KO-366: Replace kube-rbac-proxy functionality with controller-runtime…

… authz/authn filters (#341)

* Replaced kube-rbac-proxy functionality with controller-runtime authz/authn
* Upgraded till operator-sdk 1.39.1
* Removed support for deprecated ControllerManagerConfiguration struct and moved to a flag-based approach
* Moved webhook interface implementation from old deprecated to new CustomDefaulter and CustomerValidator interfaces for AerospikeCluster, backup, backup service
* Added support for metrics server with TLS integration with cert-manager
* Fixed test-case assertions
* Added scaffold for newly added NetworkPolicy

References:
* Kubebuilder Cert-manager integration for metrics endpoint: ✨ (go/v4): feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) kubernetes-sigs/kubebuilder#4400
* Kubebuilder releases: https://github.com/kubernetes-sigs/kubebuilder/releases
* Kubebuilder sample project: https://github.com/kubernetes-sigs/kubebuilder/tree/v4.4.0/testdata/project-v4
* Kube-rbac-proxy discontinue design doc: https://github.com/kubernetes-sigs/kubebuilder/blob/master/designs/discontinue_usage_of_kube_rbac_proxy.md
* Kubebuilder doc for kube-rbac-proxy migration: https://book.kubebuilder.io/reference/metrics#optional-by-using-network-policy-disabled-by-default

* Work deferred for next release:
Move webhook code to internal pkg

.golangci.yml

@@ -7,6 +7,7 @@ linters-settings:
           - allowedPackages: # Allow dot imports for testing packages
               - "github.com/onsi/ginkgo/v2"
               - "github.com/onsi/gomega"
+      - name: comment-spacings
   goconst:
     min-len: 2
     min-occurrences: 3
@@ -59,6 +60,7 @@ linters:
     - unconvert
     - unparam
     - whitespace
+    - ginkgolinter
     - lll
     - wsl # White space linter
 

Makefile

@@ -67,7 +67,7 @@ endif
 IMG ?= controller:latest
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.29.0
+ENVTEST_K8S_VERSION = 1.31.0
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -236,19 +236,19 @@ $(LOCALBIN):
 
 ## Tool Binaries
 KUBECTL ?= kubectl
-KUSTOMIZE ?= $(LOCALBIN)/kustomize-$(KUSTOMIZE_VERSION)
-CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
-ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
-GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
+KUSTOMIZE ?= $(LOCALBIN)/kustomize
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+ENVTEST ?= $(LOCALBIN)/setup-envtest
+GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v5.3.0
-CONTROLLER_TOOLS_VERSION ?= v0.14.0
-ENVTEST_VERSION ?= release-0.17
+KUSTOMIZE_VERSION ?= v5.4.3
+CONTROLLER_TOOLS_VERSION ?= v0.16.1
+ENVTEST_VERSION ?= release-0.19
 GOLANGCI_LINT_VERSION ?= v1.59.1
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.36.0
+OPERATOR_SDK_VERSION ?= v1.39.1
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -268,20 +268,22 @@ $(ENVTEST): $(LOCALBIN)
 .PHONY: golangci-lint
 golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
 $(GOLANGCI_LINT): $(LOCALBIN)
-	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,${GOLANGCI_LINT_VERSION})
+	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
 
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
 # $1 - target path with name of binary (ideally with version)
 # $2 - package url which can be installed
 # $3 - specific version of package
 define go-install-tool
-@[ -f $(1) ] || { \
+@[ -f "$(1)-$(3)" ] || { \
 set -e; \
 package=$(2)@$(3) ;\
 echo "Downloading $${package}" ;\
+rm -f $(1) || true ;\
 GOBIN=$(LOCALBIN) go install $${package} ;\
-mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
-}
+mv $(1) $(1)-$(3) ;\
+} ;\
+ln -sf $(1)-$(3) $(1)
 endef
 
 .PHONY: operator-sdk

api/v1/aerospikecluster_mutating_webhook.go

@@ -17,72 +17,67 @@ limitations under the License.
 package v1
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"strings"
 
 	"github.com/go-logr/logr"
-	"gomodules.xyz/jsonpatch/v2"
-	v1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	"github.com/aerospike/aerospike-kubernetes-operator/pkg/merge"
 	lib "github.com/aerospike/aerospike-management-lib"
 )
 
+// +kubebuilder:object:generate=false
+// Above marker prevents controller-gen from generating DeepCopy methods,
+// as it is used only for temporary operations and does not need to be deeply copied.
+type AerospikeClusterCustomDefaulter struct {
+	// Default values for various AerospikeCluster fields
+}
+
+// Implemented webhook.CustomDefaulter interface for future reference
+var _ webhook.CustomDefaulter = &AerospikeClusterCustomDefaulter{}
+
 //nolint:lll // for readability
 // +kubebuilder:webhook:path=/mutate-asdb-aerospike-com-v1-aerospikecluster,mutating=true,failurePolicy=fail,sideEffects=None,groups=asdb.aerospike.com,resources=aerospikeclusters,verbs=create;update,versions=v1,name=maerospikecluster.kb.io,admissionReviewVersions={v1}
 
-// Default implements webhook.Defaulter so a webhook will be registered for the type
-func (c *AerospikeCluster) Default(operation v1.Operation) admission.Response {
-	asLog := logf.Log.WithName(ClusterNamespacedName(c))
+// Default implements webhook.CustomDefaulter so a webhook will be registered for the type
+func (acd *AerospikeClusterCustomDefaulter) Default(_ context.Context, obj runtime.Object) error {
+	aerospikeCluster, ok := obj.(*AerospikeCluster)
+	if !ok {
+		return fmt.Errorf("expected AerospikeCluster, got %T", obj)
+	}
+
+	asLog := logf.Log.WithName(ClusterNamespacedName(aerospikeCluster))
 
 	asLog.Info(
 		"Setting defaults for aerospikeCluster", "aerospikecluster.Spec",
-		c.Spec,
-	)
-
-	var (
-		warn admission.Warnings
-		err  error
+		aerospikeCluster.Spec,
 	)
 
-	if warn, err = c.setDefaults(asLog); err != nil {
+	if err := aerospikeCluster.setDefaults(asLog); err != nil {
 		asLog.Error(err, "Mutate AerospikeCluster create failed")
-		return webhook.Denied(err.Error()).WithWarnings(warn...)
+		return err
 	}
 
 	asLog.Info("Setting defaults for aerospikeCluster completed")
 
 	asLog.Info(
-		"Added defaults for aerospikeCluster", "aerospikecluster.Spec", c.Spec,
+		"Added defaults for aerospikeCluster", "aerospikecluster.Spec", aerospikeCluster.Spec,
 	)
 
-	var patches []jsonpatch.JsonPatchOperation
-	patches = append(patches, webhook.JSONPatchOp{Operation: "replace", Path: "/spec", Value: c.Spec})
-
-	if operation == v1.Create {
-		patches = append(patches, webhook.JSONPatchOp{Operation: "replace", Path: "/metadata/labels", Value: c.Labels})
-	}
-
-	return webhook.Patched(
-		"Patched aerospike spec with defaults",
-		patches...,
-	).WithWarnings(warn...)
+	return nil
 }
 
-func (c *AerospikeCluster) setDefaults(asLog logr.Logger) (admission.Warnings, error) {
-	var warn admission.Warnings
+func (c *AerospikeCluster) setDefaults(asLog logr.Logger) error {
 	// If PDB is disabled, set maxUnavailable to nil
 	if GetBool(c.Spec.DisablePDB) {
 		c.Spec.MaxUnavailable = nil
-
-		warn = append(warn, fmt.Sprintf("Spec field 'spec.maxUnavailable' will be omitted from Custom Resource (CR) "+
-			"because 'spec.disablePDB' is true."))
 	} else if c.Spec.MaxUnavailable == nil {
 		// Set default maxUnavailable if not set
 		maxUnavailable := intstr.FromInt32(1)
@@ -99,22 +94,22 @@ func (c *AerospikeCluster) setDefaults(asLog logr.Logger) (admission.Warnings, e
 	// Need to set before setting defaults in aerospikeConfig.
 	// aerospikeConfig.namespace checks for racks
 	if err := c.setDefaultRackConf(asLog); err != nil {
-		return warn, err
+		return err
 	}
 
 	if c.Spec.AerospikeConfig == nil {
-		return warn, fmt.Errorf("spec.aerospikeConfig cannot be nil")
+		return fmt.Errorf("spec.aerospikeConfig cannot be nil")
 	}
 
 	// Set common aerospikeConfig defaults
 	// Update configMap
 	if err := c.setDefaultAerospikeConfigs(asLog, *c.Spec.AerospikeConfig, nil); err != nil {
-		return warn, err
+		return err
 	}
 
 	// Update racks configuration using global values where required.
 	if err := c.updateRacks(asLog); err != nil {
-		return warn, err
+		return err
 	}
 
 	// Set defaults for pod spec
@@ -145,7 +140,7 @@ func (c *AerospikeCluster) setDefaults(asLog logr.Logger) (admission.Warnings, e
 		c.Labels[AerospikeAPIVersionLabel] = AerospikeAPIVersion
 	}
 
-	return warn, nil
+	return nil
 }
 
 // SetDefaults applies defaults to the pod spec.