Skip to content

Commit e81b09c

Browse files
jabellardjabellard
committed
Add webhooks
Signed-off-by: Joe Nathan Abellard <[email protected]>
1 parent 10a5f0f commit e81b09c

File tree

14 files changed

+309
-77
lines changed

14 files changed

+309
-77
lines changed

‎charts/karmada-operator/templates/karmada-operator-deployment.yaml‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ metadata:
55
namespace: {{ .Release.Namespace }}
66
labels: {{- include "common.labels.standard" . | nindent 4 }}
77
app: {{ include "karmada.operator.fullname" . }}
8-
{{- if .Values.commonLabels }}
9-
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
8+
{{- if .Values.operator.labels }}
9+
{{- include "common.tplvalues.render" ( dict "value" .Values.operator.labels "context" $ ) | nindent 4 }}
1010
{{- end }}
11-
{{- if .Values.commonAnnotations }}
12-
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
11+
{{- if .Values.operator.annotations }}
12+
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.operator.annotations "context" $ ) | nindent 4 }}
1313
{{- end }}
1414
spec:
1515
replicas: {{ .Values.operator.replicaCount }}
@@ -27,33 +27,40 @@ spec:
2727
{{- end }}
2828
labels: {{- include "common.labels.standard" . | nindent 8 }}
2929
app: {{ include "karmada.operator.fullname" . }}
30-
{{- if .Values.podLabels }}
30+
{{- if .Values.operator.podLabels }}
3131
{{- include "common.tplvalues.render" (dict "value" .Values.operator.podLabels "context" $) | nindent 8 }}
3232
{{- end }}
3333
spec:
3434
{{- include "karmada.operator.imagePullSecrets" . | indent 6 }}
3535
containers:
36-
- name: {{ include "karmada.operator.fullname" . }}
37-
image: {{ template "karmada.operator.image" . }}
38-
imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
39-
ports:
40-
- containerPort: 8080
41-
name: metrics
42-
protocol: TCP
43-
command:
44-
- /bin/karmada-operator
45-
- --leader-elect-resource-namespace={{ .Release.Namespace }}
46-
- --v=2
36+
- name: {{ include "karmada.operator.fullname" . }}
37+
image: {{ template "karmada.operator.image" . }}
38+
imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
39+
ports:
40+
- containerPort: 8080
41+
name: metrics
42+
protocol: TCP
43+
- containerPort: 9443
44+
name: webhook
45+
protocol: TCP
46+
command:
47+
- /bin/karmada-operator
48+
- --leader-elect-resource-namespace={{ .Release.Namespace }}
49+
- --v=2
4750
{{- range .Values.operator.extraArgs }}
48-
- {{ . }}
51+
- {{ . }}
4952
{{- end }}
5053
{{- with .Values.operator.env }}
51-
env:
54+
env:
5255
{{- toYaml . | nindent 10 }}
5356
{{- end }}
5457
{{- if .Values.operator.resources }}
55-
resources: {{- toYaml .Values.operator.resources | nindent 12 }}
58+
resources: {{- toYaml .Values.operator.resources | nindent 12 }}
5659
{{- end }}
60+
volumeMounts:
61+
- name: karmada-operator-webhook-cert
62+
mountPath: /tmp/k8s-webhook-server/serving-certs
63+
readOnly: true
5764
serviceAccountName: {{ include "karmada.operator.fullname" . }}
5865
{{- if .Values.operator.affinity }}
5966
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.operator.affinity "context" $) | nindent 8 }}
@@ -64,3 +71,7 @@ spec:
6471
{{- if .Values.operator.tolerations }}
6572
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.operator.tolerations "context" $) | nindent 8 }}
6673
{{- end }}
74+
volumes:
75+
- name: karmada-operator-webhook-cert
76+
secret:
77+
secretName: karmada-operator-webhook-cert

‎charts/karmada-operator/templates/webhook-cert.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: karmada-operator-webhook-cert
6+
namespace: {{ .Release.Namespace }}
7+
spec:
8+
selfSigned: {}
9+
---
10+
apiVersion: cert-manager.io/v1
11+
kind: Certificate
12+
metadata:
13+
name: karmada-operator-webhook-cert
14+
namespace: {{ .Release.Namespace }}
15+
spec:
16+
secretName: karmada-operator-webhook-cert
17+
issuerRef:
18+
kind: Issuer
19+
name: karmada-operator-webhook-cert
20+
dnsNames:
21+
- karmada-operator-webhook
22+
- karmada-operator-webhook.{{ .Release.Namespace }}
23+
- karmada-operator-webhook.{{ .Release.Namespace }}.svc
24+
- karmada-operator-webhook.{{ .Release.Namespace }}.svc.cluster.local
25+
26+

‎charts/karmada-operator/templates/webhook-configs.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
apiVersion: admissionregistration.k8s.io/v1
3+
kind: MutatingWebhookConfiguration
4+
metadata:
5+
name: karmada-mutating-webhook-configuration
6+
annotations:
7+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/karmada-operator-webhook-cert
8+
webhooks:
9+
- name: karmada-v1alpha1.kb.io
10+
admissionReviewVersions: ["v1"]
11+
clientConfig:
12+
service:
13+
name: karmada-operator-webhook
14+
namespace: {{ .Release.Namespace }}
15+
path: /mutate-operator-karmada-io-v1alpha1-karmada
16+
failurePolicy: Fail
17+
sideEffects: None
18+
rules:
19+
- apiGroups: ["operator.karmada.io"]
20+
apiVersions: ["v1alpha1"]
21+
operations: ["CREATE","UPDATE"]
22+
resources: ["karmadas"]
23+
---
24+
apiVersion: admissionregistration.k8s.io/v1
25+
kind: ValidatingWebhookConfiguration
26+
metadata:
27+
name: karmada-validating-webhook-configuration
28+
annotations:
29+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/karmada-operator-webhook-cert
30+
webhooks:
31+
- name: karmada-v1alpha1.kb.io
32+
admissionReviewVersions: ["v1"]
33+
clientConfig:
34+
service:
35+
name: karmada-operator-webhook
36+
namespace: {{ .Release.Namespace }}
37+
path: /validate-operator-karmada-io-v1alpha1-karmada
38+
failurePolicy: Fail
39+
sideEffects: None
40+
rules:
41+
- apiGroups: ["operator.karmada.io"]
42+
apiVersions: ["v1alpha1"]
43+
operations: ["CREATE","UPDATE"]
44+
resources: ["karmadas"]
45+

‎charts/karmada-operator/templates/webhook-service.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: karmada-operator-webhook
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
app: {{ include "karmada.operator.fullname" . }}
9+
spec:
10+
type: ClusterIP
11+
ports:
12+
- name: webhook
13+
port: 443
14+
targetPort: webhook
15+
protocol: TCP
16+
selector:
17+
app: {{ include "karmada.operator.fullname" . }}
18+

‎charts/karmada-operator/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ kubectl:
3939
operator:
4040
## @param operator.labels
4141
labels: {}
42+
## @param operator.annotations Operator deployment annotations
43+
annotations: {}
4244
## @param operator.replicaCount target replicas
4345
replicaCount: 1
4446
## @param operator.podAnnotations

‎hack/deploy-karmada-operator.sh‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,14 @@ kind load docker-image "${REGISTRY}/karmada-operator:${VERSION}" --name="${CONTE
6060
# create namespace `karmada-system`
6161
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f "${REPO_ROOT}/artifacts/deploy/namespace.yaml"
6262

63-
# install Karmada operator crds
64-
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f operator/config/crds/
63+
# deploy karmada-operator using Helm
64+
echo "Installing Karmada operator using Helm"
65+
cd "${REPO_ROOT}/charts/karmada-operator"
66+
helm repo add bitnami https://charts.bitnami.com/bitnami
67+
helm dependency build
68+
helm --kubeconfig "${KUBECONFIG}" --kube-context "${CONTEXT_NAME}" install --namespace ${KARMADA_SYSTEM_NAMESPACE} karmada-operator .
69+
cd -
6570

66-
# deploy karmada-operator
67-
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f "${REPO_ROOT}/operator/config/deploy/karmada-operator-clusterrole.yaml"
68-
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f "${REPO_ROOT}/operator/config/deploy/karmada-operator-clusterrolebinding.yaml"
69-
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f "${REPO_ROOT}/operator/config/deploy/karmada-operator-serviceaccount.yaml"
70-
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" apply -f "${REPO_ROOT}/operator/config/deploy/karmada-operator-deployment.yaml"
71-
72-
# wait karmada-operator ready
71+
# Await Karmada operator ready status
7372
kubectl --kubeconfig="${KUBECONFIG}" --context="${CONTEXT_NAME}" wait --for=condition=Ready --timeout=30s pods -l app.kubernetes.io/name=karmada-operator -n ${KARMADA_SYSTEM_NAMESPACE}
73+
echo "Successfully installed Karmada operator using Helm."

‎hack/local-up-karmada-by-operator.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ OPERATOR_POD_NAME=$(kubectl --kubeconfig="${MAIN_KUBECONFIG}" --context="${HOST_
8888
kubectl --kubeconfig="${MAIN_KUBECONFIG}" --context="${HOST_CLUSTER_NAME}" exec -i ${OPERATOR_POD_NAME} -n ${KARMADA_SYSTEM_NAMESPACE} -- mkdir -p ${CRD_CACHE_DIR}
8989
kubectl --kubeconfig="${MAIN_KUBECONFIG}" --context="${HOST_CLUSTER_NAME}" cp ${REPO_ROOT}/crds.tar.gz ${KARMADA_SYSTEM_NAMESPACE}/${OPERATOR_POD_NAME}:${CRD_CACHE_DIR}
9090

91+
echo "Installing cert-manager in host cluster"
92+
kubectl --kubeconfig="${MAIN_KUBECONFIG}" --context="${HOST_CLUSTER_NAME}" apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.19.0/cert-manager.yaml
93+
9194
# step3.3 install karmada instance
9295
"${REPO_ROOT}"/hack/deploy-karmada-by-operator.sh "${MAIN_KUBECONFIG}" "${HOST_CLUSTER_NAME}" "${KARMADA_APISERVER_CLUSTER_NAME}" "latest" true "${CRDTARBALL_URL}"
9396

‎hack/setup-dev-base.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,15 @@ else
8282
util::install_kubectl "" "${BS_ARCH}" "${BS_OS}"
8383
fi
8484

85+
# install helm
86+
echo -n "Preparing: 'helm' existence check - "
87+
if util::cmd_exist helm; then
88+
echo "passed"
89+
else
90+
echo "installing helm"
91+
util::install_helm
92+
fi
93+
8594
#step1. create host cluster and member clusters in parallel
8695
# host IP address: script parameter ahead of WSL2 or macOS IP
8796
if [[ -z "${HOST_IPADDRESS}" ]]; then
@@ -114,6 +123,7 @@ if [[ -n "${HOST_IPADDRESS}" ]]; then # If bind the port of clusters(karmada-hos
114123
else
115124
util::create_cluster "${HOST_CLUSTER_NAME}" "${MAIN_KUBECONFIG}" "${CLUSTER_VERSION}" "${KIND_LOG_FILE}"
116125
fi
126+
117127
util::create_cluster "${MEMBER_CLUSTER_1_NAME}" "${MEMBER_CLUSTER_1_TMP_CONFIG}" "${CLUSTER_VERSION}" "${KIND_LOG_FILE}" "${TEMP_PATH}"/member1.yaml
118128
util::create_cluster "${MEMBER_CLUSTER_2_NAME}" "${MEMBER_CLUSTER_2_TMP_CONFIG}" "${CLUSTER_VERSION}" "${KIND_LOG_FILE}" "${TEMP_PATH}"/member2.yaml
119129
util::create_cluster "${PULL_MODE_CLUSTER_NAME}" "${PULL_MODE_CLUSTER_TMP_CONFIG}" "${CLUSTER_VERSION}" "${KIND_LOG_FILE}" "${TEMP_PATH}"/member3.yaml
@@ -137,6 +147,9 @@ util::check_clusters_ready "${MEMBER_CLUSTER_1_TMP_CONFIG}" "${MEMBER_CLUSTER_1_
137147
util::check_clusters_ready "${MEMBER_CLUSTER_2_TMP_CONFIG}" "${MEMBER_CLUSTER_2_NAME}"
138148
util::check_clusters_ready "${PULL_MODE_CLUSTER_TMP_CONFIG}" "${PULL_MODE_CLUSTER_NAME}"
139149

150+
echo "Installing cert-manager in host cluster..."
151+
kubectl --kubeconfig="${MAIN_KUBECONFIG}" --context="${HOST_CLUSTER_NAME}" apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.19.0/cert-manager.yaml
152+
140153
#step4. load components images to kind cluster
141154
if [[ "${BUILD_FROM_SOURCE}" == "true" ]]; then
142155
# host cluster

‎operator/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ This section describes how to install `karmada-operator` and create a Karmada in
1919
- Kubernetes 1.16+
2020
- Helm v3+
2121

22+
### Install `cert-manager`
23+
24+
`cert-manager` is used to provision and manage the certificate for the operator's webhook server. Please follow [these instructions](https://cert-manager.io/docs/installation/) to download `cert-manager` on the host cluster
25+
where the Karmada operator is to be installed.
26+
2227
### Deploy `karmada-operator`
2328

2429
#### Helm install

‎operator/cmd/operator/app/operator.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3939

4040
"github.com/karmada-io/karmada/operator/cmd/operator/app/options"
41+
"github.com/karmada-io/karmada/operator/internal/webhook/v1alpha1"
4142
operatorv1alpha1 "github.com/karmada-io/karmada/operator/pkg/apis/operator/v1alpha1"
4243
ctrlctx "github.com/karmada-io/karmada/operator/pkg/controller/context"
4344
"github.com/karmada-io/karmada/operator/pkg/controller/karmada"
@@ -79,6 +80,13 @@ func NewOperatorCommand(ctx context.Context) *cobra.Command {
7980
return err
8081
}
8182
logs.InitLogs()
83+
84+
// Starting from version 0.15.0, controller-runtime expects its consumers to set a logger through log.SetLogger.
85+
// If SetLogger is not called within the first 30 seconds of a binaries lifetime, it will get
86+
// set to a NullLogSink and report an error. Here's to silence the "log.SetLogger(...) was never called; logs will not be displayed" error
87+
// by setting a logger through log.SetLogger.
88+
// More info refer to: https://github.com/karmada-io/karmada/pull/4885.
89+
controllerruntime.SetLogger(klog.Background())
8290
return nil
8391
},
8492
RunE: func(_ *cobra.Command, _ []string) error {
@@ -116,6 +124,13 @@ func Run(ctx context.Context, o *options.Options) error {
116124
return err
117125
}
118126

127+
klog.Info("Registering admission webhooks with the controller manager")
128+
err = v1alpha1.SetupKarmadaWebhookWithManager(manager)
129+
if err != nil {
130+
klog.Errorf("Failed to setup karmada-operator webhook: %v", err)
131+
return err
132+
}
133+
119134
if err := manager.AddHealthzCheck("ping", healthz.Ping); err != nil {
120135
klog.Errorf("Failed to add health check endpoint: %v", err)
121136
return err

0 commit comments

Comments
 (0)