Skip to content

Commit 4729341

Browse files
runkechengrunkecheng
committed
chart: Support webhook. #486
1. Use helm generated cert. (Default) 2. Use cert-manager. (Set certManager.enabled to true and make sure that cert-manager has been installed.) 3. Use Specified cert. (Fill in caBundlePEM, crtPEM, keyPEM.)
1 parent 36ad807 commit 4729341

File tree

6 files changed

+177
-0
lines changed

6 files changed

+177
-0
lines changed

‎charts/mysql-operator/templates/_helpers.tpl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,22 @@ If release name contains chart name it will be used as a full name.
2323
{{- end }}
2424
{{- end }}
2525

26+
{{- define "validating-webhook-configuration.name" -}}
27+
{{ default "radondb-mysql-validation" }}
28+
{{- end }}
29+
30+
{{- define "certificate.name" -}}
31+
{{ default "radondb-mysql-certificate" }}
32+
{{- end }}
33+
34+
{{- define "issuer.name" -}}
35+
{{ default "radondb-mysql-issuer" }}
36+
{{- end }}
37+
38+
{{- define "webhook.name" -}}
39+
{{ default "radondb-mysql-webhook" }}
40+
{{- end }}
41+
2642
{{/*
2743
Create chart name and version as used by the chart label.
2844
*/}}

‎charts/mysql-operator/templates/cert.tpl

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{{- define "webhook.caBundleCertPEM" -}}
2+
{{- if .Values.webhook.caBundlePEM -}}
3+
{{- trim .Values.webhook.caBundlePEM -}}
4+
{{- else -}}
5+
{{- /* Generate ca with CN "radondb-ca" and 5 years validity duration if not exists in the current scope.*/ -}}
6+
{{- $caKeypair := .selfSignedCAKeypair | default (genCA "radondb-ca" 1825) -}}
7+
{{- $_ := set . "selfSignedCAKeypair" $caKeypair -}}
8+
{{- $caKeypair.Cert -}}
9+
{{- end -}}
10+
{{- end -}}
11+
12+
{{- define "webhook.certPEM" -}}
13+
{{- if .Values.webhook.crtPEM -}}
14+
{{- trim .Values.webhook.crtPEM -}}
15+
{{- else -}}
16+
{{- $webhookDomain := printf "%s.%s.svc" (include "webhook.name" .) .Release.Namespace -}}
17+
{{- $webhookDomainLocal := printf "%s.%s.svc.cluster.local" (include "webhook.name" .) .Release.Namespace -}}
18+
{{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
19+
{{- /* genSignedCert <CN> <IP> <DNS> <Validity duration> <CA> */ -}}
20+
{{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert "radondb-mysql" nil (list $webhookDomain $webhookDomainLocal) 1825 $webhookCA) -}}
21+
{{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
22+
{{- $webhookServerTLSKeypair.Cert -}}
23+
{{- end -}}
24+
{{- end -}}
25+
26+
{{- define "webhook.keyPEM" -}}
27+
{{- if .Values.webhook.keyPEM -}}
28+
{{ trim .Values.webhook.keyPEM }}
29+
{{- else -}}
30+
{{- $webhookDomain := printf "%s.%s.svc" (include "webhook.name" .) .Release.Namespace -}}
31+
{{- $webhookDomainLocal := printf "%s.%s.svc.cluster.local" (include "webhook.name" .) .Release.Namespace -}}
32+
{{- $webhookCA := required "self-signed CA keypair is requried" .selfSignedCAKeypair -}}
33+
{{- /* genSignedCert <CN> <IP> <DNS> <Validity duration> <CA> */ -}}
34+
{{- $webhookServerTLSKeypair := .webhookTLSKeypair | default (genSignedCert "radondb-mysql" nil (list $webhookDomain $webhookDomainLocal) 1825 $webhookCA) -}}
35+
{{- $_ := set . "webhookTLSKeypair" $webhookServerTLSKeypair -}}
36+
{{- $webhookServerTLSKeypair.Key -}}
37+
{{- end -}}
38+
{{- end -}}

‎charts/mysql-operator/templates/cert_manager.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if .Values.webhook.certManager.enabled }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: {{ template "issuer.name" . }}
6+
namespace: {{ .Release.Namespace }}
7+
spec:
8+
selfSigned: {}
9+
---
10+
apiVersion: cert-manager.io/v1
11+
kind: Certificate
12+
metadata:
13+
name: {{ template "certificate.name" . }}
14+
namespace: {{ .Release.Namespace }}
15+
spec:
16+
dnsNames:
17+
- {{ printf "%s.%s.svc" (include "webhook.name" .) .Release.Namespace }}
18+
- {{ printf "%s.%s.svc.cluster.local" (include "webhook.name" .) .Release.Namespace }}
19+
issuerRef:
20+
kind: Issuer
21+
name: {{ template "issuer.name" . }}
22+
secretName: "{{ template "webhook.name" . }}-certs"
23+
{{- end }}

‎charts/mysql-operator/templates/deployment.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ spec:
2121
spec:
2222
securityContext:
2323
runAsNonRoot: true
24+
volumes:
25+
- name: cert
26+
secret:
27+
defaultMode: 420
28+
secretName: "{{ template "webhook.name" . }}-certs"
2429
containers:
2530
{{- if .Values.rbacProxy.create }}
2631
- name: kube-rbac-proxy
@@ -39,6 +44,14 @@ spec:
3944
name: https
4045
{{- end }}
4146
- name: manager
47+
ports:
48+
- containerPort: 9443
49+
name: webhook-server
50+
protocol: TCP
51+
volumeMounts:
52+
- name: cert
53+
mountPath: /tmp/k8s-webhook-server/serving-certs/
54+
readOnly: true
4255
command:
4356
- /manager
4457
args:
@@ -54,6 +67,8 @@ spec:
5467
env:
5568
- name: IMAGE_PREFIX
5669
value: {{ .Values.imagePrefix }}
70+
- name: ENABLED_WEBHOOKS
71+
value: {{ .Values.manager.enabledWebhooks | quote }}
5772
securityContext:
5873
allowPrivilegeEscalation: false
5974
livenessProbe:

‎charts/mysql-operator/templates/webhook_configuration.yaml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{{- $certManagerEnabled := .Values.webhook.certManager.enabled -}}
2+
{{- $caCertPEM := include "webhook.caBundleCertPEM" . -}}
3+
{{- $tlsCertPEM := include "webhook.certPEM" . -}}
4+
{{- $tlsKeyPEM := include "webhook.keyPEM" . -}}
5+
6+
apiVersion: admissionregistration.k8s.io/v1
7+
kind: ValidatingWebhookConfiguration
8+
metadata:
9+
creationTimestamp: null
10+
name: {{ template "validating-webhook-configuration.name" . }}
11+
{{- if $certManagerEnabled }}
12+
annotations:
13+
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ template "certificate.name" . }}"
14+
{{- end }}
15+
webhooks:
16+
- admissionReviewVersions:
17+
- v1
18+
clientConfig:
19+
{{- if $certManagerEnabled }}
20+
caBundle: Cg==
21+
{{- else }}
22+
caBundle: {{ ternary (b64enc $caCertPEM) (b64enc (trim $tlsCertPEM)) (empty $tlsKeyPEM) }}
23+
{{- end }}
24+
service:
25+
name: {{ template "webhook.name" .}}
26+
namespace: {{ .Release.Namespace }}
27+
## path is generated by controller-runtime.
28+
## https://github.com/kubernetes-sigs/controller-runtime/blob/master/pkg/builder/webhook.go#L206
29+
path: /validate-mysql-radondb-com-v1alpha1-mysqlcluster
30+
failurePolicy: Fail
31+
name: vmysqlcluster.kb.io
32+
rules:
33+
- apiGroups:
34+
- mysql.radondb.com
35+
apiVersions:
36+
- v1alpha1
37+
operations:
38+
- CREATE
39+
- UPDATE
40+
resources:
41+
- mysqlclusters
42+
sideEffects: None
43+
---
44+
45+
apiVersion: v1
46+
kind: Service
47+
metadata:
48+
name: {{ template "webhook.name" .}}
49+
namespace: {{ .Release.Namespace }}
50+
spec:
51+
ports:
52+
- port: 443
53+
protocol: TCP
54+
targetPort: 9443
55+
selector:
56+
app: {{ template "mysql-operator.name" . }}
57+
58+
---
59+
{{- if not $certManagerEnabled }}
60+
kind: Secret
61+
apiVersion: v1
62+
metadata:
63+
name: {{ template "webhook.name" . }}-certs
64+
namespace: {{ .Release.Namespace | quote }}
65+
labels:
66+
{{- include "mysql-operator.labels" . | nindent 4 }}
67+
app.kubernetes.io/component: webhook-secret
68+
type: Opaque
69+
data:
70+
ca.crt: {{ b64enc $caCertPEM }}
71+
tls.crt: {{ b64enc $tlsCertPEM }}
72+
tls.key: {{ b64enc $tlsKeyPEM }}
73+
{{- end }}

‎charts/mysql-operator/values.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ tolerationSeconds: 30
2222
manager:
2323
image: radondb/mysql-operator
2424
tag: v2.2.0
25+
enabledWebhooks: true
2526
resources: {}
2627
# We usually recommend not to specify default resources and to leave this as a conscious
2728
# choice for the user. This also increases chances charts run on environments with little
@@ -86,3 +87,14 @@ nfsBackup:
8687
localPVCapacity: 50G
8788
hostName: ""
8889
hostPath: "/mnt/radondb-nfs-backup"
90+
91+
webhook:
92+
certManager:
93+
# If true, make sure that cert-manager has been installed.
94+
enabled: false
95+
# If empty and disable certManager, Helm will auto-generate these fields.
96+
caBundlePEM: |
97+
98+
crtPEM: |
99+
100+
keyPEM: |

0 commit comments

Comments
 (0)