Skip to content

Commit 5e531f0

Browse files
zongzwzongzw
authored
Merge pull request #75 from zongzw/develop
Add webhook devops files.
2 parents 0c155e9 + c75b2ff commit 5e531f0

File tree

6 files changed

+233
-0
lines changed

6 files changed

+233
-0
lines changed

‎develop/webhook/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
certificates/*
2+
3+
prepare-certificate.yaml
4+
validating-webhook-configuration.yaml
5+
launch.json

‎develop/webhook/0.prepare-certificates.yaml.tmpl‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Install cert-manager.io: https://cert-manager.io/docs/installation/
2+
---
3+
4+
apiVersion: cert-manager.io/v1
5+
kind: ClusterIssuer
6+
metadata:
7+
name: selfsigned-issuer
8+
spec:
9+
selfSigned: {}
10+
11+
---
12+
13+
apiVersion: cert-manager.io/v1
14+
kind: Certificate
15+
metadata:
16+
name: my-selfsigned-ca
17+
namespace: kube-system
18+
spec:
19+
isCA: true
20+
commonName: my-selfsigned-ca
21+
secretName: root-secret
22+
privateKey:
23+
algorithm: ECDSA
24+
size: 256
25+
issuerRef:
26+
name: selfsigned-issuer
27+
kind: ClusterIssuer
28+
group: cert-manager.io
29+
30+
---
31+
32+
apiVersion: cert-manager.io/v1
33+
kind: Issuer
34+
metadata:
35+
name: my-ca-issuer
36+
namespace: kube-system
37+
spec:
38+
ca:
39+
secretName: root-secret
40+
41+
---
42+
43+
apiVersion: cert-manager.io/v1
44+
kind: Certificate
45+
metadata:
46+
name: serving-cert
47+
namespace: kube-system
48+
spec:
49+
dnsNames:
50+
- bigip-kubernetes-gateway-webhook.kube-system.svc
51+
- bigip-kubernetes-gateway-webhook.kube-system.svc.cluster.local
52+
ipAddresses:
53+
- 127.0.0.1
54+
- 0.0.0.0
55+
- ${local_host_ipaddr}
56+
issuerRef:
57+
kind: Issuer
58+
name: my-ca-issuer
59+
secretName: webhook-server-cert

‎develop/webhook/1.validating-webhook-configuration.yaml.tmpl‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
apiVersion: admissionregistration.k8s.io/v1
3+
kind: ValidatingWebhookConfiguration
4+
metadata:
5+
creationTimestamp: null
6+
name: validating-webhook-configuration
7+
annotations:
8+
cert-manager.io/inject-ca-from: kube-system/my-selfsigned-ca
9+
webhooks:
10+
- admissionReviewVersions:
11+
- v1beta1
12+
- v1
13+
clientConfig:
14+
# service:
15+
# name: webhook-service
16+
# namespace: system
17+
url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-gatewayclass"
18+
failurePolicy: Fail
19+
name: vgwc.kb.io
20+
rules:
21+
- apiGroups:
22+
- gateway.networking.k8s.io
23+
apiVersions:
24+
- v1beta1
25+
operations: ["*"]
26+
resources:
27+
- gatewayclasses
28+
sideEffects: None
29+
- admissionReviewVersions:
30+
- v1beta1
31+
- v1
32+
clientConfig:
33+
service:
34+
# name: bigip-kubernetes-gateway
35+
# namespace: kube-system
36+
# path: /validate-gateway-networking-k8s-io-v1beta1-gateway
37+
# port: 9443
38+
url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-gateway"
39+
failurePolicy: Fail
40+
name: vgw.kb.io
41+
rules:
42+
- apiGroups:
43+
- gateway.networking.k8s.io
44+
apiVersions:
45+
- v1beta1
46+
operations: ["*"]
47+
resources:
48+
- gateways
49+
sideEffects: None
50+
- admissionReviewVersions:
51+
- v1beta1
52+
- v1
53+
clientConfig:
54+
# service:
55+
# name: bigip-kubernetes-gateway
56+
# namespace: kube-system
57+
# path: /validate-gateway-networking-k8s-io-v1beta1-httproute
58+
# port: 9443
59+
url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-httproute"
60+
failurePolicy: Fail
61+
name: vhr.kb.io
62+
rules:
63+
- apiGroups:
64+
- gateway.networking.k8s.io
65+
apiVersions:
66+
- v1beta1
67+
operations: ["*"]
68+
resources:
69+
- httproutes
70+
sideEffects: None
71+
- admissionReviewVersions:
72+
- v1beta1
73+
- v1
74+
clientConfig:
75+
# service:
76+
# name: bigip-kubernetes-gateway
77+
# namespace: kube-system
78+
# path: /validate-gateway-networking-k8s-io-v1beta1-referencegrant
79+
# port: 9443
80+
url: "https://${local_host_ipaddr}:9443/validate-gateway-networking-k8s-io-v1beta1-referencegrant"
81+
failurePolicy: Fail
82+
name: vrg.kb.io
83+
rules:
84+
- apiGroups:
85+
- gateway.networking.k8s.io
86+
apiVersions:
87+
- v1beta1
88+
operations: ["*"]
89+
resources:
90+
- referencegrants
91+
sideEffects: None

‎develop/webhook/2.vscode-launch.json.tmpl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "0.2.0",
3+
"configurations": [
4+
{
5+
"name": "GO: Launch webhook program",
6+
"type": "go",
7+
"request": "launch",
8+
"mode": "auto",
9+
"program": "\${workspaceFolder}/cmd/webhook",
10+
"args": [
11+
"--controller-name", "f5.io/gateway-controller-name",
12+
"--log-level", "trace",
13+
"--certificate-directory", "\${workspaceFolder}/develop/webhook/certificates",
14+
"--kubeconfig", "${kube_config}",
15+
"--validates", "gateway.gatewayClassName,gateway.listeners.tls.certificateRefs,httproute.parentRefs,httproute.rules.backendRefs"
16+
]
17+
}
18+
]
19+
}

‎develop/webhook/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
This guide aims to make it clear how to develop bigip-kubernetes-gateway-webhook program.
2+
3+
Refer to `setup-webhook-dev.sh` for more details.
4+
5+
Basically, it setup 3 things for developing webhook program:
6+
7+
* create the webhook server crt/key via cert-manager.io, see `0.prepare-cerfitifcate.yaml.tmpl` for detail.
8+
9+
* create the webhook validating configuration, see `1.validating-webhook-configuration.yaml.tmpl` for detail.
10+
11+
* create the vscode `launch.json` for debugging.
12+
13+
During the process, variables are needed:
14+
15+
* `local_host_ipaddr`: the callback IP address for webhook API.
16+
17+
* `kube_config`: the kubeconfig file for accessing kubernetes API.

‎develop/webhook/setup-webhook-dev.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/bash
2+
3+
local_host_ipaddr=10.250.64.107
4+
kube_config=/Users/zong/.kube/config
5+
6+
k="kubectl --kubeconfig $kube_config"
7+
8+
eval "cat <<EOF
9+
$(< 0.prepare-certificates.yaml.tmpl)
10+
EOF
11+
" > prepare-certificate.yaml
12+
13+
$k apply -f prepare-certificate.yaml
14+
if [ $? -ne 0 ]; then
15+
echo "Error: Failed to create certificate"
16+
exit 1;
17+
fi
18+
19+
while true; do
20+
$k get secret/webhook-server-cert -n kube-system;
21+
if [ $? -eq 0 ]; then break; fi
22+
echo "waiting for secret webhook-server-cert ready"; sleep 1;
23+
done
24+
25+
$k get secret webhook-server-cert -n kube-system -o json | jq '.data["tls.crt"]' | tr -d '"' | base64 -d > certificates/tls.crt
26+
$k get secret webhook-server-cert -n kube-system -o json | jq '.data["tls.key"]' | tr -d '"' | base64 -d > certificates/tls.key
27+
28+
29+
eval "cat <<EOF
30+
$(< 1.validating-webhook-configuration.yaml.tmpl)
31+
EOF
32+
" > validating-webhook-configuration.yaml
33+
34+
$k apply -f validating-webhook-configuration.yaml
35+
36+
37+
eval "cat <<EOF
38+
$(< 2.vscode-launch.json.tmpl)
39+
EOF
40+
" > launch.json
41+
42+
echo "Copy the launch.json to .vscode folder in the project root folder"

0 commit comments

Comments
 (0)