 2 +- internal/apis/config/{ => webhook}/v1alpha1/BUILD.bazel | 0 internal/apis/config/{ => webhook}/v1alpha1/conversion.go | 0 internal/apis/config/{ => webhook}/v1alpha1/defaults.go | 2 +- internal/apis/config/{ => webhook}/v1alpha1/doc.go | 0 internal/apis/config/{ => webhook}/v1alpha1/register.go | 7 +++---- .../{ => webhook}/v1alpha1/zz_generated.conversion.go | 2 +- .../config/{ => webhook}/v1alpha1/zz_generated.defaults.go | 2 +- internal/apis/config/{ => webhook}/validation/BUILD.bazel | 0 .../apis/config/{ => webhook}/validation/validation.go | 0 .../apis/config/{ => webhook}/zz_generated.deepcopy.go | 0 pkg/apis/config/{ => webhook}/BUILD.bazel | 0 pkg/apis/config/{ => webhook}/doc.go | 0 pkg/apis/config/{ => webhook}/v1alpha1/BUILD.bazel | 0 pkg/apis/config/{ => webhook}/v1alpha1/doc.go | 0 pkg/apis/config/{ => webhook}/v1alpha1/register.go | 0 .../types_webhook.go => webhook/v1alpha1/types.go} | 0 .../config/{ => webhook}/v1alpha1/zz_generated.deepcopy.go | 0 28 files changed, 9 insertions(+), 11 deletions(-) rename internal/apis/config/{ => webhook}/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/doc.go (100%) rename internal/apis/config/{ => webhook}/fuzzer/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/fuzzer/fuzzer.go (100%) rename internal/apis/config/{ => webhook}/install/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/install/install.go (100%) rename internal/apis/config/{ => webhook}/install/roundtrip_test.go (100%) rename internal/apis/config/{ => webhook}/register.go (88%) rename internal/apis/config/{ => webhook}/scheme/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/scheme/scheme.go (100%) rename internal/apis/config/{types_webhook.go => webhook/types.go} (99%) rename internal/apis/config/{ => webhook}/v1alpha1/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/v1alpha1/conversion.go (100%) rename internal/apis/config/{ => webhook}/v1alpha1/defaults.go (93%) rename internal/apis/config/{ => webhook}/v1alpha1/doc.go (100%) rename internal/apis/config/{ => webhook}/v1alpha1/register.go (85%) rename internal/apis/config/{ => webhook}/v1alpha1/zz_generated.conversion.go (99%) rename internal/apis/config/{ => webhook}/v1alpha1/zz_generated.defaults.go (94%) rename internal/apis/config/{ => webhook}/validation/BUILD.bazel (100%) rename internal/apis/config/{ => webhook}/validation/validation.go (100%) rename internal/apis/config/{ => webhook}/zz_generated.deepcopy.go (100%) rename pkg/apis/config/{ => webhook}/BUILD.bazel (100%) rename pkg/apis/config/{ => webhook}/doc.go (100%) rename pkg/apis/config/{ => webhook}/v1alpha1/BUILD.bazel (100%) rename pkg/apis/config/{ => webhook}/v1alpha1/doc.go (100%) rename pkg/apis/config/{ => webhook}/v1alpha1/register.go (100%) rename pkg/apis/config/{v1alpha1/types_webhook.go => webhook/v1alpha1/types.go} (100%) rename pkg/apis/config/{ => webhook}/v1alpha1/zz_generated.deepcopy.go (100%) diff --git a/internal/apis/config/BUILD.bazel b/internal/apis/config/webhook/BUILD.bazel similarity index 100% rename from internal/apis/config/BUILD.bazel rename to internal/apis/config/webhook/BUILD.bazel diff --git a/internal/apis/config/doc.go b/internal/apis/config/webhook/doc.go similarity index 100% rename from internal/apis/config/doc.go rename to internal/apis/config/webhook/doc.go diff --git a/internal/apis/config/fuzzer/BUILD.bazel b/internal/apis/config/webhook/fuzzer/BUILD.bazel similarity index 100% rename from internal/apis/config/fuzzer/BUILD.bazel rename to internal/apis/config/webhook/fuzzer/BUILD.bazel diff --git a/internal/apis/config/fuzzer/fuzzer.go b/internal/apis/config/webhook/fuzzer/fuzzer.go similarity index 100% rename from internal/apis/config/fuzzer/fuzzer.go rename to internal/apis/config/webhook/fuzzer/fuzzer.go diff --git a/internal/apis/config/install/BUILD.bazel b/internal/apis/config/webhook/install/BUILD.bazel similarity index 100% rename from internal/apis/config/install/BUILD.bazel rename to internal/apis/config/webhook/install/BUILD.bazel diff --git a/internal/apis/config/install/install.go b/internal/apis/config/webhook/install/install.go similarity index 100% rename from internal/apis/config/install/install.go rename to internal/apis/config/webhook/install/install.go diff --git a/internal/apis/config/install/roundtrip_test.go b/internal/apis/config/webhook/install/roundtrip_test.go similarity index 100% rename from internal/apis/config/install/roundtrip_test.go rename to internal/apis/config/webhook/install/roundtrip_test.go diff --git a/internal/apis/config/register.go b/internal/apis/config/webhook/register.go similarity index 88% rename from internal/apis/config/register.go rename to internal/apis/config/webhook/register.go index ad71dbe3e..f9352266e 100644 --- a/internal/apis/config/register.go +++ b/internal/apis/config/webhook/register.go @@ -17,10 +17,9 @@ limitations under the License. package config import ( + "github.com/jetstack/cert-manager/pkg/apis/config/webhook" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" - - "github.com/jetstack/cert-manager/pkg/apis/config" ) var ( @@ -29,7 +28,7 @@ var ( ) // SchemeGroupVersion is group version used to register these objects -var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: runtime.APIVersionInternal} +var SchemeGroupVersion = schema.GroupVersion{Group: webhook.GroupName, Version: runtime.APIVersionInternal} // Resource takes an unqualified resource and returns a Group qualified GroupResource func Resource(resource string) schema.GroupResource { diff --git a/internal/apis/config/scheme/BUILD.bazel b/internal/apis/config/webhook/scheme/BUILD.bazel similarity index 100% rename from internal/apis/config/scheme/BUILD.bazel rename to internal/apis/config/webhook/scheme/BUILD.bazel diff --git a/internal/apis/config/scheme/scheme.go b/internal/apis/config/webhook/scheme/scheme.go similarity index 100% rename from internal/apis/config/scheme/scheme.go rename to internal/apis/config/webhook/scheme/scheme.go diff --git a/internal/apis/config/types_webhook.go b/internal/apis/config/webhook/types.go similarity index 99% rename from internal/apis/config/types_webhook.go rename to internal/apis/config/webhook/types.go index 2c4a3ba59..2d9939ddf 100644 --- a/internal/apis/config/types_webhook.go +++ b/internal/apis/config/webhook/types.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package config +package webhook import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" diff --git a/internal/apis/config/v1alpha1/BUILD.bazel b/internal/apis/config/webhook/v1alpha1/BUILD.bazel similarity index 100% rename from internal/apis/config/v1alpha1/BUILD.bazel rename to internal/apis/config/webhook/v1alpha1/BUILD.bazel diff --git a/internal/apis/config/v1alpha1/conversion.go b/internal/apis/config/webhook/v1alpha1/conversion.go similarity index 100% rename from internal/apis/config/v1alpha1/conversion.go rename to internal/apis/config/webhook/v1alpha1/conversion.go diff --git a/internal/apis/config/v1alpha1/defaults.go b/internal/apis/config/webhook/v1alpha1/defaults.go similarity index 93% rename from internal/apis/config/v1alpha1/defaults.go rename to internal/apis/config/webhook/v1alpha1/defaults.go index 60cb83552..950a8a489 100644 --- a/internal/apis/config/v1alpha1/defaults.go +++ b/internal/apis/config/webhook/v1alpha1/defaults.go @@ -17,7 +17,7 @@ limitations under the License. package v1alpha1 import ( - "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" + "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/utils/pointer" ) diff --git a/internal/apis/config/v1alpha1/doc.go b/internal/apis/config/webhook/v1alpha1/doc.go similarity index 100% rename from internal/apis/config/v1alpha1/doc.go rename to internal/apis/config/webhook/v1alpha1/doc.go diff --git a/internal/apis/config/v1alpha1/register.go b/internal/apis/config/webhook/v1alpha1/register.go similarity index 85% rename from internal/apis/config/v1alpha1/register.go rename to internal/apis/config/webhook/v1alpha1/register.go index 4b4d4c4bb..102d7dacc 100644 --- a/internal/apis/config/v1alpha1/register.go +++ b/internal/apis/config/webhook/v1alpha1/register.go @@ -17,14 +17,13 @@ limitations under the License. package v1alpha1 import ( + "github.com/jetstack/cert-manager/pkg/apis/config/webhook" + "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" "k8s.io/apimachinery/pkg/runtime/schema" - - "github.com/jetstack/cert-manager/pkg/apis/config" - "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" ) // SchemeGroupVersion is group version used to register these objects -var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: "v1alpha1"} +var SchemeGroupVersion = schema.GroupVersion{Group: webhook.GroupName, Version: "v1alpha1"} // Resource takes an unqualified resource and returns a Group qualified GroupResource func Resource(resource string) schema.GroupResource { diff --git a/internal/apis/config/v1alpha1/zz_generated.conversion.go b/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go similarity index 99% rename from internal/apis/config/v1alpha1/zz_generated.conversion.go rename to internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go index 05d1e8bcd..114d09f6d 100644 --- a/internal/apis/config/v1alpha1/zz_generated.conversion.go +++ b/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go @@ -22,10 +22,10 @@ limitations under the License. package v1alpha1 import ( + "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" unsafe "unsafe" config "github.com/jetstack/cert-manager/internal/apis/config" - v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" conversion "k8s.io/apimachinery/pkg/conversion" runtime "k8s.io/apimachinery/pkg/runtime" ) diff --git a/internal/apis/config/v1alpha1/zz_generated.defaults.go b/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go similarity index 94% rename from internal/apis/config/v1alpha1/zz_generated.defaults.go rename to internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go index c51a47bee..f7e0b36e9 100644 --- a/internal/apis/config/v1alpha1/zz_generated.defaults.go +++ b/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go @@ -22,7 +22,7 @@ limitations under the License. package v1alpha1 import ( - v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" + "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" runtime "k8s.io/apimachinery/pkg/runtime" ) diff --git a/internal/apis/config/validation/BUILD.bazel b/internal/apis/config/webhook/validation/BUILD.bazel similarity index 100% rename from internal/apis/config/validation/BUILD.bazel rename to internal/apis/config/webhook/validation/BUILD.bazel diff --git a/internal/apis/config/validation/validation.go b/internal/apis/config/webhook/validation/validation.go similarity index 100% rename from internal/apis/config/validation/validation.go rename to internal/apis/config/webhook/validation/validation.go diff --git a/internal/apis/config/zz_generated.deepcopy.go b/internal/apis/config/webhook/zz_generated.deepcopy.go similarity index 100% rename from internal/apis/config/zz_generated.deepcopy.go rename to internal/apis/config/webhook/zz_generated.deepcopy.go diff --git a/pkg/apis/config/BUILD.bazel b/pkg/apis/config/webhook/BUILD.bazel similarity index 100% rename from pkg/apis/config/BUILD.bazel rename to pkg/apis/config/webhook/BUILD.bazel diff --git a/pkg/apis/config/doc.go b/pkg/apis/config/webhook/doc.go similarity index 100% rename from pkg/apis/config/doc.go rename to pkg/apis/config/webhook/doc.go diff --git a/pkg/apis/config/v1alpha1/BUILD.bazel b/pkg/apis/config/webhook/v1alpha1/BUILD.bazel similarity index 100% rename from pkg/apis/config/v1alpha1/BUILD.bazel rename to pkg/apis/config/webhook/v1alpha1/BUILD.bazel diff --git a/pkg/apis/config/v1alpha1/doc.go b/pkg/apis/config/webhook/v1alpha1/doc.go similarity index 100% rename from pkg/apis/config/v1alpha1/doc.go rename to pkg/apis/config/webhook/v1alpha1/doc.go diff --git a/pkg/apis/config/v1alpha1/register.go b/pkg/apis/config/webhook/v1alpha1/register.go similarity index 100% rename from pkg/apis/config/v1alpha1/register.go rename to pkg/apis/config/webhook/v1alpha1/register.go diff --git a/pkg/apis/config/v1alpha1/types_webhook.go b/pkg/apis/config/webhook/v1alpha1/types.go similarity index 100% rename from pkg/apis/config/v1alpha1/types_webhook.go rename to pkg/apis/config/webhook/v1alpha1/types.go diff --git a/pkg/apis/config/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go similarity index 100% rename from pkg/apis/config/v1alpha1/zz_generated.deepcopy.go rename to pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go From 1a96d9f32d0a42867299805f0146861dfabb1ffb Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 26 Nov 2021 16:10:42 +0000 Subject: [PATCH 13/18] config.cert-manager.io -> webhook.config.cert-manager.io Signed-off-by: James Munnelly --- cmd/webhook/app/BUILD.bazel | 2 +- cmd/webhook/app/options/BUILD.bazel | 6 ++--- cmd/webhook/app/options/options.go | 6 ++--- cmd/webhook/app/webhook.go | 2 +- deploy/charts/cert-manager/values.yaml | 2 +- hack/update-codegen.sh | 8 +++---- internal/BUILD.bazel | 2 +- internal/apis/config/webhook/BUILD.bazel | 16 +++++++------- internal/apis/config/webhook/doc.go | 6 ++--- .../apis/config/webhook/fuzzer/BUILD.bazel | 4 ++-- internal/apis/config/webhook/fuzzer/fuzzer.go | 6 ++--- .../apis/config/webhook/install/BUILD.bazel | 8 +++---- .../apis/config/webhook/install/install.go | 6 ++--- .../config/webhook/install/roundtrip_test.go | 2 +- internal/apis/config/webhook/register.go | 5 +++-- .../apis/config/webhook/scheme/BUILD.bazel | 6 ++--- internal/apis/config/webhook/scheme/scheme.go | 4 ++-- internal/apis/config/webhook/types.go | 22 +++++++++---------- .../apis/config/webhook/v1alpha1/BUILD.bazel | 8 +++---- .../apis/config/webhook/v1alpha1/defaults.go | 3 ++- internal/apis/config/webhook/v1alpha1/doc.go | 8 +++---- .../apis/config/webhook/v1alpha1/register.go | 3 ++- .../config/webhook/validation/BUILD.bazel | 4 ++-- .../config/webhook/validation/validation.go | 2 +- pkg/apis/BUILD.bazel | 2 +- pkg/apis/config/webhook/BUILD.bazel | 4 ++-- pkg/apis/config/webhook/doc.go | 8 +++---- pkg/apis/config/webhook/v1alpha1/BUILD.bazel | 6 ++--- pkg/apis/config/webhook/v1alpha1/doc.go | 4 ++-- pkg/apis/config/webhook/v1alpha1/register.go | 4 ++-- pkg/apis/config/webhook/v1alpha1/types.go | 18 +++++++-------- pkg/webhook/configfile/BUILD.bazel | 4 ++-- pkg/webhook/configfile/configfile.go | 4 ++-- pkg/webhook/configfile/configfile_test.go | 2 +- 34 files changed, 100 insertions(+), 97 deletions(-) diff --git a/cmd/webhook/app/BUILD.bazel b/cmd/webhook/app/BUILD.bazel index 1be144d04..d031fdbc8 100644 --- a/cmd/webhook/app/BUILD.bazel +++ b/cmd/webhook/app/BUILD.bazel @@ -8,7 +8,7 @@ go_library( deps = [ "//cmd/util:go_default_library", "//cmd/webhook/app/options:go_default_library", - "//internal/apis/config:go_default_library", + "//internal/apis/config/webhook:go_default_library", "//pkg/logs:go_default_library", "//pkg/util:go_default_library", "//pkg/webhook:go_default_library", diff --git a/cmd/webhook/app/options/BUILD.bazel b/cmd/webhook/app/options/BUILD.bazel index 34b828dd3..10f13e741 100644 --- a/cmd/webhook/app/options/BUILD.bazel +++ b/cmd/webhook/app/options/BUILD.bazel @@ -9,9 +9,9 @@ go_library( importpath = "github.com/jetstack/cert-manager/cmd/webhook/app/options", visibility = ["//visibility:public"], deps = [ - "//internal/apis/config:go_default_library", - "//internal/apis/config/scheme:go_default_library", - "//pkg/apis/config/v1alpha1:go_default_library", + "//internal/apis/config/webhook:go_default_library", + "//internal/apis/config/webhook/scheme:go_default_library", + "//pkg/apis/config/webhook/v1alpha1:go_default_library", "//pkg/logs:go_default_library", "@com_github_spf13_pflag//:go_default_library", "@io_k8s_component_base//cli/flag:go_default_library", diff --git a/cmd/webhook/app/options/options.go b/cmd/webhook/app/options/options.go index b2adccd55..a683009c2 100644 --- a/cmd/webhook/app/options/options.go +++ b/cmd/webhook/app/options/options.go @@ -22,9 +22,9 @@ import ( "github.com/spf13/pflag" cliflag "k8s.io/component-base/cli/flag" - "github.com/jetstack/cert-manager/internal/apis/config" - configscheme "github.com/jetstack/cert-manager/internal/apis/config/scheme" - configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1" + config "github.com/jetstack/cert-manager/internal/apis/config/webhook" + configscheme "github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme" + configv1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" ) // WebhookFlags defines options that can only be configured via flags. diff --git a/cmd/webhook/app/webhook.go b/cmd/webhook/app/webhook.go index 57dfb5b04..696c32f5a 100644 --- a/cmd/webhook/app/webhook.go +++ b/cmd/webhook/app/webhook.go @@ -31,7 +31,7 @@ import ( cmdutil "github.com/jetstack/cert-manager/cmd/util" "github.com/jetstack/cert-manager/cmd/webhook/app/options" - "github.com/jetstack/cert-manager/internal/apis/config" + config "github.com/jetstack/cert-manager/internal/apis/config/webhook" logf "github.com/jetstack/cert-manager/pkg/logs" "github.com/jetstack/cert-manager/pkg/util" "github.com/jetstack/cert-manager/pkg/webhook" diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index 336e80f62..6a4007153 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -211,7 +211,7 @@ webhook: # An APIVersion and Kind must be specified in your values.yaml file. # Flags will override options that are set here. config: - # apiVersion: config.cert-manager.io/v1alpha1 + # apiVersion: config.webhook.cert-manager.io/v1alpha1 # kind: WebhookConfiguration strategy: {} diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh index 1bfdfe541..491f32842 100755 --- a/hack/update-codegen.sh +++ b/hack/update-codegen.sh @@ -44,8 +44,8 @@ deepcopy_inputs=( pkg/apis/acme/v1beta1 \ pkg/apis/acme/v1 \ internal/apis/acme \ - pkg/apis/config/v1alpha1 \ - internal/apis/config \ + pkg/apis/config/webhook/v1alpha1 \ + internal/apis/config/webhook \ pkg/apis/meta/v1 \ internal/apis/meta \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ @@ -78,7 +78,7 @@ defaulter_inputs=( internal/apis/acme/v1alpha3 \ internal/apis/acme/v1beta1 \ internal/apis/acme/v1 \ - internal/apis/config/v1alpha1 \ + internal/apis/config/webhook/v1alpha1 \ internal/apis/meta/v1 \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ pkg/webhook/handlers/testdata/apis/testgroup/v1 \ @@ -94,7 +94,7 @@ conversion_inputs=( internal/apis/acme/v1alpha3 \ internal/apis/acme/v1beta1 \ internal/apis/acme/v1 \ - internal/apis/config/v1alpha1 \ + internal/apis/config/webhook/v1alpha1 \ internal/apis/meta/v1 \ pkg/webhook/handlers/testdata/apis/testgroup/v2 \ pkg/webhook/handlers/testdata/apis/testgroup/v1 \ diff --git a/internal/BUILD.bazel b/internal/BUILD.bazel index be7f45a01..158de8e87 100644 --- a/internal/BUILD.bazel +++ b/internal/BUILD.bazel @@ -13,7 +13,7 @@ filegroup( "//internal/api/validation:all-srcs", "//internal/apis/acme:all-srcs", "//internal/apis/certmanager:all-srcs", - "//internal/apis/config:all-srcs", + "//internal/apis/config/webhook:all-srcs", "//internal/apis/meta:all-srcs", "//internal/ingress:all-srcs", "//internal/vault:all-srcs", diff --git a/internal/apis/config/webhook/BUILD.bazel b/internal/apis/config/webhook/BUILD.bazel index 0059bb914..c243de4b7 100644 --- a/internal/apis/config/webhook/BUILD.bazel +++ b/internal/apis/config/webhook/BUILD.bazel @@ -5,13 +5,13 @@ go_library( srcs = [ "doc.go", "register.go", - "types_webhook.go", + "types.go", "zz_generated.deepcopy.go", ], - importpath = "github.com/jetstack/cert-manager/internal/apis/config", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook", visibility = ["//:__subpackages__"], deps = [ - "//pkg/apis/config:go_default_library", + "//pkg/apis/config/webhook:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", @@ -29,11 +29,11 @@ filegroup( name = "all-srcs", srcs = [ ":package-srcs", - "//internal/apis/config/fuzzer:all-srcs", - "//internal/apis/config/install:all-srcs", - "//internal/apis/config/scheme:all-srcs", - "//internal/apis/config/v1alpha1:all-srcs", - "//internal/apis/config/validation:all-srcs", + "//internal/apis/config/webhook/fuzzer:all-srcs", + "//internal/apis/config/webhook/install:all-srcs", + "//internal/apis/config/webhook/scheme:all-srcs", + "//internal/apis/config/webhook/v1alpha1:all-srcs", + "//internal/apis/config/webhook/validation:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/internal/apis/config/webhook/doc.go b/internal/apis/config/webhook/doc.go index dba76ef4c..6026527b7 100644 --- a/internal/apis/config/webhook/doc.go +++ b/internal/apis/config/webhook/doc.go @@ -16,6 +16,6 @@ limitations under the License. // +k8s:deepcopy-gen=package,register -// Package config is the internal version of the API. -// +groupName=config.cert-manager.io -package config +// Package webhook is the internal version of the webhook config API. +// +groupName=webhook.config.cert-manager.io +package webhook diff --git a/internal/apis/config/webhook/fuzzer/BUILD.bazel b/internal/apis/config/webhook/fuzzer/BUILD.bazel index 5445eab14..e20e9353d 100644 --- a/internal/apis/config/webhook/fuzzer/BUILD.bazel +++ b/internal/apis/config/webhook/fuzzer/BUILD.bazel @@ -3,10 +3,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", srcs = ["fuzzer.go"], - importpath = "github.com/jetstack/cert-manager/internal/apis/config/fuzzer", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/fuzzer", visibility = ["//:__subpackages__"], deps = [ - "//internal/apis/config:go_default_library", + "//internal/apis/config/webhook:go_default_library", "@com_github_google_gofuzz//:go_default_library", "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", "@io_k8s_utils//pointer:go_default_library", diff --git a/internal/apis/config/webhook/fuzzer/fuzzer.go b/internal/apis/config/webhook/fuzzer/fuzzer.go index ce0307a8a..879e4eb6a 100644 --- a/internal/apis/config/webhook/fuzzer/fuzzer.go +++ b/internal/apis/config/webhook/fuzzer/fuzzer.go @@ -21,13 +21,13 @@ import ( runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer" "k8s.io/utils/pointer" - "github.com/jetstack/cert-manager/internal/apis/config" + "github.com/jetstack/cert-manager/internal/apis/config/webhook" ) -// Funcs returns the fuzzer functions for the apps api group. +// Funcs returns the fuzzer functions for the webhook config api group. var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} { return []interface{}{ - func(s *config.WebhookConfiguration, c fuzz.Continue) { + func(s *webhook.WebhookConfiguration, c fuzz.Continue) { c.FuzzNoCustom(s) // fuzz self without calling this function again if s.HealthzPort == nil { diff --git a/internal/apis/config/webhook/install/BUILD.bazel b/internal/apis/config/webhook/install/BUILD.bazel index 5cc101baf..513f9a130 100644 --- a/internal/apis/config/webhook/install/BUILD.bazel +++ b/internal/apis/config/webhook/install/BUILD.bazel @@ -3,11 +3,11 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test") go_library( name = "go_default_library", srcs = ["install.go"], - importpath = "github.com/jetstack/cert-manager/internal/apis/config/install", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/install", visibility = ["//:__subpackages__"], deps = [ - "//internal/apis/config:go_default_library", - "//internal/apis/config/v1alpha1:go_default_library", + "//internal/apis/config/webhook:go_default_library", + "//internal/apis/config/webhook/v1alpha1:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/util/runtime:go_default_library", ], @@ -35,7 +35,7 @@ go_test( ], embed = [":go_default_library"], deps = [ - "//internal/apis/config/fuzzer:go_default_library", + "//internal/apis/config/webhook/fuzzer:go_default_library", "@io_k8s_apimachinery//pkg/api/apitesting/roundtrip:go_default_library", ], ) diff --git a/internal/apis/config/webhook/install/install.go b/internal/apis/config/webhook/install/install.go index 3c0a3bc3c..426dcc8f7 100644 --- a/internal/apis/config/webhook/install/install.go +++ b/internal/apis/config/webhook/install/install.go @@ -22,12 +22,12 @@ import ( "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" - "github.com/jetstack/cert-manager/internal/apis/config" - "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1" + "github.com/jetstack/cert-manager/internal/apis/config/webhook" + "github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1" ) // Install registers the API group and adds types to a scheme func Install(scheme *runtime.Scheme) { - utilruntime.Must(config.AddToScheme(scheme)) + utilruntime.Must(webhook.AddToScheme(scheme)) utilruntime.Must(v1alpha1.AddToScheme(scheme)) } diff --git a/internal/apis/config/webhook/install/roundtrip_test.go b/internal/apis/config/webhook/install/roundtrip_test.go index ce7cd163b..6175d8b9f 100644 --- a/internal/apis/config/webhook/install/roundtrip_test.go +++ b/internal/apis/config/webhook/install/roundtrip_test.go @@ -21,7 +21,7 @@ import ( "k8s.io/apimachinery/pkg/api/apitesting/roundtrip" - configfuzzer "github.com/jetstack/cert-manager/internal/apis/config/fuzzer" + configfuzzer "github.com/jetstack/cert-manager/internal/apis/config/webhook/fuzzer" ) func TestRoundTripTypes(t *testing.T) { diff --git a/internal/apis/config/webhook/register.go b/internal/apis/config/webhook/register.go index f9352266e..0fa94f50e 100644 --- a/internal/apis/config/webhook/register.go +++ b/internal/apis/config/webhook/register.go @@ -14,12 +14,13 @@ See the License for the specific language governing permissions and limitations under the License. */ -package config +package webhook import ( - "github.com/jetstack/cert-manager/pkg/apis/config/webhook" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/jetstack/cert-manager/pkg/apis/config/webhook" ) var ( diff --git a/internal/apis/config/webhook/scheme/BUILD.bazel b/internal/apis/config/webhook/scheme/BUILD.bazel index d2b3fdd30..bb3921a3f 100644 --- a/internal/apis/config/webhook/scheme/BUILD.bazel +++ b/internal/apis/config/webhook/scheme/BUILD.bazel @@ -3,11 +3,11 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", srcs = ["scheme.go"], - importpath = "github.com/jetstack/cert-manager/internal/apis/config/scheme", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme", visibility = ["//:__subpackages__"], deps = [ - "//internal/apis/config:go_default_library", - "//internal/apis/config/v1alpha1:go_default_library", + "//internal/apis/config/webhook:go_default_library", + "//internal/apis/config/webhook/v1alpha1:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", ], diff --git a/internal/apis/config/webhook/scheme/scheme.go b/internal/apis/config/webhook/scheme/scheme.go index 3f301134a..e5b607768 100644 --- a/internal/apis/config/webhook/scheme/scheme.go +++ b/internal/apis/config/webhook/scheme/scheme.go @@ -20,8 +20,8 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/serializer" - "github.com/jetstack/cert-manager/internal/apis/config" - configv1alpha1 "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1" + config "github.com/jetstack/cert-manager/internal/apis/config/webhook" + configv1alpha1 "github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1" ) // NewSchemeAndCodecs is a utility function that returns a Scheme and CodecFactory diff --git a/internal/apis/config/webhook/types.go b/internal/apis/config/webhook/types.go index 2d9939ddf..4eac795fb 100644 --- a/internal/apis/config/webhook/types.go +++ b/internal/apis/config/webhook/types.go @@ -32,7 +32,7 @@ type WebhookConfiguration struct { HealthzPort *int // tlsConfig is used to configure the secure listener's TLS settings. - TLSConfig WebhookTLSConfig + TLSConfig TLSConfig // kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver. // If not specified, the webhook will attempt to load the in-cluster-config. @@ -50,9 +50,9 @@ type WebhookConfiguration struct { PprofAddress string } -// WebhookTLSConfig configures how TLS certificates are sourced for serving. +// TLSConfig configures how TLS certificates are sourced for serving. // Only one of 'filesystem' or 'dynamic' may be specified. -type WebhookTLSConfig struct { +type TLSConfig struct { // cipherSuites is the list of allowed cipher suites for the server. // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). // If not specified, the default for the Go version will be used and may change over time. @@ -65,7 +65,7 @@ type WebhookTLSConfig struct { // Filesystem enables using a certificate and private key found on the local filesystem. // These files will be periodically polled in case they have changed, and dynamically reloaded. - Filesystem WebhookFilesystemServingConfig + Filesystem FilesystemServingConfig // When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook // certificates and persist it into a Kubernetes Secret resource (for other replicas of the @@ -73,26 +73,26 @@ type WebhookTLSConfig struct { // It will then generate a certificate in-memory for itself using this CA to serve with. // The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion // webhook configuration objects (typically by cainjector). - Dynamic WebhookDynamicServingConfig + Dynamic DynamicServingConfig } -func (c *WebhookTLSConfig) FilesystemConfigProvided() bool { +func (c *TLSConfig) FilesystemConfigProvided() bool { if c.Filesystem.KeyFile != "" || c.Filesystem.CertFile != "" { return true } return false } -func (c *WebhookTLSConfig) DynamicConfigProvided() bool { +func (c *TLSConfig) DynamicConfigProvided() bool { if c.Dynamic.SecretNamespace != "" || c.Dynamic.SecretName != "" || len(c.Dynamic.DNSNames) > 0 { return true } return false } -// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. +// DynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. // This CA will be used by all instances of the webhook for signing serving certificates. -type WebhookDynamicServingConfig struct { +type DynamicServingConfig struct { // Namespace of the Kubernetes Secret resource containing the TLS certificate // used as a CA to sign dynamic serving certificates. SecretNamespace string @@ -105,9 +105,9 @@ type WebhookDynamicServingConfig struct { DNSNames []string } -// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem. +// FilesystemServingConfig enables using a certificate and private key found on the local filesystem. // These files will be periodically polled in case they have changed, and dynamically reloaded. -type WebhookFilesystemServingConfig struct { +type FilesystemServingConfig struct { // Path to a file containing TLS certificate & chain to serve with CertFile string diff --git a/internal/apis/config/webhook/v1alpha1/BUILD.bazel b/internal/apis/config/webhook/v1alpha1/BUILD.bazel index 486f4e54d..b9e93ab06 100644 --- a/internal/apis/config/webhook/v1alpha1/BUILD.bazel +++ b/internal/apis/config/webhook/v1alpha1/BUILD.bazel @@ -10,12 +10,12 @@ go_library( "zz_generated.conversion.go", "zz_generated.defaults.go", ], - importpath = "github.com/jetstack/cert-manager/internal/apis/config/v1alpha1", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/v1alpha1", visibility = ["//:__subpackages__"], deps = [ - "//internal/apis/config:go_default_library", - "//pkg/apis/config:go_default_library", - "//pkg/apis/config/v1alpha1:go_default_library", + "//internal/apis/config/webhook:go_default_library", + "//pkg/apis/config/webhook:go_default_library", + "//pkg/apis/config/webhook/v1alpha1:go_default_library", "@io_k8s_apimachinery//pkg/conversion:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", diff --git a/internal/apis/config/webhook/v1alpha1/defaults.go b/internal/apis/config/webhook/v1alpha1/defaults.go index 950a8a489..136ec1033 100644 --- a/internal/apis/config/webhook/v1alpha1/defaults.go +++ b/internal/apis/config/webhook/v1alpha1/defaults.go @@ -17,9 +17,10 @@ limitations under the License. package v1alpha1 import ( - "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/utils/pointer" + + "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" ) func addDefaultingFuncs(scheme *runtime.Scheme) error { diff --git a/internal/apis/config/webhook/v1alpha1/doc.go b/internal/apis/config/webhook/v1alpha1/doc.go index 4cb5b49c1..7271e6668 100644 --- a/internal/apis/config/webhook/v1alpha1/doc.go +++ b/internal/apis/config/webhook/v1alpha1/doc.go @@ -14,10 +14,10 @@ See the License for the specific language governing permissions and limitations under the License. */ -// +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config -// +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1 +// +k8s:conversion-gen=github.com/jetstack/cert-manager/internal/apis/config/webhook +// +k8s:conversion-gen-external-types=github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1 // +k8s:defaulter-gen=TypeMeta -// +k8s:defaulter-gen-input=../../../../pkg/apis/config/v1alpha1 +// +k8s:defaulter-gen-input=../../../../../pkg/apis/config/webhook/v1alpha1 -// +groupName=config.cert-manager.io +// +groupName=webhook.config.cert-manager.io package v1alpha1 diff --git a/internal/apis/config/webhook/v1alpha1/register.go b/internal/apis/config/webhook/v1alpha1/register.go index 102d7dacc..117d5699d 100644 --- a/internal/apis/config/webhook/v1alpha1/register.go +++ b/internal/apis/config/webhook/v1alpha1/register.go @@ -17,9 +17,10 @@ limitations under the License. package v1alpha1 import ( + "k8s.io/apimachinery/pkg/runtime/schema" + "github.com/jetstack/cert-manager/pkg/apis/config/webhook" "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" - "k8s.io/apimachinery/pkg/runtime/schema" ) // SchemeGroupVersion is group version used to register these objects diff --git a/internal/apis/config/webhook/validation/BUILD.bazel b/internal/apis/config/webhook/validation/BUILD.bazel index f6b482bbb..2b21a8ee8 100644 --- a/internal/apis/config/webhook/validation/BUILD.bazel +++ b/internal/apis/config/webhook/validation/BUILD.bazel @@ -3,10 +3,10 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", srcs = ["validation.go"], - importpath = "github.com/jetstack/cert-manager/internal/apis/config/validation", + importpath = "github.com/jetstack/cert-manager/internal/apis/config/webhook/validation", visibility = ["//:__subpackages__"], deps = [ - "//internal/apis/config:go_default_library", + "//internal/apis/config/webhook:go_default_library", "@io_k8s_apimachinery//pkg/util/errors:go_default_library", ], ) diff --git a/internal/apis/config/webhook/validation/validation.go b/internal/apis/config/webhook/validation/validation.go index 1ef8bb182..689aea827 100644 --- a/internal/apis/config/webhook/validation/validation.go +++ b/internal/apis/config/webhook/validation/validation.go @@ -21,7 +21,7 @@ import ( utilerrors "k8s.io/apimachinery/pkg/util/errors" - "github.com/jetstack/cert-manager/internal/apis/config" + config "github.com/jetstack/cert-manager/internal/apis/config/webhook" ) func ValidateWebhookConfiguration(cfg *config.WebhookConfiguration) error { diff --git a/pkg/apis/BUILD.bazel b/pkg/apis/BUILD.bazel index 012210456..92d78d3b3 100644 --- a/pkg/apis/BUILD.bazel +++ b/pkg/apis/BUILD.bazel @@ -20,7 +20,7 @@ filegroup( ":package-srcs", "//pkg/apis/acme:all-srcs", "//pkg/apis/certmanager:all-srcs", - "//pkg/apis/config:all-srcs", + "//pkg/apis/config/webhook:all-srcs", "//pkg/apis/experimental:all-srcs", "//pkg/apis/meta:all-srcs", ], diff --git a/pkg/apis/config/webhook/BUILD.bazel b/pkg/apis/config/webhook/BUILD.bazel index 08d473549..4faa3628d 100644 --- a/pkg/apis/config/webhook/BUILD.bazel +++ b/pkg/apis/config/webhook/BUILD.bazel @@ -3,7 +3,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library") go_library( name = "go_default_library", srcs = ["doc.go"], - importpath = "github.com/jetstack/cert-manager/pkg/apis/config", + importpath = "github.com/jetstack/cert-manager/pkg/apis/config/webhook", visibility = ["//visibility:public"], ) @@ -18,7 +18,7 @@ filegroup( name = "all-srcs", srcs = [ ":package-srcs", - "//pkg/apis/config/v1alpha1:all-srcs", + "//pkg/apis/config/webhook/v1alpha1:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/pkg/apis/config/webhook/doc.go b/pkg/apis/config/webhook/doc.go index 590999204..d90c90388 100644 --- a/pkg/apis/config/webhook/doc.go +++ b/pkg/apis/config/webhook/doc.go @@ -14,9 +14,9 @@ See the License for the specific language governing permissions and limitations under the License. */ -// +groupName=config.cert-manager.io +// +groupName=webhook.config.cert-manager.io -// Package config contains types used to configure cert-manager components -package config +// Package webhook contains types used to configure the webhook +package webhook -const GroupName = "config.cert-manager.io" +const GroupName = "webhook.config.cert-manager.io" diff --git a/pkg/apis/config/webhook/v1alpha1/BUILD.bazel b/pkg/apis/config/webhook/v1alpha1/BUILD.bazel index 4c8995b22..151a284e8 100644 --- a/pkg/apis/config/webhook/v1alpha1/BUILD.bazel +++ b/pkg/apis/config/webhook/v1alpha1/BUILD.bazel @@ -5,13 +5,13 @@ go_library( srcs = [ "doc.go", "register.go", - "types_webhook.go", + "types.go", "zz_generated.deepcopy.go", ], - importpath = "github.com/jetstack/cert-manager/pkg/apis/config/v1alpha1", + importpath = "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1", visibility = ["//visibility:public"], deps = [ - "//pkg/apis/config:go_default_library", + "//pkg/apis/config/webhook:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", "@io_k8s_apimachinery//pkg/runtime:go_default_library", "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library", diff --git a/pkg/apis/config/webhook/v1alpha1/doc.go b/pkg/apis/config/webhook/v1alpha1/doc.go index eb719f670..50a51f182 100644 --- a/pkg/apis/config/webhook/v1alpha1/doc.go +++ b/pkg/apis/config/webhook/v1alpha1/doc.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -// Package v1alpha1 is the v1alpha1 version of the API. +// Package v1alpha1 is the v1alpha1 version of the webhook config API. // +k8s:deepcopy-gen=package,register -// +groupName=config.cert-manager.io +// +groupName=webhook.config.cert-manager.io package v1alpha1 diff --git a/pkg/apis/config/webhook/v1alpha1/register.go b/pkg/apis/config/webhook/v1alpha1/register.go index 608f9d7c4..df9f247eb 100644 --- a/pkg/apis/config/webhook/v1alpha1/register.go +++ b/pkg/apis/config/webhook/v1alpha1/register.go @@ -21,11 +21,11 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" - "github.com/jetstack/cert-manager/pkg/apis/config" + "github.com/jetstack/cert-manager/pkg/apis/config/webhook" ) // SchemeGroupVersion is group version used to register these objects -var SchemeGroupVersion = schema.GroupVersion{Group: config.GroupName, Version: "v1alpha1"} +var SchemeGroupVersion = schema.GroupVersion{Group: webhook.GroupName, Version: "v1alpha1"} // Resource takes an unqualified resource and returns a Group qualified GroupResource func Resource(resource string) schema.GroupResource { diff --git a/pkg/apis/config/webhook/v1alpha1/types.go b/pkg/apis/config/webhook/v1alpha1/types.go index 20064b59f..441bcbd9d 100644 --- a/pkg/apis/config/webhook/v1alpha1/types.go +++ b/pkg/apis/config/webhook/v1alpha1/types.go @@ -32,7 +32,7 @@ type WebhookConfiguration struct { HealthzPort *int `json:"healthzPort,omitempty"` // tlsConfig is used to configure the secure listener's TLS settings. - TLSConfig WebhookTLSConfig `json:"tlsConfig"` + TLSConfig TLSConfig `json:"tlsConfig"` // kubeConfig is the kubeconfig file used to connect to the Kubernetes apiserver. // If not specified, the webhook will attempt to load the in-cluster-config. @@ -50,9 +50,9 @@ type WebhookConfiguration struct { PprofAddress string `json:"pprofAddress,omitempty"` } -// WebhookTLSConfig configures how TLS certificates are sourced for serving. +// TLSConfig configures how TLS certificates are sourced for serving. // Only one of 'filesystem' or 'dynamic' may be specified. -type WebhookTLSConfig struct { +type TLSConfig struct { // cipherSuites is the list of allowed cipher suites for the server. // Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). // If not specified, the default for the Go version will be used and may change over time. @@ -65,7 +65,7 @@ type WebhookTLSConfig struct { // Filesystem enables using a certificate and private key found on the local filesystem. // These files will be periodically polled in case they have changed, and dynamically reloaded. - Filesystem WebhookFilesystemServingConfig `json:"filesystem"` + Filesystem FilesystemServingConfig `json:"filesystem"` // When Dynamic serving is enabled, the webhook will generate a CA used to sign webhook // certificates and persist it into a Kubernetes Secret resource (for other replicas of the @@ -73,12 +73,12 @@ type WebhookTLSConfig struct { // It will then generate a certificate in-memory for itself using this CA to serve with. // The CAs certificate can then be copied into the appropriate Validating, Mutating and Conversion // webhook configuration objects (typically by cainjector). - Dynamic WebhookDynamicServingConfig `json:"dynamic"` + Dynamic DynamicServingConfig `json:"dynamic"` } -// WebhookDynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. +// DynamicServingConfig makes the webhook generate a CA and persist it into Secret resources. // This CA will be used by all instances of the webhook for signing serving certificates. -type WebhookDynamicServingConfig struct { +type DynamicServingConfig struct { // Namespace of the Kubernetes Secret resource containing the TLS certificate // used as a CA to sign dynamic serving certificates. SecretNamespace string `json:"secretNamespace,omitempty"` @@ -91,9 +91,9 @@ type WebhookDynamicServingConfig struct { DNSNames []string `json:"dnsNames,omitempty"` } -// WebhookFilesystemServingConfig enables using a certificate and private key found on the local filesystem. +// FilesystemServingConfig enables using a certificate and private key found on the local filesystem. // These files will be periodically polled in case they have changed, and dynamically reloaded. -type WebhookFilesystemServingConfig struct { +type FilesystemServingConfig struct { // Path to a file containing TLS certificate & chain to serve with CertFile string `json:"certFile,omitempty"` diff --git a/pkg/webhook/configfile/BUILD.bazel b/pkg/webhook/configfile/BUILD.bazel index 763c62dbc..643e89c2e 100644 --- a/pkg/webhook/configfile/BUILD.bazel +++ b/pkg/webhook/configfile/BUILD.bazel @@ -6,8 +6,8 @@ go_library( importpath = "github.com/jetstack/cert-manager/pkg/webhook/configfile", visibility = ["//visibility:public"], deps = [ - "//internal/apis/config:go_default_library", - "//internal/apis/config/scheme:go_default_library", + "//internal/apis/config/webhook:go_default_library", + "//internal/apis/config/webhook/scheme:go_default_library", "@io_k8s_apimachinery//pkg/runtime/serializer:go_default_library", ], ) diff --git a/pkg/webhook/configfile/configfile.go b/pkg/webhook/configfile/configfile.go index f7a31996d..65b874fcf 100644 --- a/pkg/webhook/configfile/configfile.go +++ b/pkg/webhook/configfile/configfile.go @@ -23,8 +23,8 @@ import ( "k8s.io/apimachinery/pkg/runtime/serializer" - "github.com/jetstack/cert-manager/internal/apis/config" - "github.com/jetstack/cert-manager/internal/apis/config/scheme" + config "github.com/jetstack/cert-manager/internal/apis/config/webhook" + "github.com/jetstack/cert-manager/internal/apis/config/webhook/scheme" ) // Filesystem is an interface used to mock out calls to ReadFile diff --git a/pkg/webhook/configfile/configfile_test.go b/pkg/webhook/configfile/configfile_test.go index 29e2019e6..475960b30 100644 --- a/pkg/webhook/configfile/configfile_test.go +++ b/pkg/webhook/configfile/configfile_test.go @@ -30,7 +30,7 @@ func TestFSLoader_Load(t *testing.T) { t.Fatalf("unexpected filename %q passed to ReadFile", filename) return nil, fmt.Errorf("unexpected filename %q", filename) } - return []byte(fmt.Sprintf(`apiVersion: config.cert-manager.io/v1alpha1 + return []byte(fmt.Sprintf(`apiVersion: webhook.config.cert-manager.io/v1alpha1 kind: WebhookConfiguration kubeConfig: %s`, kubeConfigPath)), nil }), expectedFilename) From ce3f3fc1f2d71077243a463a11d449294a9cffdb Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 26 Nov 2021 16:10:53 +0000 Subject: [PATCH 14/18] Regenerate files Signed-off-by: James Munnelly --- .../v1alpha1/zz_generated.conversion.go | 216 +++++++++--------- .../webhook/v1alpha1/zz_generated.defaults.go | 2 +- .../config/webhook/zz_generated.deepcopy.go | 122 +++++----- .../webhook/v1alpha1/zz_generated.deepcopy.go | 120 +++++----- 4 files changed, 230 insertions(+), 230 deletions(-) diff --git a/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go b/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go index 114d09f6d..bcbba6ce8 100644 --- a/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go +++ b/internal/apis/config/webhook/v1alpha1/zz_generated.conversion.go @@ -22,10 +22,10 @@ limitations under the License. package v1alpha1 import ( - "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" unsafe "unsafe" - config "github.com/jetstack/cert-manager/internal/apis/config" + webhook "github.com/jetstack/cert-manager/internal/apis/config/webhook" + v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" conversion "k8s.io/apimachinery/pkg/conversion" runtime "k8s.io/apimachinery/pkg/runtime" ) @@ -37,53 +37,133 @@ func init() { // RegisterConversions adds conversion functions to the given scheme. // Public to allow building arbitrary schemes. func RegisterConversions(s *runtime.Scheme) error { - if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookConfiguration)(nil), (*config.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(a.(*v1alpha1.WebhookConfiguration), b.(*config.WebhookConfiguration), scope) + if err := s.AddGeneratedConversionFunc((*v1alpha1.DynamicServingConfig)(nil), (*webhook.DynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig(a.(*v1alpha1.DynamicServingConfig), b.(*webhook.DynamicServingConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*config.WebhookConfiguration)(nil), (*v1alpha1.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(a.(*config.WebhookConfiguration), b.(*v1alpha1.WebhookConfiguration), scope) + if err := s.AddGeneratedConversionFunc((*webhook.DynamicServingConfig)(nil), (*v1alpha1.DynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig(a.(*webhook.DynamicServingConfig), b.(*v1alpha1.DynamicServingConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookDynamicServingConfig)(nil), (*config.WebhookDynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(a.(*v1alpha1.WebhookDynamicServingConfig), b.(*config.WebhookDynamicServingConfig), scope) + if err := s.AddGeneratedConversionFunc((*v1alpha1.FilesystemServingConfig)(nil), (*webhook.FilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig(a.(*v1alpha1.FilesystemServingConfig), b.(*webhook.FilesystemServingConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*config.WebhookDynamicServingConfig)(nil), (*v1alpha1.WebhookDynamicServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(a.(*config.WebhookDynamicServingConfig), b.(*v1alpha1.WebhookDynamicServingConfig), scope) + if err := s.AddGeneratedConversionFunc((*webhook.FilesystemServingConfig)(nil), (*v1alpha1.FilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig(a.(*webhook.FilesystemServingConfig), b.(*v1alpha1.FilesystemServingConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookFilesystemServingConfig)(nil), (*config.WebhookFilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(a.(*v1alpha1.WebhookFilesystemServingConfig), b.(*config.WebhookFilesystemServingConfig), scope) + if err := s.AddGeneratedConversionFunc((*v1alpha1.TLSConfig)(nil), (*webhook.TLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_TLSConfig_To_webhook_TLSConfig(a.(*v1alpha1.TLSConfig), b.(*webhook.TLSConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*config.WebhookFilesystemServingConfig)(nil), (*v1alpha1.WebhookFilesystemServingConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(a.(*config.WebhookFilesystemServingConfig), b.(*v1alpha1.WebhookFilesystemServingConfig), scope) + if err := s.AddGeneratedConversionFunc((*webhook.TLSConfig)(nil), (*v1alpha1.TLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_webhook_TLSConfig_To_v1alpha1_TLSConfig(a.(*webhook.TLSConfig), b.(*v1alpha1.TLSConfig), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookTLSConfig)(nil), (*config.WebhookTLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(a.(*v1alpha1.WebhookTLSConfig), b.(*config.WebhookTLSConfig), scope) + if err := s.AddGeneratedConversionFunc((*v1alpha1.WebhookConfiguration)(nil), (*webhook.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_WebhookConfiguration_To_webhook_WebhookConfiguration(a.(*v1alpha1.WebhookConfiguration), b.(*webhook.WebhookConfiguration), scope) }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*config.WebhookTLSConfig)(nil), (*v1alpha1.WebhookTLSConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(a.(*config.WebhookTLSConfig), b.(*v1alpha1.WebhookTLSConfig), scope) + if err := s.AddGeneratedConversionFunc((*webhook.WebhookConfiguration)(nil), (*v1alpha1.WebhookConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_webhook_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(a.(*webhook.WebhookConfiguration), b.(*v1alpha1.WebhookConfiguration), scope) }); err != nil { return err } return nil } -func autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *config.WebhookConfiguration, s conversion.Scope) error { +func autoConvert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig(in *v1alpha1.DynamicServingConfig, out *webhook.DynamicServingConfig, s conversion.Scope) error { + out.SecretNamespace = in.SecretNamespace + out.SecretName = in.SecretName + out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) + return nil +} + +// Convert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig is an autogenerated conversion function. +func Convert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig(in *v1alpha1.DynamicServingConfig, out *webhook.DynamicServingConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig(in, out, s) +} + +func autoConvert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig(in *webhook.DynamicServingConfig, out *v1alpha1.DynamicServingConfig, s conversion.Scope) error { + out.SecretNamespace = in.SecretNamespace + out.SecretName = in.SecretName + out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) + return nil +} + +// Convert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig is an autogenerated conversion function. +func Convert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig(in *webhook.DynamicServingConfig, out *v1alpha1.DynamicServingConfig, s conversion.Scope) error { + return autoConvert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig(in, out, s) +} + +func autoConvert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig(in *v1alpha1.FilesystemServingConfig, out *webhook.FilesystemServingConfig, s conversion.Scope) error { + out.CertFile = in.CertFile + out.KeyFile = in.KeyFile + return nil +} + +// Convert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig is an autogenerated conversion function. +func Convert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig(in *v1alpha1.FilesystemServingConfig, out *webhook.FilesystemServingConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig(in, out, s) +} + +func autoConvert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig(in *webhook.FilesystemServingConfig, out *v1alpha1.FilesystemServingConfig, s conversion.Scope) error { + out.CertFile = in.CertFile + out.KeyFile = in.KeyFile + return nil +} + +// Convert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig is an autogenerated conversion function. +func Convert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig(in *webhook.FilesystemServingConfig, out *v1alpha1.FilesystemServingConfig, s conversion.Scope) error { + return autoConvert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig(in, out, s) +} + +func autoConvert_v1alpha1_TLSConfig_To_webhook_TLSConfig(in *v1alpha1.TLSConfig, out *webhook.TLSConfig, s conversion.Scope) error { + out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) + out.MinTLSVersion = in.MinTLSVersion + if err := Convert_v1alpha1_FilesystemServingConfig_To_webhook_FilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { + return err + } + if err := Convert_v1alpha1_DynamicServingConfig_To_webhook_DynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { + return err + } + return nil +} + +// Convert_v1alpha1_TLSConfig_To_webhook_TLSConfig is an autogenerated conversion function. +func Convert_v1alpha1_TLSConfig_To_webhook_TLSConfig(in *v1alpha1.TLSConfig, out *webhook.TLSConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_TLSConfig_To_webhook_TLSConfig(in, out, s) +} + +func autoConvert_webhook_TLSConfig_To_v1alpha1_TLSConfig(in *webhook.TLSConfig, out *v1alpha1.TLSConfig, s conversion.Scope) error { + out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) + out.MinTLSVersion = in.MinTLSVersion + if err := Convert_webhook_FilesystemServingConfig_To_v1alpha1_FilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { + return err + } + if err := Convert_webhook_DynamicServingConfig_To_v1alpha1_DynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { + return err + } + return nil +} + +// Convert_webhook_TLSConfig_To_v1alpha1_TLSConfig is an autogenerated conversion function. +func Convert_webhook_TLSConfig_To_v1alpha1_TLSConfig(in *webhook.TLSConfig, out *v1alpha1.TLSConfig, s conversion.Scope) error { + return autoConvert_webhook_TLSConfig_To_v1alpha1_TLSConfig(in, out, s) +} + +func autoConvert_v1alpha1_WebhookConfiguration_To_webhook_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *webhook.WebhookConfiguration, s conversion.Scope) error { out.SecurePort = (*int)(unsafe.Pointer(in.SecurePort)) out.HealthzPort = (*int)(unsafe.Pointer(in.HealthzPort)) - if err := Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { + if err := Convert_v1alpha1_TLSConfig_To_webhook_TLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { return err } out.KubeConfig = in.KubeConfig @@ -93,15 +173,15 @@ func autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in return nil } -// Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration is an autogenerated conversion function. -func Convert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *config.WebhookConfiguration, s conversion.Scope) error { - return autoConvert_v1alpha1_WebhookConfiguration_To_config_WebhookConfiguration(in, out, s) +// Convert_v1alpha1_WebhookConfiguration_To_webhook_WebhookConfiguration is an autogenerated conversion function. +func Convert_v1alpha1_WebhookConfiguration_To_webhook_WebhookConfiguration(in *v1alpha1.WebhookConfiguration, out *webhook.WebhookConfiguration, s conversion.Scope) error { + return autoConvert_v1alpha1_WebhookConfiguration_To_webhook_WebhookConfiguration(in, out, s) } -func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { +func autoConvert_webhook_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *webhook.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { out.SecurePort = (*int)(unsafe.Pointer(in.SecurePort)) out.HealthzPort = (*int)(unsafe.Pointer(in.HealthzPort)) - if err := Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { + if err := Convert_webhook_TLSConfig_To_v1alpha1_TLSConfig(&in.TLSConfig, &out.TLSConfig, s); err != nil { return err } out.KubeConfig = in.KubeConfig @@ -111,87 +191,7 @@ func autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in return nil } -// Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration is an autogenerated conversion function. -func Convert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *config.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { - return autoConvert_config_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in, out, s) -} - -func autoConvert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in *v1alpha1.WebhookDynamicServingConfig, out *config.WebhookDynamicServingConfig, s conversion.Scope) error { - out.SecretNamespace = in.SecretNamespace - out.SecretName = in.SecretName - out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) - return nil -} - -// Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig is an autogenerated conversion function. -func Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in *v1alpha1.WebhookDynamicServingConfig, out *config.WebhookDynamicServingConfig, s conversion.Scope) error { - return autoConvert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(in, out, s) -} - -func autoConvert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in *config.WebhookDynamicServingConfig, out *v1alpha1.WebhookDynamicServingConfig, s conversion.Scope) error { - out.SecretNamespace = in.SecretNamespace - out.SecretName = in.SecretName - out.DNSNames = *(*[]string)(unsafe.Pointer(&in.DNSNames)) - return nil -} - -// Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig is an autogenerated conversion function. -func Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in *config.WebhookDynamicServingConfig, out *v1alpha1.WebhookDynamicServingConfig, s conversion.Scope) error { - return autoConvert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(in, out, s) -} - -func autoConvert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in *v1alpha1.WebhookFilesystemServingConfig, out *config.WebhookFilesystemServingConfig, s conversion.Scope) error { - out.CertFile = in.CertFile - out.KeyFile = in.KeyFile - return nil -} - -// Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig is an autogenerated conversion function. -func Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in *v1alpha1.WebhookFilesystemServingConfig, out *config.WebhookFilesystemServingConfig, s conversion.Scope) error { - return autoConvert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(in, out, s) -} - -func autoConvert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in *config.WebhookFilesystemServingConfig, out *v1alpha1.WebhookFilesystemServingConfig, s conversion.Scope) error { - out.CertFile = in.CertFile - out.KeyFile = in.KeyFile - return nil -} - -// Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig is an autogenerated conversion function. -func Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in *config.WebhookFilesystemServingConfig, out *v1alpha1.WebhookFilesystemServingConfig, s conversion.Scope) error { - return autoConvert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(in, out, s) -} - -func autoConvert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in *v1alpha1.WebhookTLSConfig, out *config.WebhookTLSConfig, s conversion.Scope) error { - out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) - out.MinTLSVersion = in.MinTLSVersion - if err := Convert_v1alpha1_WebhookFilesystemServingConfig_To_config_WebhookFilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { - return err - } - if err := Convert_v1alpha1_WebhookDynamicServingConfig_To_config_WebhookDynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { - return err - } - return nil -} - -// Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig is an autogenerated conversion function. -func Convert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in *v1alpha1.WebhookTLSConfig, out *config.WebhookTLSConfig, s conversion.Scope) error { - return autoConvert_v1alpha1_WebhookTLSConfig_To_config_WebhookTLSConfig(in, out, s) -} - -func autoConvert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in *config.WebhookTLSConfig, out *v1alpha1.WebhookTLSConfig, s conversion.Scope) error { - out.CipherSuites = *(*[]string)(unsafe.Pointer(&in.CipherSuites)) - out.MinTLSVersion = in.MinTLSVersion - if err := Convert_config_WebhookFilesystemServingConfig_To_v1alpha1_WebhookFilesystemServingConfig(&in.Filesystem, &out.Filesystem, s); err != nil { - return err - } - if err := Convert_config_WebhookDynamicServingConfig_To_v1alpha1_WebhookDynamicServingConfig(&in.Dynamic, &out.Dynamic, s); err != nil { - return err - } - return nil -} - -// Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig is an autogenerated conversion function. -func Convert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in *config.WebhookTLSConfig, out *v1alpha1.WebhookTLSConfig, s conversion.Scope) error { - return autoConvert_config_WebhookTLSConfig_To_v1alpha1_WebhookTLSConfig(in, out, s) +// Convert_webhook_WebhookConfiguration_To_v1alpha1_WebhookConfiguration is an autogenerated conversion function. +func Convert_webhook_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in *webhook.WebhookConfiguration, out *v1alpha1.WebhookConfiguration, s conversion.Scope) error { + return autoConvert_webhook_WebhookConfiguration_To_v1alpha1_WebhookConfiguration(in, out, s) } diff --git a/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go b/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go index f7e0b36e9..786446d27 100644 --- a/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go +++ b/internal/apis/config/webhook/v1alpha1/zz_generated.defaults.go @@ -22,7 +22,7 @@ limitations under the License. package v1alpha1 import ( - "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" + v1alpha1 "github.com/jetstack/cert-manager/pkg/apis/config/webhook/v1alpha1" runtime "k8s.io/apimachinery/pkg/runtime" ) diff --git a/internal/apis/config/webhook/zz_generated.deepcopy.go b/internal/apis/config/webhook/zz_generated.deepcopy.go index 4ea458478..862f4692d 100644 --- a/internal/apis/config/webhook/zz_generated.deepcopy.go +++ b/internal/apis/config/webhook/zz_generated.deepcopy.go @@ -19,12 +19,72 @@ limitations under the License. // Code generated by deepcopy-gen. DO NOT EDIT. -package config +package webhook import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *DynamicServingConfig) DeepCopyInto(out *DynamicServingConfig) { + *out = *in + if in.DNSNames != nil { + in, out := &in.DNSNames, &out.DNSNames + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DynamicServingConfig. +func (in *DynamicServingConfig) DeepCopy() *DynamicServingConfig { + if in == nil { + return nil + } + out := new(DynamicServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FilesystemServingConfig) DeepCopyInto(out *FilesystemServingConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FilesystemServingConfig. +func (in *FilesystemServingConfig) DeepCopy() *FilesystemServingConfig { + if in == nil { + return nil + } + out := new(FilesystemServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLSConfig) DeepCopyInto(out *TLSConfig) { + *out = *in + if in.CipherSuites != nil { + in, out := &in.CipherSuites, &out.CipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.Filesystem = in.Filesystem + in.Dynamic.DeepCopyInto(&out.Dynamic) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig. +func (in *TLSConfig) DeepCopy() *TLSConfig { + if in == nil { + return nil + } + out := new(TLSConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in @@ -60,63 +120,3 @@ func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { } return nil } - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookDynamicServingConfig) DeepCopyInto(out *WebhookDynamicServingConfig) { - *out = *in - if in.DNSNames != nil { - in, out := &in.DNSNames, &out.DNSNames - *out = make([]string, len(*in)) - copy(*out, *in) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookDynamicServingConfig. -func (in *WebhookDynamicServingConfig) DeepCopy() *WebhookDynamicServingConfig { - if in == nil { - return nil - } - out := new(WebhookDynamicServingConfig) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookFilesystemServingConfig) DeepCopyInto(out *WebhookFilesystemServingConfig) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookFilesystemServingConfig. -func (in *WebhookFilesystemServingConfig) DeepCopy() *WebhookFilesystemServingConfig { - if in == nil { - return nil - } - out := new(WebhookFilesystemServingConfig) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookTLSConfig) DeepCopyInto(out *WebhookTLSConfig) { - *out = *in - if in.CipherSuites != nil { - in, out := &in.CipherSuites, &out.CipherSuites - *out = make([]string, len(*in)) - copy(*out, *in) - } - out.Filesystem = in.Filesystem - in.Dynamic.DeepCopyInto(&out.Dynamic) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookTLSConfig. -func (in *WebhookTLSConfig) DeepCopy() *WebhookTLSConfig { - if in == nil { - return nil - } - out := new(WebhookTLSConfig) - in.DeepCopyInto(out) - return out -} diff --git a/pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go index 7f7818cd1..3faedb8d1 100644 --- a/pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/config/webhook/v1alpha1/zz_generated.deepcopy.go @@ -25,6 +25,66 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *DynamicServingConfig) DeepCopyInto(out *DynamicServingConfig) { + *out = *in + if in.DNSNames != nil { + in, out := &in.DNSNames, &out.DNSNames + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DynamicServingConfig. +func (in *DynamicServingConfig) DeepCopy() *DynamicServingConfig { + if in == nil { + return nil + } + out := new(DynamicServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FilesystemServingConfig) DeepCopyInto(out *FilesystemServingConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FilesystemServingConfig. +func (in *FilesystemServingConfig) DeepCopy() *FilesystemServingConfig { + if in == nil { + return nil + } + out := new(FilesystemServingConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLSConfig) DeepCopyInto(out *TLSConfig) { + *out = *in + if in.CipherSuites != nil { + in, out := &in.CipherSuites, &out.CipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.Filesystem = in.Filesystem + in.Dynamic.DeepCopyInto(&out.Dynamic) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig. +func (in *TLSConfig) DeepCopy() *TLSConfig { + if in == nil { + return nil + } + out := new(TLSConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration) { *out = *in @@ -60,63 +120,3 @@ func (in *WebhookConfiguration) DeepCopyObject() runtime.Object { } return nil } - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookDynamicServingConfig) DeepCopyInto(out *WebhookDynamicServingConfig) { - *out = *in - if in.DNSNames != nil { - in, out := &in.DNSNames, &out.DNSNames - *out = make([]string, len(*in)) - copy(*out, *in) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookDynamicServingConfig. -func (in *WebhookDynamicServingConfig) DeepCopy() *WebhookDynamicServingConfig { - if in == nil { - return nil - } - out := new(WebhookDynamicServingConfig) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookFilesystemServingConfig) DeepCopyInto(out *WebhookFilesystemServingConfig) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookFilesystemServingConfig. -func (in *WebhookFilesystemServingConfig) DeepCopy() *WebhookFilesystemServingConfig { - if in == nil { - return nil - } - out := new(WebhookFilesystemServingConfig) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WebhookTLSConfig) DeepCopyInto(out *WebhookTLSConfig) { - *out = *in - if in.CipherSuites != nil { - in, out := &in.CipherSuites, &out.CipherSuites - *out = make([]string, len(*in)) - copy(*out, *in) - } - out.Filesystem = in.Filesystem - in.Dynamic.DeepCopyInto(&out.Dynamic) - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookTLSConfig. -func (in *WebhookTLSConfig) DeepCopy() *WebhookTLSConfig { - if in == nil { - return nil - } - out := new(WebhookTLSConfig) - in.DeepCopyInto(out) - return out -} From d4beef13b80ac54fd14112dae984aec9564658f8 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 3 Dec 2021 12:56:26 +0000 Subject: [PATCH 15/18] Support configuring securePort in webhook service Signed-off-by: James Munnelly --- .../cert-manager/templates/webhook-deployment.yaml | 14 ++++++++++++++ .../cert-manager/templates/webhook-service.yaml | 2 +- deploy/charts/cert-manager/values.yaml | 9 +++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/deploy/charts/cert-manager/templates/webhook-deployment.yaml b/deploy/charts/cert-manager/templates/webhook-deployment.yaml index 6d0cf07a6..40005a024 100644 --- a/deploy/charts/cert-manager/templates/webhook-deployment.yaml +++ b/deploy/charts/cert-manager/templates/webhook-deployment.yaml @@ -79,11 +79,21 @@ spec: ports: - name: https protocol: TCP + {{- if $config.securePort }} + containerPort: {{ $config.securePort }} + {{- else if .Values.webhook.securePort }} containerPort: {{ .Values.webhook.securePort }} + {{- else }} + containerPort: 6443 + {{- end }} livenessProbe: httpGet: path: /livez + {{- if $config.healthzPort }} + port: {{ $config.healthzPort }} + {{- else }} port: 6080 + {{- end }} scheme: HTTP initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }} @@ -93,7 +103,11 @@ spec: readinessProbe: httpGet: path: /healthz + {{- if $config.healthzPort }} + port: {{ $config.healthzPort }} + {{- else }} port: 6080 + {{- end }} scheme: HTTP initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }} diff --git a/deploy/charts/cert-manager/templates/webhook-service.yaml b/deploy/charts/cert-manager/templates/webhook-service.yaml index c6a4f0a30..ca3f7152c 100644 --- a/deploy/charts/cert-manager/templates/webhook-service.yaml +++ b/deploy/charts/cert-manager/templates/webhook-service.yaml @@ -25,7 +25,7 @@ spec: - name: https port: 443 protocol: TCP - targetPort: {{ .Values.webhook.securePort }} + targetPort: "https" selector: app.kubernetes.io/name: {{ include "webhook.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index 6a4007153..a9540fff6 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -214,6 +214,15 @@ webhook: # apiVersion: config.webhook.cert-manager.io/v1alpha1 # kind: WebhookConfiguration + # The port that the webhook should listen on for requests. + # In GKE private clusters, by default kubernetes apiservers are allowed to + # talk to the cluster nodes only on 443 and 10250. so configuring + # securePort: 10250, will work out of the box without needing to add firewall + # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000. + # This should be uncommented and set as a default by the chart once we graduate + # the apiVersion of WebhookConfiguration past v1alpha1. + # securePort: 10250 + strategy: {} # type: RollingUpdate # rollingUpdate: From 17d6a19ba2909b30e2a8264019c3b78ae1bd2244 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 3 Dec 2021 12:56:34 +0000 Subject: [PATCH 16/18] Fix apiVersion of example config Signed-off-by: James Munnelly --- deploy/charts/cert-manager/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index a9540fff6..cd67218e8 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -211,7 +211,7 @@ webhook: # An APIVersion and Kind must be specified in your values.yaml file. # Flags will override options that are set here. config: - # apiVersion: config.webhook.cert-manager.io/v1alpha1 + # apiVersion: webhook.config.cert-manager.io/v1alpha1 # kind: WebhookConfiguration # The port that the webhook should listen on for requests. From 838a8dc153b93b174b3d62147c0a5dcc59023140 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 3 Dec 2021 13:03:57 +0000 Subject: [PATCH 17/18] Allow specifying minTLSVersion and cipherSuites without explicit tlsConfig Signed-off-by: James Munnelly --- deploy/charts/cert-manager/templates/webhook-deployment.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/deploy/charts/cert-manager/templates/webhook-deployment.yaml b/deploy/charts/cert-manager/templates/webhook-deployment.yaml index 40005a024..0de1df2f0 100644 --- a/deploy/charts/cert-manager/templates/webhook-deployment.yaml +++ b/deploy/charts/cert-manager/templates/webhook-deployment.yaml @@ -68,7 +68,8 @@ spec: {{ if not $config.securePort -}} - --secure-port={{ .Values.webhook.securePort }} {{- end }} - {{ if not $config.tlsConfig -}} + {{- $tlsConfig := default $config.tlsConfig "" }} + {{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}} - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - --dynamic-serving-ca-secret-name={{ template "webhook.fullname" . }}-ca - --dynamic-serving-dns-names={{ template "webhook.fullname" . }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }},{{ template "webhook.fullname" . }}.{{ .Release.Namespace }}.svc{{ if .Values.webhook.url.host }},{{ .Values.webhook.url.host }}{{ end }} From cfbd574e757653db428f5db9d3bea16fa79bc5ee Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Fri, 10 Dec 2021 12:53:00 +0000 Subject: [PATCH 18/18] Remove deprecation notice on webhook.securePort Signed-off-by: James Munnelly --- deploy/charts/cert-manager/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index cd67218e8..67edbd309 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -325,7 +325,6 @@ webhook: # talk to the cluster nodes only on 443 and 10250. so configuring # securePort: 10250, will work out of the box without needing to add firewall # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000 - # DEPRECATED: use webhook.config.securePort instead. securePort: 10250 # Specifies if the webhook should be started in hostNetwork mode.