feat: add webhook

Dockerfile

@@ -11,7 +11,7 @@ COPY go.sum go.sum
 RUN go mod download
 
 COPY cmd/main.go cmd/main.go
-COPY internal/controller/ internal/controller/
+COPY internal/ internal/
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
 

Makefile

@@ -243,26 +243,31 @@ mv $(1) $(1)-$(3) ;\
 ln -sf $(1)-$(3) $(1)
 endef
 
-HELM_DEPENDS ?= commons-operator listener-operator secret-operator
 TEST_NAMESPACE = kubedoop-operators
+HELM_DEPENDS ?= ""
+
 
 .PHONY: helm-install-depends
 helm-install-depends: helm ## Install the helm chart depends.
-	$(HELM) repo add kubedoop https://zncdatadev.github.io/kubedoop-helm-charts/
-ifneq ($(strip $(HELM_DEPENDS)),)
-	for dep in $(HELM_DEPENDS); do \
-		$(HELM) upgrade --install --create-namespace --namespace $(TEST_NAMESPACE) --wait $$dep kubedoop/$$dep --version $(VERSION); \
-	done
-endif
+	# install cert-manage
+	KUBECONFIG=$(KIND_KUBECONFIG) kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml
+	@if [ ! -z "$(strip $(HELM_DEPENDS))" ]; then \
+		$(HELM) repo add kubedoop https://zncdatadev.github.io/kubedoop-helm-charts/; \
+		for dep in $(HELM_DEPENDS); do \
+			$(HELM) upgrade --install --create-namespace --namespace $(TEST_NAMESPACE) --wait $$dep kubedoop/$$dep --version $(VERSION); \
+		done; \
+	fi
 
 ## helm uninstall depends
 .PHONY: helm-uninstall-depends
 helm-uninstall-depends: helm ## Uninstall the helm chart depends.
-ifneq ($(strip $(HELM_DEPENDS)),)
-	for dep in $(HELM_DEPENDS); do \
-		$(HELM) uninstall --namespace $(TEST_NAMESPACE) $$dep; \
-	done
-endif
+	# uninstall cert-manage
+	KUBECONFIG=$(KIND_KUBECONFIG) kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml
+	@if [ ! -z "$(strip $(HELM_DEPENDS))" ]; then \
+		for dep in $(HELM_DEPENDS); do \
+			$(HELM) uninstall --namespace $(TEST_NAMESPACE) $$dep; \
+		done; \
+	fi
 
 ##@ Chainsaw-E2E
 
@@ -313,7 +318,7 @@ $(CHAINSAW): $(LOCALBIN)
 	}
 
 .PHONY: chainsaw-setup
-chainsaw-setup: docker-build ## Run the chainsaw setup
+chainsaw-setup: docker-build helm-install-depends ## Run the chainsaw setup
 	$(KIND) --name $(KIND_CLUSTER) load docker-image $(IMG)
 	KUBECONFIG=$(KIND_KUBECONFIG) $(MAKE) deploy
 

PROJECT

@@ -16,24 +16,39 @@ resources:
   domain: kubedoop.dev
   group: authentication
   kind: AuthenticationClass
-  path: github.com/zncdatadev/commons-operator/api/authentication/v1alpha1
+  path: github.com/zncdatadev/operator-go/pkg/apis/authentication/v1alpha1
+  # path: github.com/zncdatadev/commons-operator/api/authentication/v1alpha1
   version: v1alpha1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: kubedoop.dev
   group: s3
   kind: S3Connection
-  path: github.com/zncdatadev/commons-operator/api/s3/v1alpha1
+  path: github.com/zncdatadev/operator-go/pkg/apis/s3/v1alpha1
+  # path: github.com/zncdatadev/commons-operator/api/s3/v1alpha1
   version: v1alpha1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: kubedoop.dev
   group: s3
   kind: S3Bucket
-  path: github.com/zncdatadev/commons-operator/api/s3/v1alpha1
+  path: github.com/zncdatadev/operator-go/pkg/apis/s3/v1alpha1
+  # path: github.com/zncdatadev/commons-operator/api/s3/v1alpha1
   version: v1alpha1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 version: "3"

cmd/main.go

@@ -25,6 +25,8 @@ import (
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	authenticationv1alpha1 "github.com/zncdatadev/operator-go/pkg/apis/authentication/v1alpha1"
+	s3v1alpha1 "github.com/zncdatadev/operator-go/pkg/apis/s3/v1alpha1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -37,13 +39,9 @@ import (
 
 	"github.com/zncdatadev/commons-operator/internal/controller/pod_enrichment"
 	"github.com/zncdatadev/commons-operator/internal/controller/restart"
-
+	webhookauthenticationv1alpha1 "github.com/zncdatadev/commons-operator/internal/webhook/authentication/v1alpha1"
+	webhooks3v1alpha1 "github.com/zncdatadev/commons-operator/internal/webhook/s3/v1alpha1"
 	// +kubebuilder:scaffold:imports
-
-	// Now we need to import the constants package to fix olm bundle generate error
-	// later refactoring with constants feature, we will use it.
-	_ "github.com/zncdatadev/operator-go/pkg/apis/authentication/v1alpha1"
-	_ "github.com/zncdatadev/operator-go/pkg/apis/s3/v1alpha1"
 )
 
 var (
@@ -53,6 +51,9 @@ var (
 
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(authenticationv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(s3v1alpha1.AddToScheme(scheme))
+
 	// +kubebuilder:scaffold:scheme
 
 }
@@ -171,6 +172,27 @@ func main() {
 		os.Exit(1)
 	}
 
+	// nolint:goconst
+	if os.Getenv("ENABLE_WEBHOOKS") != "false" {
+		if err = webhookauthenticationv1alpha1.SetupAuthenticationClassWebhookWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create webhook", "webhook", "AuthenticationClass")
+			os.Exit(1)
+		}
+	}
+	// nolint:goconst
+	if os.Getenv("ENABLE_WEBHOOKS") != "false" {
+		if err = webhooks3v1alpha1.SetupS3ConnectionWebhookWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create webhook", "webhook", "S3Connection")
+			os.Exit(1)
+		}
+	}
+	// nolint:goconst
+	if os.Getenv("ENABLE_WEBHOOKS") != "false" {
+		if err = webhooks3v1alpha1.SetupS3BucketWebhookWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create webhook", "webhook", "S3Bucket")
+			os.Exit(1)
+		}
+	}
 	// +kubebuilder:scaffold:builder
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		setupLog.Error(err, "unable to set up health check")

config/certmanager/certificate.yaml

@@ -0,0 +1,35 @@
+# The following manifests contain a self-signed issuer CR and a certificate CR.
+# More document can be found at https://docs.cert-manager.io
+# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  labels:
+    app.kubernetes.io/name: commons-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: selfsigned-issuer
+  namespace: system
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    app.kubernetes.io/name: certificate
+    app.kubernetes.io/instance: serving-cert
+    app.kubernetes.io/component: certificate
+    app.kubernetes.io/created-by: commons-operator
+    app.kubernetes.io/part-of: commons-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
+  namespace: system
+spec:
+  # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
+  dnsNames:
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: selfsigned-issuer
+  secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

config/certmanager/kustomization.yaml

@@ -0,0 +1,5 @@
+resources:
+- certificate.yaml
+
+configurations:
+- kustomizeconfig.yaml

config/certmanager/kustomizeconfig.yaml

@@ -0,0 +1,8 @@
+# This configuration is for teaching kustomize how to update name ref substitution
+nameReference:
+- kind: Issuer
+  group: cert-manager.io
+  fieldSpecs:
+  - kind: Certificate
+    group: cert-manager.io
+    path: spec/issuerRef/name