Skip to content

Commit 47d5a05

Browse files
duanhongyiduanhongyi
committed
fix(charts): failed to call webhook
1 parent 0a6255d commit 47d5a05

13 files changed

Lines changed: 101 additions & 105 deletions

‎charts/controller/templates/controller-job-upgrade.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: batch/v1
22
kind: Job
33
metadata:
4-
name: drycc-controller-job-upgrade
4+
name: drycc-controller-job-upgrade-{{ now | date "20060102150405" }}
55
labels:
66
heritage: drycc
77
annotations:

charts/controller/templates/controller-webhook-deloyment.yaml renamed to charts/controller/templates/controller-mutate-deloyment.yaml

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: drycc-controller-webhook
4+
name: drycc-controller-mutate
55
spec:
6-
replicas: {{ .Values.webhookReplicas }}
6+
replicas: {{ .Values.mutateReplicas }}
77
selector:
88
matchLabels:
9-
component: drycc-controller-webhook
9+
component: drycc-controller-mutate
1010
template:
1111
metadata:
1212
labels: {{- include "common.labels.standard" . | nindent 8 }}
13-
component: drycc-controller-webhook
13+
component: drycc-controller-mutate
1414
spec:
1515
affinity:
16-
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.webhook.podAffinityPreset.type "component" "" "extraMatchLabels" .Values.webhook.podAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
17-
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.webhook.podAntiAffinityPreset.type "component" "" "extraMatchLabels" .Values.webhook.podAntiAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
18-
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.webhook.nodeAffinityPreset.type "key" .Values.webhook.nodeAffinityPreset.key "values" .Values.webhook.nodeAffinityPreset.values ) | nindent 10 }}
16+
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.mutate.podAffinityPreset.type "component" "" "extraMatchLabels" .Values.mutate.podAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
17+
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.mutate.podAntiAffinityPreset.type "component" "" "extraMatchLabels" .Values.mutate.podAntiAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
18+
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.mutate.nodeAffinityPreset.type "key" .Values.mutate.nodeAffinityPreset.key "values" .Values.mutate.nodeAffinityPreset.values ) | nindent 10 }}
1919
initContainers:
2020
- name: drycc-controller-init
2121
image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/python-dev:latest
@@ -57,18 +57,11 @@ spec:
5757
name: https
5858
{{- end }}
5959
volumeMounts:
60-
- name: controller-webhook-cert
61-
mountPath: /etc/controller/webhook/cert
60+
- name: controller-mutate-cert
61+
mountPath: /etc/controller/mutate/cert
6262
{{- include "controller.limits" . | indent 8 }}
6363
{{- include "controller.envs" . | indent 8 }}
6464
volumes:
65-
- name: controller-webhook-cert
65+
- name: controller-mutate-cert
6666
secret:
67-
secretName: controller-webhook-cert
68-
items:
69-
- key: token
70-
path: token
71-
- key: tls.crt
72-
path: tls.crt
73-
- key: tls.key
74-
path: tls.key
67+
secretName: controller-mutate-cert

charts/controller/templates/controller-webhook-service.yaml renamed to charts/controller/templates/controller-mutate-service.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
kind: Service
22
apiVersion: v1
33
metadata:
4-
name: drycc-controller-webhook
4+
name: drycc-controller-mutate
55
spec:
66
selector:
7-
component: drycc-controller-webhook
7+
component: drycc-controller-mutate
88
ports:
99
- name: https
10-
port: 8443
10+
port: 443
1111
targetPort: 8443

‎charts/controller/templates/controller-mutate-webhook.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{{- $key := randAlphaNum 128 | lower }}
2+
{{- $ca := genCA "controller-mutate-ca" 3650 }}
3+
{{- $altName1 := printf "drycc-controller-mutate.%s" .Release.Namespace }}
4+
{{- $altName2 := printf "drycc-controller-mutate.%s.svc" .Release.Namespace }}
5+
{{- $cert := genSignedCert "drycc-controller-mutate" nil (list $altName1 $altName2) 3650 $ca }}
6+
apiVersion: admissionregistration.k8s.io/v1
7+
kind: MutatingWebhookConfiguration
8+
metadata:
9+
name: {{ .Release.Namespace }}-controller-mutate
10+
webhooks:
11+
- name: mutate.drycc.cc
12+
sideEffects: None
13+
admissionReviewVersions: ["v1"]
14+
clientConfig:
15+
caBundle: {{ b64enc $ca.Cert }}
16+
service:
17+
name: drycc-controller-mutate
18+
namespace: "{{ .Release.Namespace }}"
19+
path: "{{ printf "/v2/mutate/%s/" $key }}"
20+
failurePolicy: Fail
21+
objectSelector:
22+
matchLabels:
23+
heritage: drycc
24+
rules:
25+
- operations: ["UPDATE"]
26+
apiGroups: ["batch"]
27+
apiVersions: ["*"]
28+
resources: ["jobs/status"]
29+
- operations: ["UPDATE"]
30+
apiGroups: ["apps"]
31+
apiVersions: ["*"]
32+
resources: ["deployments/scale"]
33+
- operations: ["UPDATE"]
34+
apiGroups: ["servicecatalog.k8s.io"]
35+
apiVersions: ["*"]
36+
resources: ["serviceinstances/status", "servicebindings/status"]
37+
timeoutSeconds: 30
38+
---
39+
apiVersion: v1
40+
kind: Secret
41+
metadata:
42+
name: controller-mutate-cert
43+
labels:
44+
release: "{{ .Release.Name }}"
45+
heritage: "{{ .Release.Service }}"
46+
type: Opaque
47+
data:
48+
key: {{ b64enc $key }}
49+
tls.crt: {{ b64enc $cert.Cert }}
50+
tls.key: {{ b64enc $cert.Key }}

‎charts/controller/templates/controller-webhook-register.yaml‎

Lines changed: 0 additions & 58 deletions
This file was deleted.

‎charts/controller/values.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ appPodExecTimeout: 3600
4444
apiReplicas: 1
4545
# Set celery replicas
4646
celeryReplicas: 1
47-
# Set webhook replicas
48-
webhookReplicas: 1
47+
# Set mutate replicas
48+
mutateReplicas: 1
4949
# Set cronjob concurrencyPolicy
5050
# Allow (default): The cron job allows concurrently running jobs
5151
# Forbid: The cron job does not allow concurrent runs; if it is time for a new job run and the previous job run hasn't finished yet, the cron job skips the new job run
@@ -112,7 +112,7 @@ celery:
112112
extraMatchLabels:
113113
app: "drycc-controller-celery"
114114

115-
webhook:
115+
mutate:
116116
nodeAffinityPreset:
117117
key: "drycc.cc/node"
118118
type: "soft"
@@ -125,7 +125,7 @@ webhook:
125125
podAntiAffinityPreset:
126126
type: "soft"
127127
extraMatchLabels:
128-
component: "drycc-controller-webhook"
128+
component: "drycc-controller-mutate"
129129

130130
redis:
131131
replicas: 1

‎rootfs/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ RUN groupadd drycc --gid ${DRYCC_GID} \
1212
COPY requirements.txt ${DRYCC_HOME_DIR}/requirements.txt
1313

1414
RUN buildDeps='gcc libffi-dev libpq-dev rustc cargo'; \
15-
install-packages ${buildDeps} \
15+
install-packages inotify-tools ${buildDeps} \
1616
&& install-stack python $PYTHON_VERSION && . init-stack \
1717
&& python3 -m venv ${DRYCC_HOME_DIR}/.venv \
1818
&& source ${DRYCC_HOME_DIR}/.venv/bin/activate \

‎rootfs/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ENV PGDATA="/opt/drycc/postgresql/data" \
1414
GOSU_VERSION="1.17"
1515

1616
RUN buildDeps='gcc rustc cargo libffi-dev musl-dev openssl'; \
17-
install-packages mercurial ca-certificates git $buildDeps \
17+
install-packages mercurial ca-certificates git inotify-tools $buildDeps \
1818
&& install-stack python $PYTHON_VERSION \
1919
&& install-stack redis $REDIS_VERSION \
2020
&& install-stack rabbitmq $RABBITMQ_VERSION \

‎rootfs/api/settings/production.py‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,14 @@
280280
SECRET_KEY = os.environ.get('DRYCC_SECRET_KEY', random_secret)
281281
BUILDER_KEY = os.environ.get('DRYCC_BUILDER_KEY', random_secret)
282282

283+
# Drycc admission mutate key
284+
MUTATE_KEY_PATH = os.environ.get('DRYCC_MUTATE_KEY_PATH', '/etc/controller/mutate/cert/key')
285+
if os.path.exists(MUTATE_KEY_PATH):
286+
with open(MUTATE_KEY_PATH) as f:
287+
MUTATE_KEY = f.read()
288+
else:
289+
MUTATE_KEY = None
290+
283291
# gateway class name
284292
GATEWAY_CLASS = os.environ.get('DRYCC_GATEWAY_CLASS', '')
285293

@@ -462,10 +470,3 @@
462470
WORKFLOW_MANAGER_URL = os.environ.get('WORKFLOW_MANAGER_URL', None)
463471
WORKFLOW_MANAGER_ACCESS_KEY = os.environ.get('WORKFLOW_MANAGER_ACCESS_KEY', None)
464472
WORKFLOW_MANAGER_SECRET_KEY = os.environ.get('WORKFLOW_MANAGER_SECRET_KEY', None)
465-
466-
# Drycc admission webhook token
467-
if os.path.exists("/etc/controller/webhook/cert"):
468-
with open("/etc/controller/webhook/cert/token") as f:
469-
DRYCC_ADMISSION_WEBHOOK_TOKEN = f.read()
470-
else:
471-
DRYCC_ADMISSION_WEBHOOK_TOKEN = None

‎rootfs/api/urls.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -230,15 +230,15 @@
230230
re_path('', include('social_django.urls', namespace='social')),
231231
]
232232

233-
webhook_urlpatterns = [
233+
mutate_urlpatterns = [
234234
re_path(
235-
r'^webhooks/(?P<token>.+)/?$',
235+
r'^mutate/(?P<key>.+)/?$',
236236
views.AdmissionWebhookViewSet.as_view({'post': 'handle'})
237237
),
238238
]
239239

240-
# If there is a mutating admission webhook configuration, use webhook url
241-
if settings.DRYCC_ADMISSION_WEBHOOK_TOKEN:
242-
urlpatterns = webhook_urlpatterns
240+
# If there is a mutating admission mutate configuration, use mutate url
241+
if settings.MUTATE_KEY:
242+
urlpatterns = mutate_urlpatterns
243243
else:
244244
urlpatterns = app_urlpatterns

0 commit comments

Comments
 (0)