Skip to content

Admission Webhooks for OLM #884

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ecordell wants to merge 7 commits into from
Closed

Admission Webhooks for OLM #884

ecordell wants to merge 7 commits into from

Conversation

@ecordell
Copy link
Member

@ecordell ecordell commented Jun 3, 2019 •
edited
Loading

Description of the change:
This adds an admission webhook to OLM that:

  • Detects when a user is creating a CSV
  • Processes the CSV for the required RBAC
  • Checks if the user has enough permission to have created the RBAC directly
  • If so, creates the RBAC for the CSV

Directly applying a CSV and CRD will result in the CSV transitioning past Pending and into running states.

If the RBAC generation fails for some reason, the CSV status will explain exactly which rbac rules still need to be filled.

The processing is done asynchronously and doesn't block storage of the CSV by etcd.

The webhook requires TLS certs coordinated with the kube apiserver. For this PR, the webhook is only enabled when running locally, and certs are generated at that time. Upstream deployments should probably integrate with cert-manager, and OpenShift deployments should use service-ca-signer (this work is coming).

Motivation for the change:

It can be frustrating to iterate on CSVs if you have to syncronize rbac between CSV and standard roles/rolebindings.

This also restores the older behavior of OLM, which

Reviewer Checklist

  • Implementation matches the proposed design, or proposal is updated to match implementation
  • Sufficient unit test coverage
  • Sufficient end-to-end test coverage
  • Docs updated or added to /docs
  • Commit messages sensible and descriptive

@openshift-ci-robot openshift-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 3, 2019
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Jun 3, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ecordell

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 3, 2019
@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 17, 2019
@openshift-ci-robot openshift-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 11, 2019
@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 11, 2019
njhale
njhale reviewed Oct 29, 2019
View reviewed changes
Copy link
Member

@njhale njhale left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this. A few preliminary comments:

@estroz estroz mentioned this pull request Oct 30, 2019
Closed
5 tasks
@openshift-ci-robot openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 31, 2019
@ecordell ecordell changed the title WIP: Admission Webhooks for OLM Admission Webhooks for OLM Oct 31, 2019
@openshift-ci-robot openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 31, 2019
@ecordell ecordell force-pushed the admctrl branch 2 times, most recently from 2fb1bd5 to a82855d Compare October 31, 2019 13:36
@ecordell
Copy link
Member Author

ecordell commented Oct 31, 2019

/retest

1 similar comment
@ecordell
Copy link
Member Author

ecordell commented Oct 31, 2019

/retest

@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Nov 1, 2019 •
edited
Loading

@ecordell: The following tests failed, say /retest to rerun them all:

Test name Commit Details Rerun command
ci/prow/schema-check 7a48eec link /test schema-check
ci/prow/e2e-aws 7a48eec link /test e2e-aws
ci/prow/e2e-aws-upgrade 7a48eec link /test e2e-aws-upgrade
ci/prow/e2e-gcp-upgrade 1af1132 link /test e2e-gcp-upgrade
ci/prow/e2e-aws-console-olm 1af1132 link /test e2e-aws-console-olm

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@awgreene
Copy link
Member

awgreene commented Feb 20, 2020

Closing this in favor of #1102

@awgreene awgreene closed this Feb 20, 2020
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Feb 20, 2020

@ecordell: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 20, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@njhale njhale njhale left review comments

@alecmerdler alecmerdler Awaiting requested review from alecmerdler

@jpeeler jpeeler Awaiting requested review from jpeeler

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@ecordell @openshift-ci-robot @awgreene @njhale