-
Notifications
You must be signed in to change notification settings - Fork 717
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
16 changed files
with
332 additions
and
5 deletions.
There are no files selected for viewing
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| annotations: | ||
| catalog.cattle.io/certified: rancher | ||
| catalog.cattle.io/hidden: "true" | ||
| catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.28.0-0' | ||
| catalog.cattle.io/namespace: cattle-system | ||
| catalog.cattle.io/os: linux | ||
| catalog.cattle.io/permits-os: linux,windows | ||
| catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' | ||
| catalog.cattle.io/release-name: rancher-webhook | ||
| apiVersion: v2 | ||
| appVersion: 0.3.13-rc.2 | ||
| dependencies: | ||
| - condition: capi.enabled | ||
| name: capi | ||
| repository: "" | ||
| description: ValidatingAdmissionWebhook for Rancher types | ||
| name: rancher-webhook | ||
| version: 2.0.13+up0.3.13-rc.2 |
4 changes: 4 additions & 0 deletions
4
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/charts/capi/Chart.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| apiVersion: v2 | ||
| appVersion: 0.0.0 | ||
| name: capi | ||
| version: 0.0.0 |
13 changes: 13 additions & 0 deletions
13
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/charts/capi/templates/service.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| kind: Service | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: webhook-service | ||
| annotations: | ||
| need-a-cert.cattle.io/secret-name: rancher-webhook-tls | ||
| spec: | ||
| ports: | ||
| - name: https | ||
| port: 443 | ||
| targetPort: {{ .Values.port | default 8777 }} | ||
| selector: | ||
| app: rancher-webhook |
22 changes: 22 additions & 0 deletions
22
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/_helpers.tpl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| {{- define "system_default_registry" -}} | ||
| {{- if .Values.global.cattle.systemDefaultRegistry -}} | ||
| {{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} | ||
| {{- else -}} | ||
| {{- "" -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{- define "rancher-webhook.labels" -}} | ||
| app: rancher-webhook | ||
| {{- end }} | ||
|
|
||
| {{- define "linux-node-tolerations" -}} | ||
| - key: "cattle.io/os" | ||
| value: "linux" | ||
| effect: "NoSchedule" | ||
| operator: "Equal" | ||
| {{- end -}} | ||
|
|
||
| {{- define "linux-node-selector" -}} | ||
| kubernetes.io/os: linux | ||
| {{- end -}} |
83 changes: 83 additions & 0 deletions
83
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: rancher-webhook | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: rancher-webhook | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: rancher-webhook | ||
| spec: | ||
| {{- if .Values.capi.enabled }} | ||
| volumes: | ||
| - name: tls | ||
| secret: | ||
| secretName: rancher-webhook-tls | ||
| {{- end }} | ||
| {{- if .Values.global.hostNetwork }} | ||
| hostNetwork: true | ||
| {{- end }} | ||
| nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} | ||
| {{- if .Values.nodeSelector }} | ||
| {{ toYaml .Values.nodeSelector | indent 8 }} | ||
| {{- end }} | ||
| tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} | ||
| {{- if .Values.tolerations }} | ||
| {{ toYaml .Values.tolerations | indent 6 }} | ||
| {{- end }} | ||
| containers: | ||
| - env: | ||
| - name: STAMP | ||
| value: "{{.Values.stamp}}" | ||
| - name: ENABLE_CAPI | ||
| value: "{{.Values.capi.enabled}}" | ||
| - name: ENABLE_MCM | ||
| value: "{{.Values.mcm.enabled}}" | ||
| - name: CATTLE_PORT | ||
| value: {{.Values.port | default 9443 | quote}} | ||
| - name: CATTLE_CAPI_PORT | ||
| value: {{.Values.capi.port | default 8777 | quote}} | ||
| - name: NAMESPACE | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: metadata.namespace | ||
| image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' | ||
| name: rancher-webhook | ||
| imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" | ||
| ports: | ||
| - name: https | ||
| containerPort: {{ .Values.port | default 9443 }} | ||
| - name: capi-https | ||
| containerPort: {{ .Values.capi.port | default 8777}} | ||
| startupProbe: | ||
| httpGet: | ||
| path: "/healthz" | ||
| port: "https" | ||
| scheme: "HTTPS" | ||
| failureThreshold: 60 | ||
| periodSeconds: 5 | ||
| livenessProbe: | ||
| httpGet: | ||
| path: "/healthz" | ||
| port: "https" | ||
| scheme: "HTTPS" | ||
| periodSeconds: 5 | ||
| {{- if .Values.capi.enabled }} | ||
| volumeMounts: | ||
| - name: tls | ||
| mountPath: /tmp/k8s-webhook-server/serving-certs | ||
| {{- end }} | ||
| {{- if .Values.capNetBindService }} | ||
| securityContext: | ||
| capabilities: | ||
| add: | ||
| - NET_BIND_SERVICE | ||
| {{- end }} | ||
| serviceAccountName: rancher-webhook | ||
| {{- if .Values.priorityClassName }} | ||
| priorityClassName: "{{.Values.priorityClassName}}" | ||
| {{- end }} | ||
|
|
12 changes: 12 additions & 0 deletions
12
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/rbac.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: rancher-webhook | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-admin | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: rancher-webhook | ||
| namespace: {{.Release.Namespace}} |
13 changes: 13 additions & 0 deletions
13
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/service.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| kind: Service | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: rancher-webhook | ||
| namespace: cattle-system | ||
| spec: | ||
| ports: | ||
| - port: 443 | ||
| targetPort: {{ .Values.port | default 9443 }} | ||
| protocol: TCP | ||
| name: https | ||
| selector: | ||
| app: rancher-webhook |
11 changes: 11 additions & 0 deletions
11
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/serviceaccount.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: rancher-webhook | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: rancher-webhook-sudo | ||
| annotations: | ||
| cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation" |
9 changes: 9 additions & 0 deletions
9
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/templates/webhook.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| apiVersion: admissionregistration.k8s.io/v1 | ||
| kind: ValidatingWebhookConfiguration | ||
| metadata: | ||
| name: rancher.cattle.io | ||
| --- | ||
| apiVersion: admissionregistration.k8s.io/v1 | ||
| kind: MutatingWebhookConfiguration | ||
| metadata: | ||
| name: rancher.cattle.io |
16 changes: 16 additions & 0 deletions
16
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/tests/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
|
|
||
| ## local dev testing instructions | ||
|
|
||
| Option 1: Full chart CI run with a live cluster | ||
|
|
||
| ```bash | ||
| ./scripts/charts/ci | ||
| ``` | ||
|
|
||
| Option 2: Test runs against the chart only | ||
|
|
||
| ```bash | ||
| # install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git | ||
| bash dev-scripts/helm-unittest.sh | ||
| ``` | ||
|
|
20 changes: 20 additions & 0 deletions
20
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/tests/capi-service_test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| suite: Test Service | ||
| templates: | ||
| - charts/capi/templates/service.yaml | ||
| tests: | ||
| - it: should set webhook default port values | ||
| set: | ||
| capi.enabled: true | ||
| asserts: | ||
| - equal: | ||
| path: spec.ports[0].targetPort | ||
| value: 8777 | ||
|
|
||
| - it: should set updated target port | ||
| set: | ||
| capi.port: 2319 | ||
| capi.enabled: true | ||
| asserts: | ||
| - equal: | ||
| path: spec.ports[0].targetPort | ||
| value: 2319 |
62 changes: 62 additions & 0 deletions
62
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/tests/deployment_test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| suite: Test Deployment | ||
| templates: | ||
| - deployment.yaml | ||
|
|
||
| tests: | ||
| - it: should set webhook default port values | ||
| asserts: | ||
| - equal: | ||
| path: spec.template.spec.containers[0].ports[0].containerPort | ||
| value: 9443 | ||
| - equal: | ||
| path: spec.template.spec.containers[0].ports[1].containerPort | ||
| value: 8777 | ||
| - contains: | ||
| path: spec.template.spec.containers[0].env | ||
| content: | ||
| name: CATTLE_PORT | ||
| value: "9443" | ||
| - contains: | ||
| path: spec.template.spec.containers[0].env | ||
| content: | ||
| name: CATTLE_CAPI_PORT | ||
| value: "8777" | ||
|
|
||
| - it: should set updated webhook port | ||
| set: | ||
| port: 2319 | ||
| asserts: | ||
| - equal: | ||
| path: spec.template.spec.containers[0].ports[0].containerPort | ||
| value: 2319 | ||
| - contains: | ||
| path: spec.template.spec.containers[0].env | ||
| content: | ||
| name: CATTLE_PORT | ||
| value: "2319" | ||
|
|
||
| - it: should set updated capi port | ||
| set: | ||
| capi.port: 2319 | ||
| asserts: | ||
| - equal: | ||
| path: spec.template.spec.containers[0].ports[1].containerPort | ||
| value: 2319 | ||
| - contains: | ||
| path: spec.template.spec.containers[0].env | ||
| content: | ||
| name: CATTLE_CAPI_PORT | ||
| value: "2319" | ||
|
|
||
| - it: should not set capabilities by default. | ||
| asserts: | ||
| - isNull: | ||
| path: spec.template.spec.containers[0].securityContext | ||
|
|
||
| - it: should set net capabilities when capNetBindService is true. | ||
| set: | ||
| capNetBindService: true | ||
| asserts: | ||
| - contains: | ||
| path: spec.template.spec.containers[0].securityContext.capabilities.add | ||
| content: NET_BIND_SERVICE |
18 changes: 18 additions & 0 deletions
18
charts/rancher-webhook/2.0.13+up0.3.13-rc.2/tests/service_test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| suite: Test Service | ||
| templates: | ||
| - service.yaml | ||
|
|
||
| tests: | ||
| - it: should set webhook default port values | ||
| asserts: | ||
| - equal: | ||
| path: spec.ports[0].targetPort | ||
| value: 9443 | ||
|
|
||
| - it: should set updated target port | ||
| set: | ||
| port: 2319 | ||
| asserts: | ||
| - equal: | ||
| path: spec.ports[0].targetPort | ||
| value: 2319 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| image: | ||
| repository: rancher/rancher-webhook | ||
| tag: v0.3.13-rc.2 | ||
| imagePullPolicy: IfNotPresent | ||
|
|
||
| global: | ||
| cattle: | ||
| systemDefaultRegistry: "" | ||
| hostNetwork: false | ||
|
|
||
| capi: | ||
| enabled: false | ||
| port: 8777 | ||
|
|
||
| mcm: | ||
| enabled: true | ||
|
|
||
| # tolerations for the webhook deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info | ||
| tolerations: [] | ||
| nodeSelector: {} | ||
|
|
||
| ## PriorityClassName assigned to deployment. | ||
| priorityClassName: "" | ||
|
|
||
| # port assigns which port to use when running rancher-webhook | ||
| port: 9443 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters