[release-v2.8] OOB Charts release for rancher-webhook 0.4.0, rancher-external-ip-webhook and system-upgrade-controller 103.0.0+up0.6.0

charts/rancher-external-ip-webhook/0.1.400/Chart.yaml

@@ -8,8 +8,7 @@ annotations:
   catalog.cattle.io/ui-component: rancher-external-ip-webhook
 apiVersion: v1
 appVersion: v0.1.4
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-external-ip-webhook/0.1.600/Chart.yaml

@@ -8,8 +8,7 @@ annotations:
   catalog.cattle.io/ui-component: rancher-external-ip-webhook
 apiVersion: v1
 appVersion: v0.1.6
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-external-ip-webhook/0.1.601/Chart.yaml

@@ -8,8 +8,7 @@ annotations:
   catalog.cattle.io/ui-component: rancher-external-ip-webhook
 apiVersion: v1
 appVersion: v0.1.6
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-external-ip-webhook/100.0.0+up1.0.0/Chart.yaml

@@ -9,8 +9,7 @@ annotations:
   catalog.cattle.io/ui-component: rancher-external-ip-webhook
 apiVersion: v1
 appVersion: v1.0.0
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-external-ip-webhook/100.0.1+up1.0.1/Chart.yaml

@@ -10,8 +10,7 @@ annotations:
   catalog.cattle.io/upstream-version: 1.0.1
 apiVersion: v1
 appVersion: v1.0.1
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-external-ip-webhook/100.0.2+up1.0.1/Chart.yaml

@@ -11,8 +11,7 @@ annotations:
   catalog.cattle.io/upstream-version: 1.0.1
 apiVersion: v1
 appVersion: v1.0.1
-description: |
-  Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
+description: Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
 home: https://github.com/rancher/externalip-webhook
 keywords:
 - cve

charts/rancher-webhook/103.0.0+up0.4.0/Chart.yaml

@@ -0,0 +1,18 @@
+annotations:
+  catalog.cattle.io/certified: rancher
+  catalog.cattle.io/hidden: "true"
+  catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.28.0-0'
+  catalog.cattle.io/namespace: cattle-system
+  catalog.cattle.io/os: linux
+  catalog.cattle.io/permits-os: linux,windows
+  catalog.cattle.io/rancher-version: '>= 2.8.0-0 < 2.9.0-0'
+  catalog.cattle.io/release-name: rancher-webhook
+apiVersion: v2
+appVersion: 0.4.0
+dependencies:
+- condition: capi.enabled
+  name: capi
+  repository: ""
+description: ValidatingAdmissionWebhook for Rancher types
+name: rancher-webhook
+version: 103.0.0+up0.4.0

charts/rancher-webhook/103.0.0+up0.4.0/charts/capi/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+appVersion: 0.0.0
+name: capi
+version: 0.0.0

charts/rancher-webhook/103.0.0+up0.4.0/charts/capi/templates/service.yaml

@@ -0,0 +1,13 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: webhook-service
+  annotations:
+    need-a-cert.cattle.io/secret-name: rancher-webhook-tls
+spec:
+  ports:
+  - name: https
+    port: 443
+    targetPort: {{ .Values.port | default 8777 }}
+  selector:
+    app: rancher-webhook

charts/rancher-webhook/103.0.0+up0.4.0/templates/_helpers.tpl

@@ -0,0 +1,22 @@
+{{- define "system_default_registry" -}}
+{{- if .Values.global.cattle.systemDefaultRegistry -}}
+{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
+{{- else -}}
+{{- "" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "rancher-webhook.labels" -}}
+app: rancher-webhook
+{{- end }}
+
+{{- define "linux-node-tolerations" -}}
+- key: "cattle.io/os"
+  value: "linux"
+  effect: "NoSchedule"
+  operator: "Equal"
+{{- end -}}
+
+{{- define "linux-node-selector" -}}
+kubernetes.io/os: linux
+{{- end -}}

charts/rancher-webhook/103.0.0+up0.4.0/templates/deployment.yaml

@@ -0,0 +1,102 @@
+{{- $auth := .Values.auth | default dict }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rancher-webhook
+spec:
+  selector:
+    matchLabels:
+      app: rancher-webhook
+  template:
+    metadata:
+      labels:
+        app: rancher-webhook
+    spec:
+      {{- if or .Values.capi.enabled $auth.clientCA }}
+      volumes:
+      {{- end }}
+      {{- if .Values.capi.enabled }}
+      - name: tls
+        secret:
+          secretName: rancher-webhook-tls
+      {{- end }}
+      {{- if $auth.clientCA }}
+      - name: client-ca
+        secret:
+          secretName: client-ca
+      {{- end }}
+      {{- if .Values.global.hostNetwork }}
+      hostNetwork: true
+      {{- end }}
+      nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
+      {{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+      {{- end }}
+      tolerations: {{ include "linux-node-tolerations" . | nindent 6 }}
+      {{- if .Values.tolerations }}
+{{ toYaml .Values.tolerations | indent 6 }}
+      {{- end }}
+      containers:
+      - env:
+        - name: STAMP
+          value: "{{.Values.stamp}}"
+        - name: ENABLE_CAPI
+          value: "{{.Values.capi.enabled}}"
+        - name: ENABLE_MCM
+          value: "{{.Values.mcm.enabled}}"
+        - name: CATTLE_PORT
+          value: {{.Values.port | default 9443 | quote}}
+        - name: CATTLE_CAPI_PORT
+          value: {{.Values.capi.port | default 8777 | quote}}
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- if $auth.allowedCNs }}
+        - name: ALLOWED_CNS
+          value: '{{ join "," $auth.allowedCNs }}'
+        {{- end }}
+        image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+        name: rancher-webhook
+        imagePullPolicy: "{{ .Values.image.imagePullPolicy }}"
+        ports:
+        - name: https
+          containerPort: {{ .Values.port | default 9443 }}
+        - name: capi-https
+          containerPort: {{ .Values.capi.port | default 8777}}
+        startupProbe:
+          httpGet:
+            path: "/healthz"
+            port: "https"
+            scheme: "HTTPS"
+          failureThreshold: 60
+          periodSeconds: 5
+        livenessProbe:
+          httpGet:
+            path: "/healthz"
+            port: "https"
+            scheme: "HTTPS"
+          periodSeconds: 5
+        {{- if or .Values.capi.enabled $auth.clientCA }}
+        volumeMounts:
+        {{- end }}
+        {{- if .Values.capi.enabled }}
+        - name: tls
+          mountPath: /tmp/k8s-webhook-server/serving-certs
+          readOnly: true
+        {{- end }}
+        {{- if $auth.clientCA }}
+        - name: client-ca
+          mountPath: /tmp/k8s-webhook-server/client-ca
+          readOnly: true
+        {{- end }}
+        {{- if .Values.capNetBindService }}
+        securityContext:
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+        {{- end }}
+      serviceAccountName: rancher-webhook
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{.Values.priorityClassName}}"
+      {{- end }}

charts/rancher-webhook/103.0.0+up0.4.0/templates/rbac.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: rancher-webhook
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: rancher-webhook
+  namespace: {{.Release.Namespace}}

charts/rancher-webhook/103.0.0+up0.4.0/templates/secret.yaml

@@ -0,0 +1,11 @@
+{{- $auth := .Values.auth | default dict }}
+{{- if $auth.clientCA }}
+apiVersion: v1
+data:
+  ca.crt: {{ $auth.clientCA }}
+kind: Secret
+metadata:
+  name: client-ca
+  namespace: cattle-system
+type: Opaque
+{{- end }}

charts/rancher-webhook/103.0.0+up0.4.0/templates/service.yaml

@@ -0,0 +1,13 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: rancher-webhook
+  namespace: cattle-system
+spec:
+  ports:
+  - port: 443
+    targetPort: {{ .Values.port | default 9443 }}
+    protocol: TCP
+    name: https
+  selector:
+    app: rancher-webhook

charts/rancher-webhook/103.0.0+up0.4.0/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rancher-webhook
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rancher-webhook-sudo
+  annotations:
+    cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation"

charts/rancher-webhook/103.0.0+up0.4.0/templates/webhook.yaml

@@ -0,0 +1,9 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: rancher.cattle.io
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: rancher.cattle.io

charts/rancher-webhook/103.0.0+up0.4.0/tests/README.md

@@ -0,0 +1,16 @@
+
+## local dev testing instructions
+
+Option 1: Full chart CI run with a live cluster
+
+```bash
+./scripts/charts/ci 
+```
+
+Option 2: Test runs against the chart only 
+
+```bash
+# install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git
+bash dev-scripts/helm-unittest.sh
+```
+

charts/rancher-webhook/103.0.0+up0.4.0/tests/capi-service_test.yaml

@@ -0,0 +1,20 @@
+suite: Test Service
+templates:
+  - charts/capi/templates/service.yaml
+tests:
+  - it: should set webhook default port values
+    set:
+      capi.enabled: true
+    asserts:
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 8777
+
+  - it: should set updated target port
+    set:
+      capi.port: 2319
+      capi.enabled: true
+    asserts:
+      - equal:
+          path: spec.ports[0].targetPort
+          value: 2319