Skip to content

fix: Inject custom ca and certificates #1359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
romachalm wants to merge 12 commits into from
Closed

fix: Inject custom ca and certificates #1359

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
afb4750
Add annotations to ValidatingWebhook and MutatingWebhook
Jun 11, 2021
efedbdc
Add certificateSecretname parameter to inject custom
Jun 11, 2021
729be26
Debug cert-manager reconciling loop
Jun 11, 2021
9182440
Parameter to disable auto generation of certificate
Jun 11, 2021
b977372
Fix typo in test for certificateSecret
Jun 11, 2021
9e94010
Disable cert-rotation when certificates.generate
Jun 11, 2021
5dc4203
Fix typo disable-cert-rotation
Jun 11, 2021
4e4b6b7
Add doc for cert-manager
Jun 11, 2021
aa68b84
Clean dead code
Jun 11, 2021
df2c16f
Merge branch 'master' into cabundle-managed-by-cert-manager
romachalm Jun 11, 2021
637ea84
Adjust parameter description
Jun 14, 2021
c48d90a
Merge branch 'cabundle-managed-by-cert-manager' of https://github.com…
Jun 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 34 additions & 27 deletions cmd/build/helmify/kustomize-for-helm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ spec:
- --exempt-namespace={{ .Release.Namespace }}
- --operation=webhook
- --enable-mutation={{ .Values.experimentalEnableMutation}}
- --disable-cert-rotation={{ not .Values.certificates.generate }}
- HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_DISABLED_BUILTIN
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
image: "{{ .Values.image.repository }}:{{ .Values.image.release }}"
Expand All @@ -80,6 +81,10 @@ spec:
HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_IMAGE_PULL_SECRETS: ""
hostNetwork: HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_HOST_NETWORK
priorityClassName: HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_PRIORITY_CLASS_NAME
volumes:
- name: cert
secret:
secretName: "{{ .Values.certificates.secretName }}"
---
apiVersion: apps/v1
kind: Deployment
Expand Down Expand Up @@ -133,29 +138,31 @@ metadata:
labels:
gatekeeper.sh/system: "yes"
name: gatekeeper-validating-webhook-configuration
annotations:
HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS: ""
webhooks:
- clientConfig:
service:
name: gatekeeper-webhook-service
namespace: gatekeeper-system
path: /v1/admit
name: validation.gatekeeper.sh
timeoutSeconds: HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT
rules:
- apiGroups:
- "*"
apiVersions:
- '*'
operations: HELMSUBST_VALIDATING_WEBHOOK_OPERATION_RULES
resources:
- '*'
- clientConfig:
service:
name: gatekeeper-webhook-service
namespace: gatekeeper-system
path: /v1/admitlabel
name: check-ignore-label.gatekeeper.sh
timeoutSeconds: HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT
- clientConfig:
service:
name: gatekeeper-webhook-service
namespace: gatekeeper-system
path: /v1/admit
name: validation.gatekeeper.sh
timeoutSeconds: HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT
rules:
- apiGroups:
- "*"
apiVersions:
- "*"
operations: HELMSUBST_VALIDATING_WEBHOOK_OPERATION_RULES
resources:
- "*"
- clientConfig:
service:
name: gatekeeper-webhook-service
namespace: gatekeeper-system
path: /v1/admitlabel
name: check-ignore-label.gatekeeper.sh
timeoutSeconds: HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
Expand All @@ -180,8 +187,8 @@ spec:
pods: HELMSUBST_RESOURCEQUOTA_POD_LIMIT
scopeSelector:
matchExpressions:
- operator: In
scopeName: PriorityClass
values:
- HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_PRIORITY_CLASS_NAME
- HELMSUBST_DEPLOYMENT_AUDIT_PRIORITY_CLASS_NAME
- operator: In
scopeName: PriorityClass
values:
- HELMSUBST_DEPLOYMENT_CONTROLLER_MANAGER_PRIORITY_CLASS_NAME
- HELMSUBST_DEPLOYMENT_AUDIT_PRIORITY_CLASS_NAME
4 changes: 4 additions & 0 deletions cmd/build/helmify/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,10 @@ func (ks *kindSet) Write() error {
obj = "{{- if .Values.experimentalEnableMutation }}\n" + obj + "{{- end }}\n"
}

if name == "gatekeeper-webhook-server-cert" && kind == "Secret" {
obj = "{{- if .Values.controllerManager.generateCertificate }}\n" + obj + "{{- end }}\n"
}

if kind == "Deployment" {
obj = strings.Replace(obj, " labels:", " labels:\n{{- include \"gatekeeper.podLabels\" . }}", 1)
}
Expand Down
4 changes: 4 additions & 0 deletions cmd/build/helmify/replacements.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,10 @@ var replacements = map[string]string{

"HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT": `{{ .Values.validatingWebhookTimeoutSeconds }}`,

`HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS: ""`: `{{- toYaml .Values.validatingWebhookAnnotations | trim | nindent 4 }}`,

`HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS: ""`: `{{- toYaml .Values.mutatingWebhookAnnotations | trim | nindent 4 }}`,

"HELMSUBST_RESOURCEQUOTA_POD_LIMIT": `{{ .Values.podCountLimit }}`,

"HELMSUBST_VALIDATING_WEBHOOK_OPERATION_RULES": `
Expand Down
16 changes: 10 additions & 6 deletions cmd/build/helmify/static/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,16 @@ _See [helm install](https://helm.sh/docs/helm/helm_install/) for command documen
**Upgrading from < v3.4.0**
Chart 3.4.0 deprecates support for Helm 2 and also removes the creation of the `gatekeeper-system` Namespace from within the chart. This follows Helm 3 Best Practices.

Option 1:
A simple way to upgrade is to uninstall first and re-install with 3.4.0 or greater.
Option 1:
A simple way to upgrade is to uninstall first and re-install with 3.4.0 or greater.

```console
$ helm uninstall gatekeeper
$ helm install -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper --create-namespace

```

Option 2:
Option 2:
Run the `helm_migrate.sh` script before installing the 3.4.0 or greater chart. This will remove the Helm secret for the original release, while keeping all of the resources. It then updates the annotations of the resources so that the new chart can import and manage them.

```console
Expand All @@ -63,7 +63,7 @@ _See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/websi
## Parameters

| Parameter | Description | Default |
| :--------------------------------------------| :--------------------------------------------------------------------------------------| :-------------------------------------------------------------------------|
| :------------------------------------------- | :------------------------------------------------------------------------------------- | :------------------------------------------------------------------------ |
| postInstall.labelNamespace.enabled | Add labels to the namespace during post install hooks | `true` |
| postInstall.labelNamespace.image.repository | Image with kubectl to label the namespace | `line/kubectl-kustomize` |
| postInstall.labelNamespace.image.tag | Image tag | `1.20.4-4.0.5` |
Expand All @@ -73,23 +73,27 @@ _See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/websi
| constraintViolationsLimit | The maximum # of audit violations reported on a constraint | `20` |
| auditFromCache | Take the roster of resources to audit from the OPA cache | `false` |
| auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `0` |
| auditMatchKindOnly | Only check resources of the kinds specified in all constraints defined in the cluster. | `false` |
| auditMatchKindOnly | Only check resources of the kinds specified in all constraints defined in the cluster. | `false` |
| disableValidatingWebhook | Disable the validating webhook | `false` |
| validatingWebhookTimeoutSeconds | The timeout for the validating webhook in seconds | `3` |
| validatingWebhookAnnotations | The annotations to add to the ValidatingWebhookConfiguration | `{}` |
| enableDeleteOperations | Enable validating webhook for delete operations | `false` |
| experimentalEnableMutation | Enable mutation (alpha feature) | `false` |
| mutatingWebhookAnnotations | The annotations to add to the MutatingWebhookConfiguration | `{}` |
| emitAdmissionEvents | Emit K8s events in gatekeeper namespace for admission violations (alpha feature) | `false` |
| emitAuditEvents | Emit K8s events in gatekeeper namespace for audit violations (alpha feature) | `false` |
| logDenies | Log detailed info on each deny | `false` |
| logLevel | Minimum log level | `INFO` |
| image.pullPolicy | The image pull policy | `IfNotPresent` |
| image.repository | Image repository | `openpolicyagent/gatekeeper` |
| image.release | The image release tag to use | Current release version: `v3.5.0-rc.1` |
| image.release | The image release tag to use | Current release version: `v3.5.0-rc.1` |
| image.pullSecrets | Specify an array of imagePullSecrets | `[]` |
| resources | The resource request/limits for the container image | limits: 1 CPU, 512Mi, requests: 100mCPU, 256Mi |
| nodeSelector | The node selector to use for pod scheduling | `kubernetes.io/os: linux` |
| affinity | The node affinity to use for pod scheduling | `{}` |
| tolerations | The tolerations to use for pod scheduling | `[]` |
| certificates.generate | Generates a secret named `gatekeeper-webhook-server-cert` with CA and certificate | `true` |
Comment thread
romachalm marked this conversation as resolved.
Outdated
| certificates.secretName | The name of the secret storing the certificate to be mounted in controller | `gatekeeper-webhook-server-cert` |
| controllerManager.priorityClassName | Priority class name for controller manager | `system-cluster-critical` |
| controllerManager.hostNetwork | Enables controllerManager to be deployed on hostNetwork | `false` |
| audit.priorityClassName | Priority class name for audit controller | `system-cluster-critical` |
Expand Down
5 changes: 5 additions & 0 deletions cmd/build/helmify/static/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ constraintViolationsLimit: 20
auditFromCache: false
disableValidatingWebhook: false
validatingWebhookTimeoutSeconds: 3
validatingWebhookAnnotations: {}
enableDeleteOperations: false
experimentalEnableMutation: false
mutatingWebhookAnnotations: {}
auditChunkSize: 0
logLevel: INFO
logDenies: false
Expand All @@ -30,6 +32,9 @@ podAnnotations:
podLabels: {}
podCountLimit: 100
secretAnnotations: {}
certificates:
generate: true
secretName: gatekeeper-webhook-server-cert
controllerManager:
hostNetwork: false
priorityClassName: system-cluster-critical
Expand Down
15 changes: 7 additions & 8 deletions config/overlays/mutation_webhook/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# TODO: this is a temporary kustomization for the mutation webhook
# It is kept separate until the mutation feature is stable enough,
# when the mutation webhook should be moved to config/webhooks/manifests.yaml
# when the mutation webhook should be moved to config/webhooks/manifests.yaml

namespace: gatekeeper-system

Expand All @@ -12,11 +12,10 @@ resources:
- mutations.gatekeeper.sh_assign.yaml
- mutations.gatekeeper.sh_assignmetadata.yaml


patchesJson6902:
- target:
group: rbac.authorization.k8s.io
version: v1
kind: ClusterRole
name: manager-role
path: webhook_permissions_patch.yaml
- target:
group: rbac.authorization.k8s.io
version: v1
kind: ClusterRole
name: manager-role
path: webhook_permissions_patch.yaml
46 changes: 24 additions & 22 deletions config/overlays/mutation_webhook/webhook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,26 +7,28 @@ kind: MutatingWebhookConfiguration
metadata:
creationTimestamp: null
name: gatekeeper-mutating-webhook-configuration
annotations:
HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS: ""

@maxsmythe maxsmythe Jun 18, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HELMSUBST_ stuff should go under /helmify/

webhooks:
- admissionReviewVersions:
- v1
- v1beta1
clientConfig:
service:
name: webhook-service
namespace: system
path: /v1/mutate
failurePolicy: Ignore
name: mutation.gatekeeper.sh
matchPolicy: Exact
rules:
- apiGroups:
- '*'
apiVersions:
- '*'
operations:
- CREATE
- UPDATE
resources:
- '*'
sideEffects: None
- admissionReviewVersions:
- v1
- v1beta1
clientConfig:
service:
name: webhook-service
namespace: system
path: /v1/mutate
failurePolicy: Ignore
name: mutation.gatekeeper.sh
matchPolicy: Exact
rules:
- apiGroups:
- "*"
apiVersions:
- "*"
operations:
- CREATE
- UPDATE
resources:
- "*"
sideEffects: None
Loading