core: add code to update the webhook configurations

As we are adding new webhook configuration we
need to update the webhooks validations.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>

deploy/charts/rook-ceph/templates/clusterrole.yaml

@@ -20,7 +20,7 @@ rules:
     verbs: ["create"]
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["validatingwebhookconfigurations"]
-    verbs: ["create", "get", "delete"]
+    verbs: ["create", "get", "delete", "update"]
 ---
 # The cluster role for managing all the cluster-specific resources in a namespace
 apiVersion: rbac.authorization.k8s.io/v1

deploy/examples/common.yaml

@@ -600,7 +600,7 @@ rules:
     verbs: ["create"]
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["validatingwebhookconfigurations"]
-    verbs: ["create", "get", "delete"]
+    verbs: ["create", "get", "delete", "update"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

pkg/operator/ceph/webhook-config.go

@@ -24,6 +24,7 @@ import (
 	api "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
 	v1 "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
 	cs "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1"
+	"github.com/pkg/errors"
 	"github.com/rook/rook/pkg/clusterd"
 	admv1 "k8s.io/api/admissionregistration/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -154,21 +155,7 @@ func createCertificate(ctx context.Context, certMgrClient *cs.CertmanagerV1Clien
 	return nil
 }
 
-func fetchValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error {
-
-	logger.Infof("Fetching webhook %s/%s.", namespace, webhookConfigName)
-	_, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, webhookConfigName, metav1.GetOptions{})
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			return createValidatingWebhookConfig(ctx, clusterdContext)
-		}
-		logger.Errorf("failed to get webhook %s. %v", webhookConfigName, err)
-	}
-
-	return nil
-}
-
-func createValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error {
+func addValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error {
 	resourcesWebhookName := []string{
 		fmt.Sprintf("cephcluster-wh-%s-%s.rook.io", admissionControllerAppName, namespace),
 		fmt.Sprintf("cephblockpool-wh-%s-%s.rook.io", admissionControllerAppName, namespace),
@@ -195,9 +182,25 @@ func createValidatingWebhookConfig(ctx context.Context, clusterdContext *cluster
 		validatingWebhook.Webhooks = append(validatingWebhook.Webhooks, webhookRules(resourcesWebhookName[i], resources[i], resourcesServicePath[i]))
 	}
 
-	_, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, validatingWebhook, metav1.CreateOptions{})
+	webhookConfig, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, validatingWebhook.Name, metav1.GetOptions{})
 	if err != nil {
-		logger.Errorf("failed to create validating webhook %s. %v", webhookConfigName, err)
+		if apierrors.IsNotFound(err) {
+			_, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, validatingWebhook, metav1.CreateOptions{})
+			if err != nil {
+				logger.Errorf("failed to create admission webhook %s. %v", webhookConfigName, err)
+				return errors.Wrapf(err, "failed to create admission webhook %q", validatingWebhook.Name)
+			}
+			return nil
+		}
+		return errors.Wrapf(err, "failed to get admission webhook config %q", validatingWebhook.Name)
+	}
+
+	validatingWebhook.SetResourceVersion(webhookConfig.GetResourceVersion())
+	logger.Info("admission webhook already exists. updating it")
+	_, err = clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Update(ctx, validatingWebhook, metav1.UpdateOptions{})
+	if err != nil {
+		logger.Errorf("failed to update admission webhook %s. %v", webhookConfigName, err)
+		return errors.Wrapf(err, "failed to update admission webhook %q", validatingWebhook.Name)
 	}
 
 	return nil

pkg/operator/ceph/webhook.go

@@ -95,9 +95,9 @@ func createWebhook(ctx context.Context, context *clusterd.Context) (bool, error)
 
 	logger.Infof("admission webhook secret %q found", admissionControllerAppName)
 
-	err = fetchValidatingWebhookConfig(ctx, context)
+	err = addValidatingWebhookConfig(ctx, context)
 	if err != nil {
-		logger.Errorf("webhook creation failed %v", err)
+		logger.Errorf("adding webhook failed %v", err)
 		return false, nil
 	}