Kubebuilder 学习笔记之 Webhook Server

kubebuilder init --domain blazehu.com --owner "blazehu" --repo blazehu.com/kubegame

kubebuilder create api --group svc --version v1 --kind App

// mutatingwebhook.go
package controllers

import (
 "context"
 "encoding/json"
 corev1 "k8s.io/api/core/v1"
 "net/http"
 "sigs.k8s.io/controller-runtime/pkg/client"
 "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
)

// +kubebuilder:webhook:admissionReviewVersions=v1,sideEffects=None,path=/mutate-v1-svc,mutating=true,failurePolicy=fail,groups="",resources=services,verbs=create;update,versions=v1,name=msvc.kb.io

// KubeGameAnnotator annotates Pods
type KubeGameAnnotator struct {
 Client client.Client
 decoder *admission.Decoder
}

// Handle adds an annotation to every incoming pods.
func (a *KubeGameAnnotator) Handle(ctx context.Context, req admission.Request) admission.Response {
 pod := &corev1.Pod{}

err := a.decoder.Decode(req, pod)
 if err != nil {
 return admission.Errored(http.StatusBadRequest, err)
 }

if pod.Annotations == nil {
 pod.Annotations = map[string]string{}
 }
 pod.Annotations["example-mutating-admission-webhook"] = "foo"

marshaledPod, err := json.Marshal(pod)
 if err != nil {
 return admission.Errored(http.StatusInternalServerError, err)
 }

return admission.PatchResponseFromRaw(req.Object.Raw, marshaledPod)
}

// KubeGameAnnotator implements admission.DecoderInjector.
// A decoder will be automatically injected.

// InjectDecoder injects the decoder.
func (a *KubeGameAnnotator) InjectDecoder(d *admission.Decoder) error {
 a.decoder = d
 return nil
}

// validatingwebhook.go
package controllers

import (
 "context"
 "fmt"
 corev1 "k8s.io/api/core/v1"
 "net/http"
 "sigs.k8s.io/controller-runtime/pkg/client"
 "sigs.k8s.io/controller-runtime/pkg/webhook/admission"
)

// +kubebuilder:webhook:admissionReviewVersions=v1,sideEffects=None,path=/validate-v1-svc,mutating=false,failurePolicy=fail,groups="",resources=services,verbs=create;update,versions=v1,name=vsvc.kb.io

// KubeGameValidator validates Pods
type KubeGameValidator struct {
 Client client.Client
 decoder *admission.Decoder
}

// Handle admits a pod if a specific annotation exists.
func (v *KubeGameValidator) Handle(ctx context.Context, req admission.Request) admission.Response {
 pod := &corev1.Pod{}

err := v.decoder.Decode(req, pod)
 if err != nil {
 return admission.Errored(http.StatusBadRequest, err)
 }

key := "example-mutating-admission-webhook"
 anno, found := pod.Annotations[key]
 if !found {
 return admission.Denied(fmt.Sprintf("missing annotation %s", key))
 }
 if anno != "foo" {
 return admission.Denied(fmt.Sprintf("annotation %s did not have value %q", key, "foo"))
 }

return admission.Allowed("")
}

// KubeGameValidator implements admission.DecoderInjector.
// A decoder will be automatically injected.

// InjectDecoder injects the decoder.
func (v *KubeGameValidator) InjectDecoder(d *admission.Decoder) error {
 v.decoder = d
 return nil
}

setupLog.Info("setting up webhook server")
hookServer := mgr.GetWebhookServer()

setupLog.Info("registering webhooks to the webhook server")
hookServer.Register("/mutate-v1-svc", &webhook.Admission{Handler: &controllers.KubeGameAnnotator{Client: mgr.GetClient()}})
hookServer.Register("/validate-v1-svc", &webhook.Admission{Handler: &controllers.KubeGameValidator{Client: mgr.GetClient()}})

1.646924212701068e+09 ERROR setup problem running manager {"error": "open /var/folders/67/375276sx6hv0nln1whwm5syh0000gq/T/k8s-webhook-server/serving-certs/tls.crt: no such file or directory"}

mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 Scheme: scheme,
 MetricsBindAddress: metricsAddr,
 Port: 9443,
 HealthProbeBindAddress: probeAddr,
 LeaderElection: enableLeaderElection,
 LeaderElectionID: "27e1b0af.blazehu.com",
 CertDir: "./cert/",
 })

# This patch add annotation to admission webhook config and
# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize.
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
 name: mutating-webhook-configuration
 annotations:
 cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
 name: validating-webhook-configuration
 annotations:
 cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)

make docker-build IMG=xxxx
make docker-push IMG=xxxx

make deploy IMG=xxxx