From 0cd75647b2ef8e19b0f64b89dc54bd68d4d48836 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Thu, 13 Jun 2024 11:27:54 -0300 Subject: [PATCH] forward-port webhook emergency from 2.7.14 --- .../rancher-webhook-2.0.11+up0.3.11.tgz | Bin 0 -> 2705 bytes .../2.0.11+up0.3.11/Chart.yaml | 18 ++++ .../2.0.11+up0.3.11/charts/capi/Chart.yaml | 4 + .../charts/capi/templates/service.yaml | 13 +++ .../2.0.11+up0.3.11/templates/_helpers.tpl | 22 +++++ .../2.0.11+up0.3.11/templates/deployment.yaml | 83 ++++++++++++++++++ .../2.0.11+up0.3.11/templates/rbac.yaml | 12 +++ .../2.0.11+up0.3.11/templates/service.yaml | 13 +++ .../templates/serviceaccount.yaml | 11 +++ .../2.0.11+up0.3.11/templates/webhook.yaml | 9 ++ .../2.0.11+up0.3.11/tests/README.md | 16 ++++ .../tests/capi-service_test.yaml | 20 +++++ .../tests/deployment_test.yaml | 62 +++++++++++++ .../2.0.11+up0.3.11/tests/service_test.yaml | 18 ++++ .../2.0.11+up0.3.11/values.yaml | 26 ++++++ index.yaml | 22 +++++ release.yaml | 3 +- 17 files changed, 351 insertions(+), 1 deletion(-) create mode 100644 assets/rancher-webhook/rancher-webhook-2.0.11+up0.3.11.tgz create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/Chart.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/Chart.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/templates/service.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/_helpers.tpl create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/deployment.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/rbac.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/service.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/serviceaccount.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/templates/webhook.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/tests/README.md create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/tests/capi-service_test.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/tests/deployment_test.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/tests/service_test.yaml create mode 100644 charts/rancher-webhook/2.0.11+up0.3.11/values.yaml diff --git a/assets/rancher-webhook/rancher-webhook-2.0.11+up0.3.11.tgz b/assets/rancher-webhook/rancher-webhook-2.0.11+up0.3.11.tgz new file mode 100644 index 0000000000000000000000000000000000000000..54f6592b53d90b1d111fea30a58193e3ad7f5ab4 GIT binary patch literal 2705 zcmV;C3U2iuiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PGxVZ{xUeKkHWv92EPZl`KDE?+I;zTsC)I;F2?vV2k2#$kNi- zVndNyk#a7V&3`XQJuJzxolRV4d-Z&=O_4Lh$GkWrCxrVUCiWdpLm_Uvry)s{b5A1n zW@q5Kt~(kI&8O?S&Cg!1*MHL+jt2eX(Rer-zj1rR{%G_D+}*LT9#W}D^2U8Jt>)zZ zM}TlH6j4-g=~)0iQG|)P;}fMAI#hIhOcb3_3_QrsN^7@}1_5#pIx0!A)7s@Woua+K zL{h;$c>DLiLC@(A9M^W?ulnmd{q=3@P);J0G4auZtkIVDQeo8ESx65U<>_y&Ph(6X zs-#`^`pX^Vfw+^cy$kWEvE6sZIoEw>1JemIBob}Se7SgqpjjlQ9}A?5zD44={OLLa zr`NLrjFAV(eTvevZ14pSs4_i#5>p2`nKBG4fQ*7}v;Y!}g``R(_a1aQR)Eq^Xq=7v zNEi)>qI`Z5L{w^W|IGM-nMmL=;}O(-jM8f7yIhIB<2t?GpVK&J_q9**0iFX*{l6eA zMY&r8uucEF{c%(O9}jv5{l5>O5t*acP#gK7=r&~^K#{ozi(KLX%;-tV*hDbu-+S<3 zb|KUxL5W;h)|`ncVYyvV%+LYIRQG$Fk(8-RoKvZCT?G&dsV-36iR9LU8DSDFOY1c~ zGS_!SJ3uTF<-xo0cx+jbAJzJ3Gh|supajDtvu{SlsSqKb4g?r8aUUU94qPEZs8lSy zt}#>zM}<p>kIBB%GC@yf0EtKvk)MYSpMiN`9U76e7CAIYMgF|kts5nAs}(Q>fIKYnutuK zU~8pa(eXJV8*WkCuWAIMZJBYUynL)~z}XCa#Uzo zg$zh3?;=H`Xo;1>BGj{Ad#{EvsdL;SxNsD_~=j%9bzvu-I5 zJa}L3zZIb(0a3&&W6h@A$QXV7v^bTSrxy|Bhd&va%NhV$r4FDtcKNspJq@geVl5JY zf(;D~g;foiwRmTp7J{V_mZJBwR1O95#d80PGjer(az3e?ibCB#JQTF0B2oPK z*jX8Rc5(9kPiHr$CzB5w5me9Y20Z7d=Nr*PezXb8>B;r=PiHripD(Xh(JZl;Fyag3 z-hl}d;0t_Cg~D?2R*>o`ZpCb-*+8$Ox((FdbE^$_G z&D$qLghlhYN}QeAkw`udFrYt z?%uwWrB#%eEHLTn56b7ZkBO2sUTP}1jlBz0-%}o3X$(GA`%3gva}^@E!ry8u>XVpE zDWi&_tgkc)f_j4u7iZTu-+#Dxe{*$q`SHW)8LVeeW?Y>3zMgZdBhYTHR<3Q9INNS? zD$2L{bScy;+mthRGpP$cws<1;z8 z?@T~h1_h@ql?szf!BC4M;q8(4 z>n*`+ulKhGTjif*s`MplV5|Li8~6Wxw?91OfA<0niEp){+tq+=+fCi^JWRGs1MLAc z%94r%vdPC*3tBo?CwZ3BCmf~-G>S2if)kY`O{e!Uk+Mk!7I`6z;GNgrf!Brg@?Ydk z_F(^yhpYKN_aOiKfZF|kQ4^M5Xtjp`%Nnx0bnH~{8J(wD_w^#atc+Vx7f&O6o~oCT zeeJdW7GYKXrIOvtvy=DdXHFFCgvM6;KW@tZa6BF!WqZBrWS_V{D=4!4D~8;D;npaQXp~l*1iWArN!VSp?^n_36{6DUqS&bTd;eyJn2+ z`V{oT5@p|mYm`c3l0fD}(={bp84bbNJuJ~38NLW(rb~z{f|#Xq%3($mslcwa6@81U zt~pgr)@=KK;b zV4M7pM#HB6@Ad`<`QHb~lq$@nu($;%eZVYgFJza*bj|gUWll}jn<@`vC{h-HL{+J^ z%))sS-DgF{S;l^u1F0q9I@JH{2deU4 zsrYHAfJQBt^#XzaDw!zQaLlh|X@(Y)QeJ9l#M#{;R?MuKo*RoBX@u=KCL`;rMX> zvlrO-Hw3QZT9yA6Sk#}qHtPr20c?{0UDbkZ&Hwa{8~49G_mKbH4}4|)SGAy= 1.23.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-webhook +apiVersion: v2 +appVersion: 0.3.11 +dependencies: +- condition: capi.enabled + name: capi + repository: "" +description: ValidatingAdmissionWebhook for Rancher types +name: rancher-webhook +version: 2.0.11+up0.3.11 diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/Chart.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/Chart.yaml new file mode 100644 index 0000000000..388210bef1 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/Chart.yaml @@ -0,0 +1,4 @@ +apiVersion: v2 +appVersion: 0.0.0 +name: capi +version: 0.0.0 diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/templates/service.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/templates/service.yaml new file mode 100644 index 0000000000..de7c255c4e --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/charts/capi/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: webhook-service + annotations: + need-a-cert.cattle.io/secret-name: rancher-webhook-tls +spec: + ports: + - name: https + port: 443 + targetPort: {{ .Values.port | default 8777 }} + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/_helpers.tpl b/charts/rancher-webhook/2.0.11+up0.3.11/templates/_helpers.tpl new file mode 100644 index 0000000000..c37a65c6f3 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "rancher-webhook.labels" -}} +app: rancher-webhook +{{- end }} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/deployment.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/templates/deployment.yaml new file mode 100644 index 0000000000..13738feae0 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/deployment.yaml @@ -0,0 +1,83 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rancher-webhook +spec: + selector: + matchLabels: + app: rancher-webhook + template: + metadata: + labels: + app: rancher-webhook + spec: + {{- if .Values.capi.enabled }} + volumes: + - name: tls + secret: + secretName: rancher-webhook-tls + {{- end }} + {{- if .Values.global.hostNetwork }} + hostNetwork: true + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} + {{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 6 }} + {{- end }} + containers: + - env: + - name: STAMP + value: "{{.Values.stamp}}" + - name: ENABLE_CAPI + value: "{{.Values.capi.enabled}}" + - name: ENABLE_MCM + value: "{{.Values.mcm.enabled}}" + - name: CATTLE_PORT + value: {{.Values.port | default 9443 | quote}} + - name: CATTLE_CAPI_PORT + value: {{.Values.capi.port | default 8777 | quote}} + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: rancher-webhook + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + ports: + - name: https + containerPort: {{ .Values.port | default 9443 }} + - name: capi-https + containerPort: {{ .Values.capi.port | default 8777}} + startupProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + failureThreshold: 60 + periodSeconds: 5 + livenessProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + periodSeconds: 5 + {{- if .Values.capi.enabled }} + volumeMounts: + - name: tls + mountPath: /tmp/k8s-webhook-server/serving-certs + {{- end }} + {{- if .Values.capNetBindService }} + securityContext: + capabilities: + add: + - NET_BIND_SERVICE + {{- end }} + serviceAccountName: rancher-webhook + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + \ No newline at end of file diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/rbac.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/templates/rbac.yaml new file mode 100644 index 0000000000..f4364995c0 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/rbac.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: rancher-webhook + namespace: {{.Release.Namespace}} \ No newline at end of file diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/service.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/templates/service.yaml new file mode 100644 index 0000000000..220afebeae --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: rancher-webhook + namespace: cattle-system +spec: + ports: + - port: 443 + targetPort: {{ .Values.port | default 9443 }} + protocol: TCP + name: https + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/serviceaccount.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9e7ad7e1fe --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook-sudo + annotations: + cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation" \ No newline at end of file diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/templates/webhook.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/templates/webhook.yaml new file mode 100644 index 0000000000..53a0687b6f --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/templates/webhook.yaml @@ -0,0 +1,9 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: rancher.cattle.io +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: rancher.cattle.io diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/tests/README.md b/charts/rancher-webhook/2.0.11+up0.3.11/tests/README.md new file mode 100644 index 0000000000..6d3059a005 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/tests/README.md @@ -0,0 +1,16 @@ + +## local dev testing instructions + +Option 1: Full chart CI run with a live cluster + +```bash +./scripts/charts/ci +``` + +Option 2: Test runs against the chart only + +```bash +# install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git +bash dev-scripts/helm-unittest.sh +``` + diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/tests/capi-service_test.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/tests/capi-service_test.yaml new file mode 100644 index 0000000000..4ee94a84a4 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/tests/capi-service_test.yaml @@ -0,0 +1,20 @@ +suite: Test Service +templates: + - charts/capi/templates/service.yaml +tests: + - it: should set webhook default port values + set: + capi.enabled: true + asserts: + - equal: + path: spec.ports[0].targetPort + value: 8777 + + - it: should set updated target port + set: + capi.port: 2319 + capi.enabled: true + asserts: + - equal: + path: spec.ports[0].targetPort + value: 2319 diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/tests/deployment_test.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/tests/deployment_test.yaml new file mode 100644 index 0000000000..66a74d4e5f --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/tests/deployment_test.yaml @@ -0,0 +1,62 @@ +suite: Test Deployment +templates: + - deployment.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 9443 + - equal: + path: spec.template.spec.containers[0].ports[1].containerPort + value: 8777 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "9443" + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_CAPI_PORT + value: "8777" + + - it: should set updated webhook port + set: + port: 2319 + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 2319 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "2319" + + - it: should set updated capi port + set: + capi.port: 2319 + asserts: + - equal: + path: spec.template.spec.containers[0].ports[1].containerPort + value: 2319 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_CAPI_PORT + value: "2319" + + - it: should not set capabilities by default. + asserts: + - isNull: + path: spec.template.spec.containers[0].securityContext + + - it: should set net capabilities when capNetBindService is true. + set: + capNetBindService: true + asserts: + - contains: + path: spec.template.spec.containers[0].securityContext.capabilities.add + content: NET_BIND_SERVICE diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/tests/service_test.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/tests/service_test.yaml new file mode 100644 index 0000000000..03172ad033 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/tests/service_test.yaml @@ -0,0 +1,18 @@ +suite: Test Service +templates: + - service.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.ports[0].targetPort + value: 9443 + + - it: should set updated target port + set: + port: 2319 + asserts: + - equal: + path: spec.ports[0].targetPort + value: 2319 diff --git a/charts/rancher-webhook/2.0.11+up0.3.11/values.yaml b/charts/rancher-webhook/2.0.11+up0.3.11/values.yaml new file mode 100644 index 0000000000..e7945f8e42 --- /dev/null +++ b/charts/rancher-webhook/2.0.11+up0.3.11/values.yaml @@ -0,0 +1,26 @@ +image: + repository: rancher/rancher-webhook + tag: v0.3.11 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + hostNetwork: false + +capi: + enabled: false + port: 8777 + +mcm: + enabled: true + +# tolerations for the webhook deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info +tolerations: [] +nodeSelector: {} + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +# port assigns which port to use when running rancher-webhook +port: 9443 diff --git a/index.yaml b/index.yaml index 14c2e6bea3..f1b649ee1e 100755 --- a/index.yaml +++ b/index.yaml @@ -21368,6 +21368,28 @@ entries: urls: - assets/rancher-webhook/rancher-webhook-103.0.0+up0.4.0.tgz version: 103.0.0+up0.4.0 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.28.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-webhook + apiVersion: v2 + appVersion: 0.3.11 + created: "2024-06-13T11:27:20.782619874-03:00" + dependencies: + - condition: capi.enabled + name: capi + repository: "" + description: ValidatingAdmissionWebhook for Rancher types + digest: e2f551b3b0f8565c200471cc9acac3694c43da35be6e6588c3083083e180ee0c + name: rancher-webhook + urls: + - assets/rancher-webhook/rancher-webhook-2.0.11+up0.3.11.tgz + version: 2.0.11+up0.3.11 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 8b13789179..571dacc9bf 100644 --- a/release.yaml +++ b/release.yaml @@ -1 +1,2 @@ - +rancher-webhook: + - 2.0.11+up0.3.11