From abdfc70c0d76ddea3e12050fcefcf684e0fe5ba0 Mon Sep 17 00:00:00 2001 From: Przemyslaw Lal Date: Tue, 11 Dec 2018 09:15:08 +0000 Subject: [PATCH] Remove validating admission controller Remove validating admission controller to complete transfer of this feature to new repository at https://github.com/K8sNetworkPlumbingWG/net-attach-def-admission-controller --- deployment/webhook/certs.sh | 95 -------- .../webhook/configuration-template.yaml | 38 ---- deployment/webhook/deployment.yaml | 50 ----- deployment/webhook/service.yaml | 27 --- doc/webhook/webhook.md | 112 ---------- webhook/Dockerfile | 19 -- webhook/build | 10 - webhook/glide.yaml | 26 --- webhook/webhook.go | 203 ------------------ webhook/webhook_suite_test.go | 27 --- webhook/webhook_test.go | 187 ---------------- 11 files changed, 794 deletions(-) delete mode 100755 deployment/webhook/certs.sh delete mode 100644 deployment/webhook/configuration-template.yaml delete mode 100644 deployment/webhook/deployment.yaml delete mode 100644 deployment/webhook/service.yaml delete mode 100644 doc/webhook/webhook.md delete mode 100644 webhook/Dockerfile delete mode 100755 webhook/build delete mode 100644 webhook/glide.yaml delete mode 100644 webhook/webhook.go delete mode 100644 webhook/webhook_suite_test.go delete mode 100644 webhook/webhook_test.go diff --git a/deployment/webhook/certs.sh b/deployment/webhook/certs.sh deleted file mode 100755 index 8264114d8..000000000 --- a/deployment/webhook/certs.sh +++ /dev/null @@ -1,95 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2018 Intel Corporation -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http:#www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# create temp dir to store intermediate files -tmp=$(mktemp -d) - -# generate private key -echo "Generating private RSA key..." -openssl genrsa -out ${tmp}/webhook-key.pem 2048 >/dev/null 2>&1 - -# generate CSR -echo "Generating CSR configuration file..." -cat <> ${tmp}/webhook.conf -[req] -req_extensions = v3_req -distinguished_name = req_distinguished_name -[req_distinguished_name] -[ v3_req ] -basicConstraints = CA:FALSE -keyUsage = nonRepudiation, digitalSignature, keyEncipherment -extendedKeyUsage = serverAuth -subjectAltName = @alt_names -[alt_names] -DNS.1 = multus-webhook-service -DNS.2 = multus-webhook-service.default -DNS.3 = multus-webhook-service.default.svc -EOF -openssl req -new -key ${tmp}/webhook-key.pem -subj "/CN=multus-webhook-service.default.svc" -out ${tmp}/server.csr -config ${tmp}/webhook.conf - -# push CSR to Kubernetes API server -echo "Sending CSR to Kubernetes..." -csr_name="multus-webhook-service.default" -kubectl delete csr ${csr_name} >/dev/null 2>&1 -cat < ${tmp}/webhook-cert.pem - break - fi - echo -n "."; sleep 1 -done -if [[ $cert == "" ]]; then - echo -e "\nError: certificate not issued. Verify that the API for signing certificates is enabled." - exit -fi - -# create secret -echo "Creating secret..." -kubectl delete secret "multus-webhook-secret" -kubectl create secret generic --from-file=key.pem=${tmp}/webhook-key.pem --from-file=cert.pem=${tmp}/webhook-cert.pem "multus-webhook-secret" - -# set cert in webhook configuration -echo "Patching configuration file with certificate..." -if [[ -f configuration-template.yaml ]]; then - sed "s/__CERT__/${cert}/" configuration-template.yaml > configuration.yaml - echo "File configuration.yaml patched." -else - echo -e "Error: validating configuration template file 'configuration-template.yaml' is missing. Please update it with cert.pem value from the secret manually." -fi diff --git a/deployment/webhook/configuration-template.yaml b/deployment/webhook/configuration-template.yaml deleted file mode 100644 index 83cfa41fd..000000000 --- a/deployment/webhook/configuration-template.yaml +++ /dev/null @@ -1,38 +0,0 @@ -# Copyright (c) 2018 Intel Corporation -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http:#www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1beta1 -kind: ValidatingWebhookConfiguration -metadata: - labels: - app: multus-webhook - name: multus-webhook-config -webhooks: -- clientConfig: - caBundle: __CERT__ - service: - name: multus-webhook-service - namespace: default - path: /validate - failurePolicy: Fail - name: multus-webhook.k8s.cni.cncf.io - rules: - - apiGroups: - - k8s.cni.cncf.io - apiVersions: - - v1 - resources: - - network-attachment-definitions - operations: - - CREATE diff --git a/deployment/webhook/deployment.yaml b/deployment/webhook/deployment.yaml deleted file mode 100644 index 4b175aaf3..000000000 --- a/deployment/webhook/deployment.yaml +++ /dev/null @@ -1,50 +0,0 @@ -# Copyright (c) 2018 Intel Corporation -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http:#www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: multus-webhook - name: multus-webhook-deployment - namespace: default -spec: - replicas: 1 - selector: - matchLabels: - app: multus-webhook - template: - metadata: - labels: - app: multus-webhook - spec: - containers: - - name: multus-webhook - image: multus-webhook - command: - - /webhook/webhook - args: - - --bind-address=0.0.0.0 - - --port=443 - - --tls-private-key-file=/webhook/tls/key.pem - - --tls-cert-file=/webhook/tls/cert.pem - volumeMounts: - - mountPath: /webhook/tls - name: multus-webhook-secret - readOnly: True - imagePullPolicy: IfNotPresent - volumes: - - name: multus-webhook-secret - secret: - secretName: multus-webhook-secret diff --git a/deployment/webhook/service.yaml b/deployment/webhook/service.yaml deleted file mode 100644 index b81362f2e..000000000 --- a/deployment/webhook/service.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Copyright (c) 2018 Intel Corporation -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http:#www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - name: multus-webhook-service - labels: - app: multus-webhook - namespace: default -spec: - ports: - - port: 443 - targetPort: 443 - selector: - app: multus-webhook diff --git a/doc/webhook/webhook.md b/doc/webhook/webhook.md deleted file mode 100644 index 0e25cef11..000000000 --- a/doc/webhook/webhook.md +++ /dev/null @@ -1,112 +0,0 @@ -# Validating admission webhook - -## Building Docker image - -From the root directory of Multus execute: -``` -cd webhook -./build -``` - -## Deploying webhook application - -Change working directory. From the root directory of Multus execute: -``` -cd deployment/webhook -``` - -Create key and certificate pair and patch configuration-template.yaml file with base64-encoded certificate file. Run: -``` -./certs.sh -``` -*Note: Verify that Kubernetes controller manager has --cluster-signing-cert-file and --cluster-signing-key-file parameters set to paths to your CA keypair, -to make sure that Certificates API is enabled in order to generate certificate signed by cluster CA. -Script generates private key and certificate signing request, which is then pushed to the Kubernetes API server. -Then script approves that CSR and API server issues the certificate. Certificate is obtained from the API server and used to create a secret. -Script also patches `configuration-template.yaml` file with base64-encoded certificate and creates `configuration.yaml` file containing -Validating Webhook Configuration specification, which is deployed in one of the next steps. -More details about TLS certificates management in a cluster available [here](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/).* - -Create service: -``` -kubectl create -f service.yaml -``` - -Run deployment: -``` -kubectl create -f deployment.yaml -``` - -Create Validating Webhook Configuration: -``` -kubectl create -f configuration.yaml -``` - -## Verifying installation - -Try to create invalid Network Attachment Definition resource: -``` -cat <