Skip to content

Commit 91f285e

Browse files
omerap12omerap12
committed
Add Helm-managed webhook with kube-webhook-certgen
Signed-off-by: Omer Aplatony <[email protected]>
1 parent ffcbfee commit 91f285e

14 files changed

+444
-25
lines changed

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,35 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
2323
| Key | Type | Default | Description |
2424
|-----|------|---------|-------------|
2525
| admissionController.affinity | object | `{}` | |
26+
| admissionController.certGen.affinity | object | `{}` | |
27+
| admissionController.certGen.env | object | `{}` | Additional environment variables to be added to the certgen container. Format is KEY: Value format |
28+
| admissionController.certGen.image.pullPolicy | string | `"IfNotPresent"` | The pull policy for the certgen image. Recommend not changing this |
29+
| admissionController.certGen.image.repository | string | `"registry.k8s.io/ingress-nginx/kube-webhook-certgen"` | An image that contains certgen for creating certificates. Only used if admissionController.generateCertificate is true |
30+
| admissionController.certGen.image.tag | string | `"v20231011-8b53cabe0"` | An image tag for the admissionController.certGen.image.repository image. Only used if admissionController.generateCertificate is true |
31+
| admissionController.certGen.nodeSelector | object | `{}` | |
32+
| admissionController.certGen.podSecurityContext | object | `{"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | The securityContext block for the certgen pod(s) |
33+
| admissionController.certGen.resources | object | `{}` | The resources block for the certgen pod |
34+
| admissionController.certGen.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | The securityContext block for the certgen container(s) |
35+
| admissionController.certGen.tolerations | list | `[]` | |
2636
| admissionController.enabled | bool | `true` | |
2737
| admissionController.extraArgs | list | `[]` | |
2838
| admissionController.extraEnv | list | `[]` | |
39+
| admissionController.generateCertificate | bool | `true` | |
2940
| admissionController.image.pullPolicy | string | `"IfNotPresent"` | |
3041
| admissionController.image.repository | string | `"registry.k8s.io/autoscaling/vpa-admission-controller"` | |
3142
| admissionController.image.tag | string | `nil` | |
43+
| admissionController.mutatingWebhookConfiguration.annotations | object | `{}` | Additional annotations for the MutatingWebhookConfiguration |
44+
| admissionController.mutatingWebhookConfiguration.failurePolicy | string | `"Ignore"` | The failurePolicy for the mutating webhook. Allowed values are: Ignore, Fail |
45+
| admissionController.mutatingWebhookConfiguration.namespaceSelector | object | `{}` | The namespaceSelector controls which namespaces are affected by the webhook |
46+
| admissionController.mutatingWebhookConfiguration.objectSelector | object | `{}` | The objectSelector can filter objects on e.g. labels |
47+
| admissionController.mutatingWebhookConfiguration.timeoutSeconds | int | `5` | Sets the amount of time the API server will wait on a response from the webhook service |
3248
| admissionController.nodeSelector | object | `{}` | |
3349
| admissionController.podAnnotations | object | `{}` | |
3450
| admissionController.podDisruptionBudget.enabled | bool | `true` | |
3551
| admissionController.podDisruptionBudget.maxUnavailable | int or string | `nil` | Maximum number/percentage of pods that can be unavailable after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
3652
| admissionController.podDisruptionBudget.minAvailable | int or string | `1` | Minimum number/percentage of pods that must be available after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
3753
| admissionController.podLabels | object | `{}` | |
54+
| admissionController.registerWebhook | bool | `false` | |
3855
| admissionController.replicas | int | `2` | |
3956
| admissionController.resources.limits.cpu | string | `"200m"` | |
4057
| admissionController.resources.limits.memory | string | `"500Mi"` | |
@@ -50,7 +67,6 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
5067
| admissionController.serviceAccount.labels | object | `{}` | |
5168
| admissionController.tls.caCert | string | `""` | |
5269
| admissionController.tls.cert | string | `""` | |
53-
| admissionController.tls.existingSecret | string | `""` | |
5470
| admissionController.tls.key | string | `""` | |
5571
| admissionController.tls.secretName | string | `"vpa-tls-certs"` | |
5672
| admissionController.tolerations | list | `[]` | |
@@ -59,6 +75,12 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
5975
| admissionController.volumeMounts[0].readOnly | bool | `true` | |
6076
| admissionController.volumes[0].name | string | `"tls-certs"` | |
6177
| admissionController.volumes[0].secret.defaultMode | int | `420` | |
78+
| admissionController.volumes[0].secret.items[0].key | string | `"ca"` | |
79+
| admissionController.volumes[0].secret.items[0].path | string | `"caCert.pem"` | |
80+
| admissionController.volumes[0].secret.items[1].key | string | `"cert"` | |
81+
| admissionController.volumes[0].secret.items[1].path | string | `"serverCert.pem"` | |
82+
| admissionController.volumes[0].secret.items[2].key | string | `"key"` | |
83+
| admissionController.volumes[0].secret.items[2].path | string | `"serverKey.pem"` | |
6284
| admissionController.volumes[0].secret.secretName | string | `"vpa-tls-certs"` | |
6385
| commonLabels | object | `{}` | |
6486
| containerSecurityContext | object | `{}` | |

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/_helpers.tpl‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,13 +66,63 @@ app.kubernetes.io/component: admission-controller
6666
Create the name of the tls secret to use
6767
*/}}
6868
{{- define "vertical-pod-autoscaler.admissionController.tls.secretName" -}}
69-
{{- if .Values.admissionController.tls.existingSecret -}}
70-
{{ .Values.admissionController.tls.existingSecret }}
69+
{{- if .Values.admissionController.tls.secretName -}}
70+
{{ .Values.admissionController.tls.secretName }}
7171
{{- else -}}
7272
{{- printf "%s-%s" (include "vertical-pod-autoscaler.admissionController.fullname" .) "tls" | trunc 63 | trimSuffix "-" -}}
7373
{{- end -}}
7474
{{- end -}}
7575

76+
{{/*
77+
admissionController webhook
78+
*/}}
79+
{{- define "vertical-pod-autoscaler.admissionController.webhook.name" -}}
80+
{{ include "vertical-pod-autoscaler.fullname" . }}-webhook
81+
{{- end }}
82+
83+
{{- define "vertical-pod-autoscaler.admissionController.webhook.configName" -}}
84+
{{ include "vertical-pod-autoscaler.fullname" . }}-webhook-config
85+
{{- end }}
86+
87+
{{/*
88+
See if we can upgrade the mutatingWebhookConfiguration
89+
Checks if the webhook exists and is managed by this Helm release
90+
*/}}
91+
{{- define "vertical-pod-autoscaler.admissionController.webhook.upgradable" -}}
92+
{{- $webhookName := include "vertical-pod-autoscaler.admissionController.webhook.configName" . -}}
93+
{{- $webhook := (lookup "admissionregistration.k8s.io/v1" "MutatingWebhookConfiguration" "" $webhookName) -}}
94+
{{- if $webhook -}}
95+
{{- if and
96+
(hasKey $webhook.metadata "labels")
97+
(hasKey $webhook.metadata "annotations")
98+
(hasKey $webhook.metadata.labels "app.kubernetes.io/managed-by")
99+
(hasKey $webhook.metadata.annotations "meta.helm.sh/release-name")
100+
(hasKey $webhook.metadata.annotations "meta.helm.sh/release-namespace")
101+
(eq (get $webhook.metadata.labels "app.kubernetes.io/managed-by") "Helm")
102+
(eq (get $webhook.metadata.annotations "meta.helm.sh/release-name") .Release.Name)
103+
(eq (get $webhook.metadata.annotations "meta.helm.sh/release-namespace") .Release.Namespace)
104+
-}}
105+
{{- "true" -}}
106+
{{- else -}}
107+
{{- "" -}}
108+
{{- end -}}
109+
{{- else -}}
110+
{{- "true" -}}
111+
{{- end -}}
112+
{{- end -}}
113+
114+
{{/*
115+
admissionController certGen
116+
*/}}
117+
{{- define "vertical-pod-autoscaler.admissionController.certGen.fullname" -}}
118+
{{ include "vertical-pod-autoscaler.fullname" . }}-admission-certgen
119+
{{- end }}
120+
121+
{{- define "vertical-pod-autoscaler.admissionController.certGen.labels" -}}
122+
{{ include "vertical-pod-autoscaler.labels" . }}
123+
app.kubernetes.io/component: admission-certgen
124+
{{- end }}
125+
76126

77127
{{/*
78128
updater

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-clusterrole.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
annotations:
7+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
8+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
9+
"helm.sh/hook-weight": "-10"
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
rules:
13+
- apiGroups:
14+
- admissionregistration.k8s.io
15+
resources:
16+
- mutatingwebhookconfigurations
17+
verbs:
18+
- get
19+
- update
20+
- patch
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-clusterrolebinding.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
annotations:
7+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
8+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
9+
"helm.sh/hook-weight": "-10"
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
16+
subjects:
17+
- kind: ServiceAccount
18+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
19+
namespace: {{ .Release.Namespace }}
20+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-patch.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}-patch
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
spec:
13+
ttlSecondsAfterFinished: 300
14+
template:
15+
metadata:
16+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}-patch
17+
labels:
18+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 8 }}
19+
spec:
20+
restartPolicy: OnFailure
21+
serviceAccountName: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
22+
{{- with .Values.imagePullSecrets }}
23+
imagePullSecrets:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
{{- with .Values.priorityClassName }}
27+
priorityClassName: {{ . }}
28+
{{- end }}
29+
containers:
30+
- name: patch
31+
image: {{ printf "%s:%s" .Values.admissionController.certGen.image.repository .Values.admissionController.certGen.image.tag }}
32+
imagePullPolicy: {{ .Values.admissionController.certGen.image.pullPolicy }}
33+
args:
34+
- patch
35+
- --webhook-name={{ include "vertical-pod-autoscaler.admissionController.webhook.configName" . }}
36+
- --namespace={{ .Release.Namespace }}
37+
- --secret-name={{ include "vertical-pod-autoscaler.admissionController.tls.secretName" . }}
38+
- --patch-validating=false
39+
{{- with .Values.admissionController.certGen.env }}
40+
env:
41+
{{- range $key, $value := . }}
42+
- name: {{ $key }}
43+
value: {{ $value | quote }}
44+
{{- end }}
45+
{{- end }}
46+
{{- with .Values.admissionController.certGen.resources }}
47+
resources:
48+
{{- toYaml . | nindent 12 }}
49+
{{- end }}
50+
{{- with .Values.admissionController.certGen.securityContext }}
51+
securityContext:
52+
{{- toYaml . | nindent 12 }}
53+
{{- end }}
54+
{{- with .Values.admissionController.certGen.podSecurityContext }}
55+
securityContext:
56+
{{- toYaml . | nindent 8 }}
57+
{{- end }}
58+
{{- with .Values.admissionController.certGen.nodeSelector }}
59+
nodeSelector:
60+
{{- toYaml . | nindent 8 }}
61+
{{- end }}
62+
{{- with .Values.admissionController.certGen.affinity }}
63+
affinity:
64+
{{- toYaml . | nindent 8 }}
65+
{{- end }}
66+
{{- with .Values.admissionController.certGen.tolerations }}
67+
tolerations:
68+
{{- toYaml . | nindent 8 }}
69+
{{- end }}
70+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-role.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
rules:
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- secrets
18+
verbs:
19+
- get
20+
- create
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-rolebinding.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: Role
16+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
17+
subjects:
18+
- kind: ServiceAccount
19+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
20+
namespace: {{ .Release.Namespace }}
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-serviceaccount.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.generateCertificate -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-5"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
spec:
14+
ttlSecondsAfterFinished: 300
15+
template:
16+
metadata:
17+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
18+
labels:
19+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 8 }}
20+
spec:
21+
restartPolicy: OnFailure
22+
serviceAccountName: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
23+
{{- with .Values.imagePullSecrets }}
24+
imagePullSecrets:
25+
{{- toYaml . | nindent 8 }}
26+
{{- end }}
27+
{{- with .Values.priorityClassName }}
28+
priorityClassName: {{ . }}
29+
{{- end }}
30+
containers:
31+
- name: create
32+
image: {{ printf "%s:%s" .Values.admissionController.certGen.image.repository .Values.admissionController.certGen.image.tag }}
33+
imagePullPolicy: {{ .Values.admissionController.certGen.image.pullPolicy }}
34+
args:
35+
- create
36+
- --host={{ include "vertical-pod-autoscaler.admissionController.webhook.name" . }},{{ include "vertical-pod-autoscaler.admissionController.webhook.name" . }}.{{ .Release.Namespace }}.svc
37+
- --namespace={{ .Release.Namespace }}
38+
- --secret-name={{ include "vertical-pod-autoscaler.admissionController.tls.secretName" . }}
39+
{{- with .Values.admissionController.certGen.env }}
40+
env:
41+
{{- range $key, $value := . }}
42+
- name: {{ $key }}
43+
value: {{ $value | quote }}
44+
{{- end }}
45+
{{- end }}
46+
{{- with .Values.admissionController.certGen.resources }}
47+
resources:
48+
{{- toYaml . | nindent 12 }}
49+
{{- end }}
50+
{{- with .Values.admissionController.certGen.securityContext }}
51+
securityContext:
52+
{{- toYaml . | nindent 12 }}
53+
{{- end }}
54+
{{- with .Values.admissionController.certGen.podSecurityContext }}
55+
securityContext:
56+
{{- toYaml . | nindent 8 }}
57+
{{- end }}
58+
{{- with .Values.admissionController.certGen.nodeSelector }}
59+
nodeSelector:
60+
{{- toYaml . | nindent 8 }}
61+
{{- end }}
62+
{{- with .Values.admissionController.certGen.affinity }}
63+
affinity:
64+
{{- toYaml . | nindent 8 }}
65+
{{- end }}
66+
{{- with .Values.admissionController.certGen.tolerations }}
67+
tolerations:
68+
{{- toYaml . | nindent 8 }}
69+
{{- end }}
70+
{{- end -}}

0 commit comments

Comments
 (0)