-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Setup VulnerabilityReport webhook conversion #283
Merged
matheusfm
merged 22 commits into
UD-1378-vulnreport-v1alpha2
from
UD-1378-vulnreport-v1alpha2-conversion
May 8, 2024
Merged
Setup VulnerabilityReport webhook conversion #283
matheusfm
merged 22 commits into
UD-1378-vulnreport-v1alpha2
from
UD-1378-vulnreport-v1alpha2-conversion
May 8, 2024
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
knrc
approved these changes
May 8, 2024
matheusfm
added a commit
that referenced
this pull request
Jun 3, 2024
…sion (#277) * create resource VulnerabilityReport v1alpha2 * add VulnerabilityReport v1alpha2 fields * generating clientset for vulnerabilityreport v1alpha2 * fix custom checks paths in Makefile * parse trivy results to v1alpha2 vulnerability reports * send v1alpha2 vulnerability reports to SaaS * update vulnerabilityreport samples * preserve unknown fields in .spec.vulnerabilities objects of v1alpha2 VulnerabilityReports * deprecate VulnerabilityReport v1alpha1 * Setup VulnerabilityReport webhook conversion (#283) * implement conversion.Hub in VulnerabilityReport v1alpha1 * move summarize function to v1alpha2 VulnerabilityReport * implement conversion.Convertible in VulnerabilityReport v1alpha2 * set imagePullPolicy to IfNotPresent in config/manager/manager.yaml * split install and install-crds targets in Makefile * logging vulnerability reports conversions * remove x-kubernetes-preserve-unknown-fields from v1alpha2 vulnerability report * setup webhook with cert-manager * setting TLSOpts in webhook server * generating CRDs with kustomize for applying webhook patch * installing yq in local binaries directory * fix CRD generation * updating CRD annotations * annotate CRD for injecting conversion * inject webhook conversion in annotated CRDs * add flag for enabling/disabling conversion * update helm chart for generating and mounting certificates if webhook is enabled * set annotation with jq instead of kustomize * remove unnecessary base64 encoding * bump chart version to 0.8.5-rc3 * move NAMESPACE var in Makefile * delete unused cert-manager files in config/ directory * remove logs from vulnerabilityreport_conversion.go * using certificates from existing secret if it already exists (#284) * Add fields `totalPackages` and `totalUniquePackages` in VulnerabilityReport (#285) * add fields `totalPackages` and `totalUniquePackages` in v1alpha2 VulnerabilityReport * bump chart version to 0.8.5-rc4 * remove TODO
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR sets up a webhook conversion for VulnerabilityReport CRD.
Now the operator is able to inject a webhook conversion in CRDs annotated with
zora.undistro.io/inject-conversion: "true"
.The
spec.conversion.webhook.clientConfig.caBundle
field in CRD, is set from a fileca.crt
mounted as volume in operator, and generated by Helm.A self-signed certificate is being generate by Helm, if it doesn't exist.
A Secret is also being created with three files:
tls.crt
,tls.key
, andca.crt
. This Secret is mounted as volume in webhook server (operator) wheretls.crt
andtls.key
files are used as server certificates andca.crt
is being set in CRD caBundle field on initialization.Most of files in
config/
directory are generated by kubebuilder. Documentation: https://book.kubebuilder.io/multiversion-tutorial/conversionLinked Issues
How has this been tested?
This is a script that I've used for testing:
Checklist