From e85c9171a5689585e913cc5d805349a866b467d0 Mon Sep 17 00:00:00 2001 From: Peter Matseykanets Date: Thu, 13 Jun 2024 09:31:36 -0400 Subject: [PATCH] [dev-v2.8] Bump rancher-webhook to 0.4.7 (#4081) --- .../rancher-webhook-103.0.6+up0.4.7.tgz | Bin 0 -> 2801 bytes .../103.0.6+up0.4.7/Chart.yaml | 14 +++ .../103.0.6+up0.4.7/templates/_helpers.tpl | 22 +++++ .../103.0.6+up0.4.7/templates/deployment.yaml | 82 ++++++++++++++++++ .../103.0.6+up0.4.7/templates/rbac.yaml | 12 +++ .../103.0.6+up0.4.7/templates/secret.yaml | 11 +++ .../103.0.6+up0.4.7/templates/service.yaml | 13 +++ .../templates/serviceaccount.yaml | 11 +++ .../103.0.6+up0.4.7/templates/webhook.yaml | 9 ++ .../103.0.6+up0.4.7/tests/README.md | 16 ++++ .../tests/deployment_test.yaml | 73 ++++++++++++++++ .../103.0.6+up0.4.7/tests/service_test.yaml | 18 ++++ .../103.0.6+up0.4.7/values.yaml | 30 +++++++ index.yaml | 18 ++++ packages/rancher-webhook/package.yaml | 4 +- release.yaml | 1 + 16 files changed, 332 insertions(+), 2 deletions(-) create mode 100644 assets/rancher-webhook/rancher-webhook-103.0.6+up0.4.7.tgz create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/Chart.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/_helpers.tpl create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/deployment.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/rbac.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/secret.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/service.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/serviceaccount.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/templates/webhook.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/tests/README.md create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/tests/deployment_test.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/tests/service_test.yaml create mode 100644 charts/rancher-webhook/103.0.6+up0.4.7/values.yaml diff --git a/assets/rancher-webhook/rancher-webhook-103.0.6+up0.4.7.tgz b/assets/rancher-webhook/rancher-webhook-103.0.6+up0.4.7.tgz new file mode 100644 index 0000000000000000000000000000000000000000..554038cafb75b60ebf25071e36dcd6b843b84d62 GIT binary patch literal 2801 zcmVDc zVQyr3R8em|NM&qo0PH($Z`(MN{j6UxaPH6#SIKhhIIVDdfY;6L6=>Wb3A%W&SY&Bw zY;#MIDoHu(P4nL$kb1Es%W<~}obCh97u$T98Ito#jwRvY0;PM4(}fV9y5j|r+FOyB zy?8S4ecvAr2KLkU{pM%S_xmq;gJJ*pWH=o9{TF_3aC|a&0shmmupLsRiG1NdnpSgh z{}3RY3r#c?Tm=q5NHk$$?uA5ah8`8&5T&LwictW$th5eW&?rJ4Ku60IJFP=LrBig5 zC>0evfS3RG1N6M(zUR9>{IB`?#(aI*I+c?cRYF1xAZv8hN@*{BXO%*M;Gc*WBb^9opXKcJ;1a?hD4!jm@hZ4P&9`m^kac^dF+rRDS!Ij zz&mv!RH3AawoM-iqY=@R&qq;Al^OR-h6rXt!exdW^eRE+v=c0s(DVDA?+yPaO)^5y zErJJlMrhjqC1EM5r*#0k?EgvMZ`%Kp-s!>q?*nK|=4dRx#6&2ng1ysnKI*rjDvBUBhZ4O%siL1fqH?EGYSzVOsrz$+Jh@Z zSZJN7ple-_WXd_^^9|c?1_tnEFz6dh7eta6HOg$`NU9geH4UwQ zvHNIUHA$#KxkTwXW{5e2BN&g`=G4bS$S86RCUj69yqf{WiC(=b+Xd$sW+!(`83Qgf zOtFd-BhQjMPnGSO5{1Koi#!xj)|cTLk8;U5f)QilmQkfa%wRmp*7lW*5x%mGke|tP zWw&8Gf<%fXjW7brOOhGWhT+hNPR0*0bpjyE_*moKcR@$t?3tl$qumncL##waEKBt6r zwy&qchRR(`#zWn)tuvqsruOsSuKyLM^vGy%hyD+S{%J%1PY3?+p#S>-BOw1}94`bv zl)7nue}UW(Ktw|gR%6yFD@hX7UG|($lt%%)EoH@tQIm*hV#0;?L{udhn%+W!v#>BG zI$XTB`k6HVv}!0oA)@)b3Oxg?hGHucfPxJJxpA`_;gxRw{yy(s3YNxLB6ahHWdq%i zl*AN<67`yR(K2ZrUokc{HX0_f5)`k8)*@va5^urT2uJUL@{py`He=$!7vPjfCQN$0 zm9r{Rum%{k_!o&;`-m^lj8zx*nZhRAixW2zPe{ZKX+^+~0RLrk+hkKfXV^IUk=tI6n?!FHelxu#897 z*YD46E;zq$m_*&C#s7bOeQ{Oon-R)ViPsB>Y9Uw@z|gOBCn%|it}qllQURQlU5qY~qf*br z_Ex@jxTV4|or{#Wo$9840*KAnO!c}tPP(67t3t-yEJ^ORO_NBX51g%PzNS@S8s;}7 z$prO}lt))6mo&thv|yOpyAHuM{#o1RkR)VE8Pyb3efvoi)f-%xoL%4i_-^v{=IZS7 z%Rcowc<635ov+c&FVqBZOYjvz}_iXXs_V`~;N%%DPz`OGQ zLBH3`|9i)W_rJYBHKw;GZfuQ^^e-C`d7oa}gt83u$1GJE<)vU~bei({R|Nc0FwCO> zlF*-}NRtPMIRG29O4MQ2=8`C;+)?TD4-AdzbMrY@HT~YoQP!TnDBj(9m)TRDHz``T zrOW?uuwDPN%;hO8z%KpoAD=Y!|HMD&|6btl89<{fv8W)iRU6g1 zxX#rmuZ0K+hbaP$6O>ADqO;P9=_(;gHOas-ucs5d^V}!!ys%yWi#O9f`2Ul^rvE?G zf9(ZoZ+b;(X?~&Ieg&{DMa?Tv$AZu3Jk5r0SMhaa?1s7cI>P6vejM57-s|rXHuYa= z)xA6$y*)qk;^;|e?DYSqP5mF74*LiF-v>BHN5Di#7(}=PbNZCefpVo~nw97|&Ijvk zp%=hUDPs^Wh}1BC2QuYwOZ5VXeL*QM=N#wv-+!MHwQ#&{=BicK&QaZvg6S+#9tUuZ zN*hcH$eb9uw(>5cAvjyX8r_lQi!f$~ERe;Juyjs2%&1fv+*(^Pwy6D_Q@u#1UMS+O z8Rn*(YO~(@FK31MJZM{^_9k|DV%g z?@<4@7f>nHm}_CBil+<%v&6ko3+6ahOtL3(Rysx`ni0)I ztG#;!jsG#YA(krEs7tC=bJYLDQ0e$XJjLnP_iKkXwiSo8)jh(F+Q&ypXziFD!S**6 z!)z&s*^fDFFLf);VO>^U83}pN|F_3~`Q7hR1b<(V|DE(V>c9Qr;r?eYP>uhJSD;4l zSA7WFTjW=UBkNb9Euq~*fmAm6$>XT6V$Py|?&Cec0S<70t?=&v00960V>axq07d`+ DA&+}8 literal 0 HcmV?d00001 diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/Chart.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/Chart.yaml new file mode 100644 index 0000000000..1f37a5a30e --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/Chart.yaml @@ -0,0 +1,14 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.29.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.8.0-0 < 2.9.0-0' + catalog.cattle.io/release-name: rancher-webhook +apiVersion: v2 +appVersion: 0.4.7 +description: ValidatingAdmissionWebhook for Rancher types +name: rancher-webhook +version: 103.0.6+up0.4.7 diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/_helpers.tpl b/charts/rancher-webhook/103.0.6+up0.4.7/templates/_helpers.tpl new file mode 100644 index 0000000000..c37a65c6f3 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "rancher-webhook.labels" -}} +app: rancher-webhook +{{- end }} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/deployment.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/deployment.yaml new file mode 100644 index 0000000000..b8a7201dac --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/deployment.yaml @@ -0,0 +1,82 @@ +{{- $auth := .Values.auth | default dict }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rancher-webhook +spec: + selector: + matchLabels: + app: rancher-webhook + template: + metadata: + labels: + app: rancher-webhook + spec: + {{- if $auth.clientCA }} + volumes: + - name: client-ca + secret: + secretName: client-ca + {{- end }} + {{- if .Values.global.hostNetwork }} + hostNetwork: true + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} + {{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 6 }} + {{- end }} + containers: + - env: + - name: STAMP + value: "{{.Values.stamp}}" + - name: ENABLE_MCM + value: "{{.Values.mcm.enabled}}" + - name: CATTLE_PORT + value: {{.Values.port | default 9443 | quote}} + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $auth.allowedCNs }} + - name: ALLOWED_CNS + value: '{{ join "," $auth.allowedCNs }}' + {{- end }} + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: rancher-webhook + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + ports: + - name: https + containerPort: {{ .Values.port | default 9443 }} + startupProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + failureThreshold: 60 + periodSeconds: 5 + livenessProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + periodSeconds: 5 + {{- if $auth.clientCA }} + volumeMounts: + - name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + {{- end }} + {{- if .Values.capNetBindService }} + securityContext: + capabilities: + add: + - NET_BIND_SERVICE + {{- end }} + serviceAccountName: rancher-webhook + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/rbac.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/rbac.yaml new file mode 100644 index 0000000000..f4364995c0 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/rbac.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: rancher-webhook + namespace: {{.Release.Namespace}} \ No newline at end of file diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/secret.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/secret.yaml new file mode 100644 index 0000000000..9fd331dc1e --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/secret.yaml @@ -0,0 +1,11 @@ +{{- $auth := .Values.auth | default dict }} +{{- if $auth.clientCA }} +apiVersion: v1 +data: + ca.crt: {{ $auth.clientCA }} +kind: Secret +metadata: + name: client-ca + namespace: cattle-system +type: Opaque +{{- end }} diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/service.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/service.yaml new file mode 100644 index 0000000000..220afebeae --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: rancher-webhook + namespace: cattle-system +spec: + ports: + - port: 443 + targetPort: {{ .Values.port | default 9443 }} + protocol: TCP + name: https + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/serviceaccount.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9e7ad7e1fe --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook-sudo + annotations: + cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation" \ No newline at end of file diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/templates/webhook.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/templates/webhook.yaml new file mode 100644 index 0000000000..53a0687b6f --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/templates/webhook.yaml @@ -0,0 +1,9 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: rancher.cattle.io +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: rancher.cattle.io diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/tests/README.md b/charts/rancher-webhook/103.0.6+up0.4.7/tests/README.md new file mode 100644 index 0000000000..6d3059a005 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/tests/README.md @@ -0,0 +1,16 @@ + +## local dev testing instructions + +Option 1: Full chart CI run with a live cluster + +```bash +./scripts/charts/ci +``` + +Option 2: Test runs against the chart only + +```bash +# install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git +bash dev-scripts/helm-unittest.sh +``` + diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/tests/deployment_test.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/tests/deployment_test.yaml new file mode 100644 index 0000000000..bbd6e30444 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/tests/deployment_test.yaml @@ -0,0 +1,73 @@ +suite: Test Deployment +templates: + - deployment.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 9443 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "9443" + + - it: should set updated webhook port + set: + port: 2319 + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 2319 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "2319" + + - it: should not set capabilities by default. + asserts: + - isNull: + path: spec.template.spec.containers[0].securityContext + + - it: should set net capabilities when capNetBindService is true. + set: + capNetBindService: true + asserts: + - contains: + path: spec.template.spec.containers[0].securityContext.capabilities.add + content: NET_BIND_SERVICE + + - it: should not set volumes or volumeMounts by default + asserts: + - isNull: + path: spec.template.spec.volumes + - isNull: + path: spec.template.spec.volumeMounts + + - it: should set CA fields when CA options are set + set: + auth.clientCA: base64-encoded-cert + auth.allowedCNs: + - kube-apiserver + - joe + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: client-ca + secret: + secretName: client-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + - contains: + path: spec.template.spec.containers[0].env + content: + name: ALLOWED_CNS + value: kube-apiserver,joe diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/tests/service_test.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/tests/service_test.yaml new file mode 100644 index 0000000000..03172ad033 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/tests/service_test.yaml @@ -0,0 +1,18 @@ +suite: Test Service +templates: + - service.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.ports[0].targetPort + value: 9443 + + - it: should set updated target port + set: + port: 2319 + asserts: + - equal: + path: spec.ports[0].targetPort + value: 2319 diff --git a/charts/rancher-webhook/103.0.6+up0.4.7/values.yaml b/charts/rancher-webhook/103.0.6+up0.4.7/values.yaml new file mode 100644 index 0000000000..14bf63ba87 --- /dev/null +++ b/charts/rancher-webhook/103.0.6+up0.4.7/values.yaml @@ -0,0 +1,30 @@ +image: + repository: rancher/rancher-webhook + tag: v0.4.7 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + hostNetwork: false + +mcm: + enabled: true + +# tolerations for the webhook deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info +tolerations: [] +nodeSelector: {} + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +# port assigns which port to use when running rancher-webhook +port: 9443 + +# Parameters for authenticating the kube-apiserver. +auth: + # CA for authenticating kube-apiserver client certs. If empty, client connections will not be authenticated. + # Must be base64-encoded. + clientCA: "" + # Allowlist of CNs for kube-apiserver client certs. If empty, any cert signed by the CA provided in clientCA will be accepted. + allowedCNs: [] diff --git a/index.yaml b/index.yaml index f1b649ee1e..55c954b62a 100755 --- a/index.yaml +++ b/index.yaml @@ -21270,6 +21270,24 @@ entries: - assets/rancher-vsphere-csi/rancher-vsphere-csi-2.1.000.tgz version: 2.1.000 rancher-webhook: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.29.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.8.0-0 < 2.9.0-0' + catalog.cattle.io/release-name: rancher-webhook + apiVersion: v2 + appVersion: 0.4.7 + created: "2024-06-13T09:00:52.878422-04:00" + description: ValidatingAdmissionWebhook for Rancher types + digest: 818411525d44ec3766524364a35228ccac57cade7c2ddc0da5e0845f26075a99 + name: rancher-webhook + urls: + - assets/rancher-webhook/rancher-webhook-103.0.6+up0.4.7.tgz + version: 103.0.6+up0.4.7 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/packages/rancher-webhook/package.yaml b/packages/rancher-webhook/package.yaml index 8f5c48a2f9..e1508f745e 100644 --- a/packages/rancher-webhook/package.yaml +++ b/packages/rancher-webhook/package.yaml @@ -1,3 +1,3 @@ -url: https://github.com/rancher/webhook/releases/download/v0.4.6/rancher-webhook-0.4.6.tgz -version: 103.0.5 +url: https://github.com/rancher/webhook/releases/download/v0.4.7/rancher-webhook-0.4.7.tgz +version: 103.0.6 doNotRelease: false diff --git a/release.yaml b/release.yaml index 571dacc9bf..b351520dd9 100644 --- a/release.yaml +++ b/release.yaml @@ -1,2 +1,3 @@ rancher-webhook: - 2.0.11+up0.3.11 + - 103.0.6+up0.4.7