Skip to content

Commit 41e2c58

Browse files
camilamacedo86camilamacedo86
committed
fix ca injection - wip
1 parent b4119cc commit 41e2c58

File tree

47 files changed

+1230
-230
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+1230
-230
lines changed

‎.github/workflows/test-e2e-samples.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@ jobs:
4141
run: |
4242
KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml"
4343
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
44-
sed -i '50,177s/^#//' $KUSTOMIZATION_FILE_PATH
44+
# Uncomment all cert-manager injections
45+
sed -i '50,172s/^#//' $KUSTOMIZATION_FILE_PATH
46+
sed -i '174,198s/^#//' $KUSTOMIZATION_FILE_PATH
4547
cd testdata/project-v4/
4648
go mod tidy
4749
@@ -81,9 +83,12 @@ jobs:
8183
KUSTOMIZATION_FILE_PATH="testdata/project-v4-with-plugins/config/default/kustomization.yaml"
8284
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
8385
# Uncomment only ValidatingWebhookConfiguration
84-
# from cert-manager replaces
85-
sed -i '50,116s/^#//' $KUSTOMIZATION_FILE_PATH
86-
sed -i '148,177s/^#//' $KUSTOMIZATION_FILE_PATH
86+
# from cert-manager replaces; we are leaving defaulting uncommented
87+
# since this sample has no defaulting webhooks
88+
sed -i '50,155s/^#//' $KUSTOMIZATION_FILE_PATH
89+
# Uncomment only --conversion webhooks CA injection
90+
sed -i '144,163s/^#//' $KUSTOMIZATION_FILE_PATH
91+
sed -i '165,180s/^#//' $KUSTOMIZATION_FILE_PATH
8792
cd testdata/project-v4-with-plugins/
8893
go mod tidy
8994

‎docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,10 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
1915
#configurations:

‎docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -151,27 +151,13 @@ replacements:
151151
# version: v1
152152
# name: serving-cert # This name should match the one in certificate.yaml
153153
# fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
# targets:
155-
# - select:
156-
# kind: CustomResourceDefinition
157-
# fieldPaths:
158-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
159-
# options:
160-
# delimiter: '/'
161-
# index: 0
162-
# create: true
154+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163156
# - source:
164157
# kind: Certificate
165158
# group: cert-manager.io
166159
# version: v1
167160
# name: serving-cert # This name should match the one in certificate.yaml
168161
# fieldPath: .metadata.name
169-
# targets:
170-
# - select:
171-
# kind: CustomResourceDefinition
172-
# fieldPaths:
173-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
174-
# options:
175-
# delimiter: '/'
176-
# index: 1
177-
# create: true
162+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
163+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,10 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
1915
#configurations:

‎docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -151,27 +151,13 @@ patches:
151151
# version: v1
152152
# name: serving-cert # This name should match the one in certificate.yaml
153153
# fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
# targets:
155-
# - select:
156-
# kind: CustomResourceDefinition
157-
# fieldPaths:
158-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
159-
# options:
160-
# delimiter: '/'
161-
# index: 0
162-
# create: true
154+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163156
# - source:
164157
# kind: Certificate
165158
# group: cert-manager.io
166159
# version: v1
167160
# name: serving-cert # This name should match the one in certificate.yaml
168161
# fieldPath: .metadata.name
169-
# targets:
170-
# - select:
171-
# kind: CustomResourceDefinition
172-
# fieldPaths:
173-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
174-
# options:
175-
# delimiter: '/'
176-
# index: 1
177-
# create: true
162+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
163+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,11 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable the webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
- path: patches/webhook_in_cronjobs.yaml
1212
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1313

14-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
15-
# patches here are for enabling the CA injection for each CRD
16-
#- path: patches/cainjection_in_cronjobs.yaml
17-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
18-
1914
# [WEBHOOK] To enable webhook, uncomment the following section
2015
# the following config is for teaching kustomize how to do kustomization for CRDs.
2116
configurations:

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -144,34 +144,38 @@ replacements:
144144
delimiter: '/'
145145
index: 1
146146
create: true
147-
147+
#
148148
- source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
149149
kind: Certificate
150150
group: cert-manager.io
151151
version: v1
152152
name: serving-cert # This name should match the one in certificate.yaml
153153
fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
targets:
154+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155155
- select:
156156
kind: CustomResourceDefinition
157+
name: cronjobs.batch.tutorial.kubebuilder.io
157158
fieldPaths:
158159
- .metadata.annotations.[cert-manager.io/inject-ca-from]
159160
options:
160161
delimiter: '/'
161162
index: 0
162163
create: true
164+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163165
- source:
164166
kind: Certificate
165167
group: cert-manager.io
166168
version: v1
167169
name: serving-cert # This name should match the one in certificate.yaml
168170
fieldPath: .metadata.name
169-
targets:
171+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
170172
- select:
171173
kind: CustomResourceDefinition
174+
name: cronjobs.batch.tutorial.kubebuilder.io
172175
fieldPaths:
173176
- .metadata.annotations.[cert-manager.io/inject-ca-from]
174177
options:
175178
delimiter: '/'
176179
index: 1
177180
create: true
181+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/reference/markers/scaffold.md

Lines changed: 70 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -95,17 +95,76 @@ properly registered with the manager, so that the controller can reconcile the r
9595

9696
## List of `+kubebuilder:scaffold` Markers
9797

98-
| Marker | Usual Location | Function |
99-
|--------------------------------------------|------------------------------|---------------------------------------------------------------------------------|
100-
| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. |
101-
| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. |
102-
| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. |
103-
| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. |
104-
| `+kubebuilder:scaffold:crdkustomizeresource`| `config/crd` | Marks where CRD custom resource patches are added. |
105-
| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. |
106-
| `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhook. |
107-
| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. |
108-
| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. |
98+
| Marker | Usual Location | Function |
99+
|--------------------------------------------------------------------------------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
100+
| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. |
101+
| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. |
102+
| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. |
103+
| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. |
104+
| `+kubebuilder:scaffold:crdkustomizeresource` | `config/crd` | Marks where CRD custom resource patches are added. |
105+
| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. |
106+
| `+kubebuilder:scaffold:crdkustomizecainjectionns` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
107+
| `+kubebuilder:scaffold:crdkustomizecainjectioname` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
108+
| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. |
109+
| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. |
110+
| **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhooks. Replaced by `+kubebuilder:scaffold:crdkustomizecainjectionns` and `+kubebuilder:scaffold:crdkustomizecainjectioname` |
111+
112+
<aside class="note warning">
113+
<h1> **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` </h1>
114+
115+
The CA patch injection never worked for go/v4 (release : `3.5.0`) since
116+
we need to replace vars with replacements since vars is not supported
117+
for kustomize versions >= v4
118+
119+
However, since webhook --conversion was an uncompleted feature
120+
until the kubebuilder release v4.4.0 users did not check it out
121+
or were fixing the scaffold manually.
122+
123+
Please, ensure that:
124+
125+
- Remove from config/crd/kustomization.yaml the CERTMANAGER section
126+
such as:
127+
128+
```yaml
129+
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
130+
# patches here are for enabling the CA injection for each CRD
131+
#- path: patches/cainjection_in_firstmates.yaml
132+
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
133+
```
134+
135+
- 2. Ensure that config/default/kustomization.yaml under the [CERTMANAGER]
136+
replacement has the following code for your CA injection be properly generated:
137+
138+
**NOTE** You must ensure that the code contains the target markers:
139+
- '+kubebuilder:scaffold:crdkustomizecainjectionns'
140+
- '+kubebuilder:scaffold:crdkustomizecainjectioname'
141+
142+
```yaml
143+
# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
144+
# kind: Certificate
145+
# group: cert-manager.io
146+
# version: v1
147+
# name: serving-cert # This name should match the one in certificate.yaml
148+
# fieldPath: .metadata.namespace # Namespace of the certificate CR
149+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
150+
# +kubebuilder:scaffold:crdkustomizecainjectionns
151+
# - source:
152+
# kind: Certificate
153+
# group: cert-manager.io
154+
# version: v1
155+
# name: serving-cert # This name should match the one in certificate.yaml
156+
# fieldPath: .metadata.name
157+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
158+
# +kubebuilder:scaffold:crdkustomizecainjectioname
159+
```
160+
161+
**NOTE** You can check the examples under testdata/ directory
162+
in Kubebuilder repository to fix your project.
163+
164+
165+
166+
</aside>
167+
109168

110169
<aside class="note">
111170
<h1>Creating Your Own Markers</h1>

‎hack/docs/internal/multiversion-tutorial/generate_multiversion.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,13 @@ func (sp *Sample) updateDefaultKustomize() {
8787
// Enable CA for Conversion Webhook
8888
err := pluginutil.UncommentCode(
8989
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
90-
caConversionCRDDefaultKustomize, `#`)
90+
caInjectionNamespace, `#`)
91+
hackutils.CheckError("fixing default/kustomization", err)
92+
93+
// Enable CA for Conversion Webhook
94+
err = pluginutil.UncommentCode(
95+
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
96+
caInjectionCert, `#`)
9197
hackutils.CheckError("fixing default/kustomization", err)
9298
}
9399

‎hack/docs/internal/multiversion-tutorial/kustomize.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,31 +16,33 @@ limitations under the License.
1616

1717
package multiversion
1818

19-
const caConversionCRDDefaultKustomize = `#
20-
# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
19+
const caInjectionNamespace = `# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
2120
# kind: Certificate
2221
# group: cert-manager.io
2322
# version: v1
2423
# name: serving-cert # This name should match the one in certificate.yaml
2524
# fieldPath: .metadata.namespace # Namespace of the certificate CR
26-
# targets:
25+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
2726
# - select:
2827
# kind: CustomResourceDefinition
28+
# name: cronjobs.batch.tutorial.kubebuilder.io
2929
# fieldPaths:
3030
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
3131
# options:
3232
# delimiter: '/'
3333
# index: 0
34-
# create: true
35-
# - source:
34+
# create: true`
35+
36+
const caInjectionCert = `# - source:
3637
# kind: Certificate
3738
# group: cert-manager.io
3839
# version: v1
3940
# name: serving-cert # This name should match the one in certificate.yaml
4041
# fieldPath: .metadata.name
41-
# targets:
42+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
4243
# - select:
4344
# kind: CustomResourceDefinition
45+
# name: cronjobs.batch.tutorial.kubebuilder.io
4446
# fieldPaths:
4547
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
4648
# options:

‎pkg/plugins/common/kustomize/v2/scaffolds/api.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ func (s *apiScaffolder) Scaffold() error {
9090
}
9191
}
9292

93+
// nolint:goconst
9394
kustomizeFilePath := "config/default/kustomization.yaml"
9495
err := pluginutil.UncommentCode(kustomizeFilePath, "#- ../crd", `#`)
9596
if err != nil {

0 commit comments

Comments
 (0)