Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Using admission server in e2e test instead of applying webhook.yaml #1377

Merged
merged 19 commits into from
Dec 20, 2019
Merged

Using admission server in e2e test instead of applying webhook.yaml #1377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
15aa554
Update admission-webhook-registration.yaml
Dec 19, 2019
c84a786
Update values.yaml
Dec 19, 2019
56af7cd
add webhook
Dec 19, 2019
3eb21f7
add into e2e
Dec 19, 2019
43a7400
use helm 2.14.1
Dec 19, 2019
bf35855
fix
Dec 19, 2019
8f1fb56
fix upgrade
Dec 19, 2019
b0af8d2
Update webhook.go
Dec 19, 2019
4e3fa4d
fix e2e
Dec 19, 2019
ef357f6
Merge branch 'master' into use_admission_server_in_e2e
Yisaer Dec 19, 2019
94c3bba
fix
Dec 20, 2019
2e3603c
embed webhook into operator cfg
Dec 20, 2019
611f710
Update webhook.go
Dec 20, 2019
c2ec2ea
Update values.yaml
Dec 20, 2019
9266413
move cabundle into operatorConfig
Dec 20, 2019
4aeabe3
Update tidbcluster.go
Dec 20, 2019
943ff43
Update tidbcluster.go
Dec 20, 2019
c8647c7
Update actions.go
Dec 20, 2019
50ac82d
Merge branch 'master' into use_admission_server_in_e2e
Yisaer Dec 20, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/tidb-operator/templates/admission/admission-webhook-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if eq .Values.admissionWebhook.create true }}
{{- if .Values.admissionWebhook.create }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why we have to change the criteria

Copy link
Contributor Author

@Yisaer Yisaer Dec 20, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cause {{- if eq .Values.admissionWebhook.create true }} didn't work well when I configure the setting by helm upgrade <name> <path> --set-string key=value which would casue a comparing type error, so I use {{- if .Values.admissionWebhook.create }} to avoid it.

By the way, {{- if .Values.key.create }} is more common used in our templates. It is better to unify the compare style.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is should be our helm BP

apiVersion: apps/v1
kind: Deployment
metadata:
Expand Down
2 changes: 1 addition & 1 deletion charts/tidb-operator/templates/admission/admission-webhook-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if and (eq .Values.admissionWebhook.create true) (eq .Values.admissionWebhook.rbac.create true) }}
{{- if and ( .Values.admissionWebhook.create ) ( .Values.admissionWebhook.rbac.create ) }}
apiVersion: v1
kind: ServiceAccount
metadata:
Expand Down
40 changes: 38 additions & 2 deletions charts/tidb-operator/templates/admission/admission-webhook-registration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if eq .Values.admissionWebhook.create true }}
{{- if .Values.admissionWebhook.create }}
apiVersion: apiregistration.k8s.io/v1beta1
kind: APIService
metadata:
Expand All @@ -10,7 +10,7 @@ metadata:
app.kubernetes.io/component: admission-webhook
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
spec:
{{- if eq .Values.admissionWebhook.apiservice.insecureSkipTLSVerify true }}
{{- if .Values.admissionWebhook.apiservice.insecureSkipTLSVerify }}
insecureSkipTLSVerify: true
{{- else }}
caBundle: {{ .Values.admissionWebhook.apiservice.cert | b64enc }}
Expand All @@ -23,6 +23,7 @@ spec:
namespace: {{ .Release.Namespace }}
version: v1alpha1
---
{{- if .Values.admissionWebhook.hooksEnabled.pods }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
Expand Down Expand Up @@ -92,5 +93,40 @@ webhooks:
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
{{- end }}
---
{{- if .Values.admissionWebhook.hooksEnabled.statefulSets }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
name: validation-update-tidb-admission-webhook-cfg
labels:
app.kubernetes.io/name: {{ template "chart.name" . }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: admission-webhook
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
webhooks:
- name: update.stsadmission.tidb.pingcap.com
failurePolicy: {{ .Values.admissionWebhook.failurePolicy.updateStatefulSet | default "Ignore" }}
clientConfig:
service:
name: kubernetes
namespace: default
path: "/apis/admission.tidb.pingcap.com/v1alpha1/admissionreviews"
{{- if .Values.admissionWebhook.cabundle }}
caBundle: {{ .Values.admissionWebhook.cabundle | b64enc }}
{{- else }}
caBundle: null
{{- end }}
rules:
- operations: [ "UPDATE" ]
apiGroups: [ "apps", "" ]
apiVersions: ["v1beta1", "v1"]
resources: ["statefulsets"]
- operations: [ "UPDATE" ]
apiGroups: [ "apps.pingcap.com"]
apiVersions: ["v1alpha1"]
resources: ["statefulsets"]
{{- end }}
{{- end }}
2 changes: 1 addition & 1 deletion charts/tidb-operator/templates/admission/admission-webhook-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if and (eq .Values.admissionWebhook.create true) (eq .Values.admissionWebhook.apiservice.insecureSkipTLSVerify false ) }}
{{- if and ( .Values.admissionWebhook.create ) ( eq .Values.admissionWebhook.apiservice.insecureSkipTLSVerify false ) }}
apiVersion: v1
kind: Secret
metadata:
Expand Down
2 changes: 1 addition & 1 deletion charts/tidb-operator/templates/admission/admission-webhook-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if eq .Values.admissionWebhook.create true }}
{{- if .Values.admissionWebhook.create }}
apiVersion: v1
kind: Service
metadata:
Expand Down
12 changes: 10 additions & 2 deletions charts/tidb-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,13 +182,22 @@ admissionWebhook:
serviceAccount: tidb-admission-webhook
rbac:
create: true
hooksEnabled:
## statefulsets hook would check requests for updating tidbcluster's statefulsets
## If enabled it, the statefulsets of tidbcluseter would update in partition by tidbcluster's annotation
statefulSets: false
## pods hook would check requests for creating and deleting tidbcluster's pods
## if enabled it, the pods of tidbcluster would safely created or deleted by webhook instead of controller
pods: true
## failurePolicy are applied to ValidatingWebhookConfiguration which affect tidb-admission-webhook
## refer to https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
failurePolicy:
## deletePod Webhook would check the deleting request of tidbcluster pod and the failurePolicy is recommended as Fail
## createPod Webhook would check the creating request of tidbcluster pod and the failurePolicy is recommended as Ignore
deletePod: Fail
## createPod Webhook would check the creating request of tidbcluster pod and the failurePolicy is recommended as Ignore
createPod: Ignore
## updateStatefulSet Webhook would check the updating request of tidbcluster statefulset and the failurePolicy is recommended as Ignore
updateStatefulSet: Ignore
## tidb-admission-webhook deployed as kubernetes apiservice server
## refer to https://github.com/openshift/generic-admission-server
apiservice:
Expand All @@ -206,4 +215,3 @@ admissionWebhook:
## or you can get the cabundle by:
## kubectl get configmap -n kube-system extension-apiserver-authentication -o=jsonpath='{.data.client-ca-file}'
cabundle: ""

62 changes: 0 additions & 62 deletions manifests/patch-e2e.sh
View file
Open in desktop

This file was deleted.

178 changes: 0 additions & 178 deletions manifests/webhook.yaml
View file
Open in desktop

This file was deleted.

Loading