Skip to content

Commit

Permalink
Gardener v1.87 (#410)
Browse files Browse the repository at this point in the history
  • Loading branch information
Gerrit91 authored Aug 5, 2024
1 parent 5be3df9 commit 21d5569
Show file tree
Hide file tree
Showing 16 changed files with 397 additions and 154 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
{{- printf "%s:%s" .repository .tag }}
{{- end }}
{{- end }}

{{- define "leaderelectionid" -}}
gardener-extension-admission-metal
{{- end -}}
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ spec:
template:
metadata:
annotations:
checksum/secret-gardener-extension-admission-metal-cert: {{ include (print $.Template.BasePath "/secret-cert.yaml") . | sha256sum }}
{{- if .Values.global.kubeconfig }}
checksum/gardener-extension-admission-metal-kubeconfig: {{ include (print $.Template.BasePath "/secret-kubeconfig.yaml") . | sha256sum }}
{{- end }}
Expand All @@ -37,11 +36,24 @@ spec:
- /gardener-extension-metal-hyper
- admission-metal
- --webhook-config-server-port={{ .Values.global.webhookConfig.serverPort }}
- --webhook-config-cert-dir=/etc/gardener-extension-admission-metal/srv
{{- if .Values.global.virtualGarden.enabled }}
- --webhook-config-mode=url
- --webhook-config-url={{ printf "%s.%s" (include "name" .) (.Release.Namespace) }}
{{- else }}
- --webhook-config-mode=service
{{- end }}
- --webhook-config-namespace={{ .Release.Namespace }}
{{- if .Values.global.kubeconfig }}
- --kubeconfig=/etc/gardener-extension-admission-metal/kubeconfig/kubeconfig
{{- end }}
{{- if .Values.global.projectedKubeconfig }}
- --kubeconfig={{ required ".Values.global.projectedKubeconfig.baseMountPath is required" .Values.global.projectedKubeconfig.baseMountPath }}/kubeconfig
{{- end }}
{{- if .Values.global.metricsPort }}
- --metrics-bind-address=:{{ .Values.global.metricsPort }}
{{- end }}
- --health-bind-address=:{{ .Values.global.healthPort }}
- --leader-election-id={{ include "leaderelectionid" . }}
livenessProbe:
httpGet:
path: /healthz
Expand All @@ -54,41 +66,37 @@ spec:
port: {{ .Values.global.healthPort }}
scheme: HTTP
initialDelaySeconds: 5
ports:
- name: webhook-server
containerPort: {{ .Values.global.webhookConfig.serverPort }}
protocol: TCP
livenessProbe:
tcpSocket:
port: {{ .Values.global.webhookConfig.serverPort }}
initialDelaySeconds: 5
periodSeconds: 10
env:
- name: LEADER_ELECTION_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- range $key, $value := .Values.global.defaulter }}
{{- if ne nil $value }}
- name: DEFAULTER_{{ upper $key }}
value: {{ $value | quote }}
- name: DEFAULTER_{{ upper $key }}
value: {{ $value | quote }}
{{- end }}
{{- end }}

# TODO: This is not yet working, maybe with Gardener Operator?
# {{- if .Values.global.virtualGarden.enabled }}
# - name: SOURCE_CLUSTER
# value: enabled
# {{- end }}
ports:
- name: webhook-server
containerPort: {{ .Values.global.webhookConfig.serverPort }}
protocol: TCP
{{- if .Values.global.resources }}
resources:
{{ toYaml .Values.global.resources | nindent 10 }}
{{- end }}
volumeMounts:
- name: gardener-extension-admission-metal-cert
mountPath: /etc/gardener-extension-admission-metal/srv
readOnly: true
{{- if .Values.global.kubeconfig }}
- name: gardener-extension-admission-metal-kubeconfig
mountPath: /etc/gardener-extension-admission-metal/kubeconfig
readOnly: true
{{- end }}
volumes:
- name: gardener-extension-admission-metal-cert
secret:
secretName: gardener-extension-admission-metal-cert
defaultMode: 420
{{- if .Values.global.kubeconfig }}
- name: gardener-extension-admission-metal-kubeconfig
secret:
Expand Down

This file was deleted.

Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "name" . }}
namespace: {{ .Release.Namespace }}
labels:
{{ include "labels" . | indent 4 }}
1 change: 1 addition & 0 deletions charts/gardener-extension-admission-metal/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ global:
pullPolicy: Always
replicaCount: 1
resources: {}
metricsPort: 8080
healthPort: 8081
vpa:
enabled: true
Expand Down
81 changes: 76 additions & 5 deletions cmd/gardener-extension-admission-metal/app/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package app
import (
"context"
"fmt"
"os"

admissioncmd "github.com/metal-stack/gardener-extension-provider-metal/pkg/admission/cmd"
metalinstall "github.com/metal-stack/gardener-extension-provider-metal/pkg/apis/metal/install"
Expand All @@ -12,27 +13,52 @@ import (
"github.com/gardener/gardener/extensions/pkg/util"
webhookcmd "github.com/gardener/gardener/extensions/pkg/webhook/cmd"
"github.com/gardener/gardener/pkg/apis/core/install"
v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
gardenerhealthz "github.com/gardener/gardener/pkg/healthz"
"github.com/spf13/cobra"
corev1 "k8s.io/api/core/v1"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/clientcmd"
componentbaseconfig "k8s.io/component-base/config"
"k8s.io/component-base/version/verflag"
"sigs.k8s.io/controller-runtime/pkg/cache"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/cluster"
"sigs.k8s.io/controller-runtime/pkg/healthz"
logf "sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/manager"
)

// AdmissionName is the name of the admission component.
const AdmissionName = "admission-metal"

var log = logf.Log.WithName("gardener-extension-admission-metal")

// NewAdmissionCommand creates a new command for running an metal admission webhook.
func NewAdmissionCommand(ctx context.Context) *cobra.Command {
var (
restOpts = &controllercmd.RESTOptions{}
mgrOpts = &controllercmd.ManagerOptions{
WebhookServerPort: 443,
HealthBindAddress: ":8081",
LeaderElection: true,
LeaderElectionID: controllercmd.LeaderElectionNameID(AdmissionName),
LeaderElectionNamespace: os.Getenv("LEADER_ELECTION_NAMESPACE"),
WebhookServerPort: 443,
MetricsBindAddress: ":8080",
HealthBindAddress: ":8081",
WebhookCertDir: "/tmp/admission-metal-cert",
}
// options for the webhook server
webhookServerOptions = &webhookcmd.ServerOptions{
Namespace: os.Getenv("WEBHOOK_CONFIG_NAMESPACE"),
}
webhookSwitches = admissioncmd.GardenWebhookSwitchOptions()
webhookOptions = webhookcmd.NewAddToManagerSimpleOptions(webhookSwitches)
webhookOptions = webhookcmd.NewAddToManagerOptions(
AdmissionName,
"",
nil,
webhookServerOptions,
webhookSwitches,
)

aggOption = controllercmd.NewOptionAggregator(
restOpts,
Expand All @@ -56,7 +82,33 @@ func NewAdmissionCommand(ctx context.Context) *cobra.Command {
Burst: 130,
}, restOpts.Completed().Config)

mgr, err := manager.New(restOpts.Completed().Config, mgrOpts.Completed().Options())
managerOptions := mgrOpts.Completed().Options()

// Operators can enable the source cluster option via SOURCE_CLUSTER environment variable.
// In-cluster config will be used if no SOURCE_KUBECONFIG is specified.
//
// The source cluster is for instance used by Gardener's certificate controller, to maintain certificate
// secrets in a different cluster ('runtime-garden') than the cluster where the webhook configurations
// are maintained ('virtual-garden').
var sourceClusterConfig *rest.Config
if sourceClusterEnabled := os.Getenv("SOURCE_CLUSTER"); sourceClusterEnabled != "" {
log.Info("Configuring source cluster option")
var err error
sourceClusterConfig, err = clientcmd.BuildConfigFromFlags("", os.Getenv("SOURCE_KUBECONFIG"))
if err != nil {
return err
}
managerOptions.LeaderElectionConfig = sourceClusterConfig
} else {
// Restrict the cache for secrets to the configured namespace to avoid the need for cluster-wide list/watch permissions.
managerOptions.Cache = cache.Options{
ByObject: map[client.Object]cache.ByObject{
&corev1.Secret{}: {Namespaces: map[string]cache.Config{webhookOptions.Server.Completed().Namespace: {}}},
},
}
}

mgr, err := manager.New(restOpts.Completed().Config, managerOptions)
if err != nil {
return fmt.Errorf("could not instantiate manager: %w", err)
}
Expand All @@ -67,8 +119,27 @@ func NewAdmissionCommand(ctx context.Context) *cobra.Command {
return fmt.Errorf("could not update manager scheme: %w", err)
}

var sourceCluster cluster.Cluster
if sourceClusterConfig != nil {
sourceCluster, err = cluster.New(sourceClusterConfig, func(opts *cluster.Options) {
opts.Logger = log
opts.Cache.DefaultNamespaces = map[string]cache.Config{v1beta1constants.GardenNamespace: {}}
})
if err != nil {
return err
}

if err := mgr.AddReadyzCheck("source-informer-sync", gardenerhealthz.NewCacheSyncHealthz(sourceCluster.GetCache())); err != nil {
return err
}

if err = mgr.Add(sourceCluster); err != nil {
return err
}
}

log.Info("Setting up webhook server")
if err := webhookOptions.Completed().AddToManager(mgr); err != nil {
if _, err := webhookOptions.Completed().AddToManager(ctx, mgr, sourceCluster); err != nil {
return err
}

Expand Down
2 changes: 1 addition & 1 deletion cmd/gardener-extension-provider-metal/app/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
workerCtrlOpts.Completed().Apply(&metalworker.DefaultAddOptions.Controller)
metalworker.DefaultAddOptions.GardenCluster = gardenCluster

atomicShootWebhookConfig, err := webhookOptions.Completed().AddToManager(ctx, mgr)
atomicShootWebhookConfig, err := webhookOptions.Completed().AddToManager(ctx, mgr, nil)
if err != nil {
return fmt.Errorf("could not add webhooks to manager: %w", err)
}
Expand Down
2 changes: 1 addition & 1 deletion example/controller-registration.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ providerConfig:
chart: H4sIAAAAAAAAA+0ca2/cNjKf9SsIuUXbQ6R9eO0EAnKoG7up7xJ7YfvSOxRFoJXoXcVaURUlO26a/37Dl0S9Vis7ddJGAwNeUZzhkJwZDodDLd3ExxFOLPwuxRENSGTFCbkOfCha49QNR4/uDWOAJ3t7/D9A9T//PdmdTaZ70/19Vj7Z3x3PHqG9+zfdDRlN3QShRwkh6aZ6Xe//orDsnP/nKzdJ7Vt3Hd61DTbB+7NZ6/xPd2fl+Z9C0fgRGn/MjrbBFz7/bhy8xgmbdwddTww3jvNHc2KPTcPH1EuCOOVFB+gnHK6Rx0QCXZIEpSuMXkgRQq+YvKC5FB+US5QRuWvsoE5RM65V02Mb2jY+9dh8CdCt/z7x7CW5Txtd+r+3+6Ri/5/MxnuD/j8EjEZL4iyZBLgpRnSFLA+Ztj2Cv2sc+SQZLYN0lS1sj6xHSliKHyvXuxopdMsjUZqQMATZSfAyoCmUgkTZQLYsVMhGX33ruSkSLb0+Ojs/Pj35Tj7id+46DvGojRxbi9Bz8XIeuhF2BNHj6DJxoVbmpVmiCn8myRVOxINpGKMRmgPP7hJLK4YjdxFiikrDkMUxkRZOFgbRkhs7jyQJ9lJU8IZKvBmxTv3zN2Hd+p9imAwYFXpnT7C3/zcd746ng//3ENBn/t+scBjDEm2ncS9fsMP+T6bT/cr8T/eng/1/EHj/3kI+vgwijEzmppnI+vDB6HbVGB6sD7y2oRMJ3QUOqQ2OpH2FbwU5/pAtcBJhkCM7ICPWVIlGC4lrN8wkT+/foyDywszPObWRRNzASB23yiCj4qCWGrJ93lK9F0EEwhN5mKPbZzjELsX2CTDXyFnOWrCGFUJwhhB7E1yilUvnCbx/h0y6cqd7+w40+5o1D02x+nbqLlGOESdBlF4i82v6/de0WjPBMaFBSpLbTSSgj7iJoHNngtBZrd/VCfFxHJLbNY5S6efnwkFHsPXQh+tTa8WXA33sP/g8l8Fy7cYWn/xr8INIYhGYzZskSHFrjKDL/5/t71bs/xNWNNj/BwBpfUpa/ZpP7KmaV2H7SmGCqyDyHeaCgzy8cmODSYrvpq4DlkBs9putdbPgSCQKrnODKeXFwsgIw+w0mHNG/g8oBFlO0YzVVuzwFumbspQ66A9GZGOvy+Q0o/app+yjwp30v2c0sEP/Z5NJ1f/bnewO+v8g8LEUO5eNP1WZRSu5CiMAy7L4f70jXHBtJcd2LtrUlgSU1NteSDIfvA83jFfuhBPKh0Du78VgZGJ/b1TspaTnhQHwCjUjMCJQTfQQ+K2UO7wUmPU8HLNyYCy9uI0x5UOV4N+yIME+Mjvo23UCKKA5vtnFXxO+ZJkPsirtyZWG2Y8dHTHn47e476gARr92GULe3iJLaNqzRY7Tr02BUl5SmqVq7Xor8JyP+Qqm+CwVcu1Jyf9YQGwjcuti1tzyJXTlxg3DY5iWJHJDsTMpmGh7v4GfVpKtrLGGdtCPx/99dQTDu4YVvIVbvEwwpYeYpkHEtTTns/5mA4cNZDbyhlPPVwpNwXWAgVaPTPNdSk+Uxay2BJi2RLHzmoUkAroLhjJIb7uxZUVNjF3vKosLTqi3wn4WtjMiEGxVT2fDx2HqnkduTFckneMkIH4XmQYURbEySH6WEFrwKQKxjfRVZzmGLSu2S29rddVU7CZpwGZY2PYNMlEmVcErxGMybZAP7lXOszCckzDwGqeyUqW9S3nFc+wlOIVOecTH/iHxrtQK9a/z05Na06K6GuQWrI2cdTf4d3WNvwjo4/8XAZx+G4DN/v9kMtmrnv/v7u4N5/8PArrbrCJxwgM+zGd7613An+L70xh7rOEEXweMz58CZpRvXwbrALy1MX8Tg/V0acmOycLnJItS0SgFXtgW35F+VOqtXm7Hx74goDRBEtAGhfv0UURS5WSolWbL8Eq+7K+wd0WztRZq40rYHDcpTcO3PICLvrIvJJf2DzDwczddIXOryJ35He+yCD4DDzpflZWthdWNW8M7MLsVWzC6LnCmRhiGKwk8teqfewkIeLQsLf4JgUornOUHEQ4yG+L3ZgsGZTQZTppkuKi0w+LcbhamSLLABiwmrJtBpB0XWwkIZLDGLdTZubPkp9yjOTuQ1rmqzYlSKlUhwukNSUCZa/vdlCguLBgeihMQBFD/MCQ32N8O3wcp74cRZwtQSEvW6Y2dBNcsxWArdPDjSZZ4MHh1QoBmgWtKUmqxw5xiAKzUi63ZbLeg3GEVnuZ+rbRQXC1gol3YdyX5RFhdJlMAV8zyzNfOXj58cGqvxQmMWabT4nUKjLjkb+b6TNZrUKRCfCw0anAOhDlawUY90WqWXQY9DwRoQpt6XUsaBOsyCPGzEewdRs1DIw3BSAv6VMmwVmKWAQLtvGMFXpYkMDdWgtkDNECflX1byVf+m2PbBeb5beRRfVxYSysMjv8Cu6mVL2/PNqxuTYhAG99YAdv8XsMIUcaf38pcjmdzvGOJdi6wqq0EpbyX/kNRxu8ajGAZEWiFxFiExKxi4WttgKOcKoyDHKFK+4Yn6/TvgcDr4vwGL0Dxr5T89ZzLCrY0Gsxe61zJWs/l9pFXkqa7RM0PKFugNFUpdU6+LqKQLBbxFlYTZD4222jJtpsI/SxftVCpuCnlJafUlnxlLcAIWq7vs5DJM6d1udrkQUgFCdNVOzXxvomR3DbJw2S907nVl+90XBxd6zZO2OaXRweHR2dvjl4ePb84Pj15c3Lw6uh8fvD8KK+JEE8F+BEWa0crZKEwHPpn+LJcKsuZR+PknqKdS9xd/UPF7/GrgxdHr4HZ07M3p6+Pzn4+O76o8eqgEU9C0w6/Ro2nYZsmKQyuYSQpnSdkgfU+rtI0flGEFgTEvL8jMWu/l19xx6ZzahmwSBTr5U8XF3PtRRAFaeCGhzh0b6UldNBknNdIsOsHvXllWLcPwuqeoTdA61KoLIywGhq53KmYVznbxtxwFzMlHgkddPF8Xo0w5c6SjpMXNsXGCow/UKQiYOOGCBiDaxJma/yKbcMauiyMqcbqmlUUatPtGtxXjdpOo5uYqamSVo/J0GkUgrPF9gTt6sTmJ/DwgecxwifdbuEOci8vmTDdOnkJEx//ALz3g4ZXKD+IOMxgi7U8F0Fd+HXM12BZfPQOe5l+ILUjx4W7ueeljbJ6yQeEbZqP3sXMTusb3aKGha7wbWs6VZ5wVcNDSDgU0Co6jhpec5PW0CBrcovkrTJaSmISkuXtvxmvZjmpa0VoyidC4ggBrrnzFQn01JGpbmS2PjFVILeQr4gPeLOpsm29xHs74e7Pb5eybOB9iA5/ttAn/gt2B9zJJOOXgRaZv8TbBYI773/MKvc/4MeT6RD/fQiQpmWZom9ZqKopevodmlRTwGIePhhdTxYgIipgPCf+YS4eP3Dx+Dwix7Cd/E/kXrtByLZCnDzNFp0dvnfE+K9g+vrof7JwvbtcBO3Qf9D6qv5PJ+Mng/4/BLD0KV2z+Ry7WboiSfC7uNJ09ZT7RUV2WAhjhpMzEuI++t1Hc5MsZB6XxbK6XiQki7n7ZSEtk6sc2TVKWxZWVaQjLDLvCqe0XjKCaU8z/QU0ngS4oaRclfITntKDXsETgyMftBhjQ4mO50eUhbkSv/qoVyoH6hrL9OoiKlb6XbwGD24hh4oZau78B1T8uGGWjv+K819ZDPOM61PSFmuvz4gIBft5aZkJ8x9mnbhHYAhkNo6Uwzpdvk5UqHmwJePeaa1X92xDlfNlSbyrBL+hKnvgSwfLGOQjXLeyeYi3eS7ahts0+T92VCtlUE1Qq+YKBH8d8D1b6baiXiEONO3SXmjnKm2jky/dtPI4gh2qGwa/KymE/UMktZHyvJJcK8RWSNaSB2dSFfJz6NrziHpuiCU5vrWm+oMr9tklxQTlw7UCFn6E/onyokbt1VuyED/AEy5+jGAnKQQ8S/lFURmU8fTEUVEddqSB31HHA7bIWo0wvzwTFG/lbHAHLNhKh2QioE3dmCtm4wwyzBqpHZFIazE/KrgMPNRmlmW1FKxmI3WV+1ca+JuAqUTf3ihSdr828yclcqqgLF1drat0sK7GebrYFvT8LRYyqKMvTcVjH1t+n5V0i6XpDgyApSJMfTfZFSCbglMegpap6sKSdI2r2J/UCTbsYNsXjj7LojBMIWYm+14e1Q/C3vxpjhU0IQ8r1JBt4NDIs+E1l6+DH9hZvYWVj5sJgXxeinp292ebjeCndpv/NtBn/yeX1d5bwI7933RvVs3/m+4P938eBhrv/0iN/fjRm1qO3DZJO5cJWbPMgNC3WCIQPztD3/zy3lTHWqZjXjyfm49N9s50tjse+/DrN/044IlDGPuWSACzQGzY8mHJbKESY1U+yofij6uc34kXdVq4iY+HGqB89i0VMpMcaDEzaLdy0lI6FwceBVETBqiGWGmPLWOAwPO4zF6cggdg8cUx57TIA4EhDFgWaeEbGeLQ6OL08NRBF6uAisWWbb8SAn41u/kDHiT4Q2AgfZ6IGBEUkmiJE2AHvHefZf+xD8dcZjy5Bp3xmyysaI1ciighEftf+7TO99cT+8ke+ywAWmAcgSfDNcq3+0mK8ISserd5mluTQN+J/kdTgrvEd1N+U036KMfsHL4I3G6X2ZsfyFvy8H822+XjUD4550eHfJR6HcR/ahu/Ce6w/stt9fZuQNf5z3Q2qaz/s+l4yP9/ENi0/iuP/ZMe4nzqAfqbQ7f+i8SL+3wAtEP/d8f7Vf0fz/aH858HAZF2ziMlKs3cQcuVlygHTYa5mnLBK5+EYmvj0kF8rWDb/FhLQj8Ib9xbahj6MauDJkYRn0HvPxiG5iI46On46dgoUu94wcQwtIxZ+UmA/ERF7CkqWcAi8a58TLKhYh6XF3Wa8q8dtMuyW8SRyqY229KeHXTphhQbRj3N10G//GpUknZ5mbGDmvJ+2GcQWFZTIO+D72gZQLGbUZFhzJMHDZH9JAb8TJ/u4guPhYOu/1yEZDFau8y9Gi2yIAQ3mpEeidugLI/fUMlnGlUhQ0tCliF+U9yLELiWu/b3ZxKNy425yz43KwryD8FO7MnEfvfX7tWk1ivzn89Yz6bihW3bhlHyHx1D5AqqhE/mjRo7O1CWsrMDyj9MKXXlMcL20kZU3XRa3CLu1BfXigBTKRYjDHTE5aj8opLC5S8NdRNb3Z2SSY2Gl7PW/FWLpm9awD6JqTurNHpLSaR0pfi+RGMN/uWHyVikkMnPMky4zpW/fsD0ovKFgMY7/6zeho8WiNfFdf7KPfXiKr8qUJfzBX+l+/b5bXtDZcXVb9AblSZKF+Hza/DCRIjC6oV1ZiwbrvocX55AI9B9zOOsjbfA2+6AG/lH/4T0YTkYysjLr6oM/tgAAwwwwAADDDDAAAMMMMAAAwwwwAADDDDAAAMMMMDnDf8HJasSEQB4AAA=
values:
image:
tag: v0.23.1
tag: v0.24.2
---
apiVersion: core.gardener.cloud/v1beta1
kind: ControllerRegistration
Expand Down
Loading

0 comments on commit 21d5569

Please sign in to comment.