From 024c034a95c98d559fdc5eeb38121f2517e96402 Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Wed, 13 Apr 2022 10:38:38 +0530 Subject: [PATCH] core: add code to update the webhook configurations As we are adding new webhook configuration we need to update the webhooks validations. Signed-off-by: Madhu Rajanna --- .../rook-ceph/templates/clusterrole.yaml | 2 +- deploy/examples/common.yaml | 2 +- pkg/operator/ceph/webhook-config.go | 37 ++++++++++--------- pkg/operator/ceph/webhook.go | 4 +- 4 files changed, 24 insertions(+), 21 deletions(-) diff --git a/deploy/charts/rook-ceph/templates/clusterrole.yaml b/deploy/charts/rook-ceph/templates/clusterrole.yaml index ddd4e315a..e5f970da0 100644 --- a/deploy/charts/rook-ceph/templates/clusterrole.yaml +++ b/deploy/charts/rook-ceph/templates/clusterrole.yaml @@ -20,7 +20,7 @@ rules: verbs: ["create"] - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - verbs: ["create", "get", "delete"] + verbs: ["create", "get", "delete", "update"] --- # The cluster role for managing all the cluster-specific resources in a namespace apiVersion: rbac.authorization.k8s.io/v1 diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index 62a5d1bb0..543c9b2c8 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -600,7 +600,7 @@ rules: verbs: ["create"] - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - verbs: ["create", "get", "delete"] + verbs: ["create", "get", "delete", "update"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 diff --git a/pkg/operator/ceph/webhook-config.go b/pkg/operator/ceph/webhook-config.go index 397847914..247571e43 100644 --- a/pkg/operator/ceph/webhook-config.go +++ b/pkg/operator/ceph/webhook-config.go @@ -24,6 +24,7 @@ import ( api "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" v1 "github.com/jetstack/cert-manager/pkg/apis/meta/v1" cs "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1" + "github.com/pkg/errors" "github.com/rook/rook/pkg/clusterd" admv1 "k8s.io/api/admissionregistration/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" @@ -154,21 +155,7 @@ func createCertificate(ctx context.Context, certMgrClient *cs.CertmanagerV1Clien return nil } -func fetchValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error { - - logger.Infof("Fetching webhook %s/%s.", namespace, webhookConfigName) - _, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, webhookConfigName, metav1.GetOptions{}) - if err != nil { - if apierrors.IsNotFound(err) { - return createValidatingWebhookConfig(ctx, clusterdContext) - } - logger.Errorf("failed to get webhook %s. %v", webhookConfigName, err) - } - - return nil -} - -func createValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error { +func addValidatingWebhookConfig(ctx context.Context, clusterdContext *clusterd.Context) error { resourcesWebhookName := []string{ fmt.Sprintf("cephcluster-wh-%s-%s.rook.io", admissionControllerAppName, namespace), fmt.Sprintf("cephblockpool-wh-%s-%s.rook.io", admissionControllerAppName, namespace), @@ -195,9 +182,25 @@ func createValidatingWebhookConfig(ctx context.Context, clusterdContext *cluster validatingWebhook.Webhooks = append(validatingWebhook.Webhooks, webhookRules(resourcesWebhookName[i], resources[i], resourcesServicePath[i])) } - _, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, validatingWebhook, metav1.CreateOptions{}) + webhookConfig, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, validatingWebhook.Name, metav1.GetOptions{}) if err != nil { - logger.Errorf("failed to create validating webhook %s. %v", webhookConfigName, err) + if apierrors.IsNotFound(err) { + _, err := clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, validatingWebhook, metav1.CreateOptions{}) + if err != nil { + logger.Errorf("failed to create admission webhook %s. %v", webhookConfigName, err) + return errors.Wrapf(err, "failed to create admission webhook %q", validatingWebhook.Name) + } + return nil + } + return errors.Wrapf(err, "failed to get admission webhook config %q", validatingWebhook.Name) + } + + validatingWebhook.SetResourceVersion(webhookConfig.GetResourceVersion()) + logger.Info("admission webhook already exists. updating it") + _, err = clusterdContext.Clientset.AdmissionregistrationV1().ValidatingWebhookConfigurations().Update(ctx, validatingWebhook, metav1.UpdateOptions{}) + if err != nil { + logger.Errorf("failed to update admission webhook %s. %v", webhookConfigName, err) + return errors.Wrapf(err, "failed to update admission webhook %q", validatingWebhook.Name) } return nil diff --git a/pkg/operator/ceph/webhook.go b/pkg/operator/ceph/webhook.go index 4d14dc23b..e4f611888 100644 --- a/pkg/operator/ceph/webhook.go +++ b/pkg/operator/ceph/webhook.go @@ -95,9 +95,9 @@ func createWebhook(ctx context.Context, context *clusterd.Context) (bool, error) logger.Infof("admission webhook secret %q found", admissionControllerAppName) - err = fetchValidatingWebhookConfig(ctx, context) + err = addValidatingWebhookConfig(ctx, context) if err != nil { - logger.Errorf("webhook creation failed %v", err) + logger.Errorf("adding webhook failed %v", err) return false, nil }