Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(admission-controller,sysdig-deploy): add initial support for cert-manager #1791

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+65 −6
Draft

feat(admission-controller,sysdig-deploy): add initial support for cert-manager #1791

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/admission-controller/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: admission-controller
description: Sysdig Admission Controller using Sysdig Secure inline image scanner
type: application
version: 0.16.3
version: 0.17.0
appVersion: 3.9.46
home: https://sysdiglabs.github.io/admission-controller/
icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4
Expand Down
4 changes: 4 additions & 0 deletions charts/admission-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,10 @@ The following table lists the configurable parameters of the `admission-controll
| webhook.denyOnError | Deny request when an error happened evaluating request. | <code>false</code> |
| webhook.dryRun | Dry Run request | <code>false</code> |
| webhook.logLevel | Specifies the log level. The valid values are error, info, debug, trace. | <code>info</code> |
| webhook.ssl.certManager.enabled | Whether to use cert-manager for certificate management | <code>false</code> |
| webhook.ssl.certManager.issuer.group | The group of the existing issuer to use. | <code>cert-manager.io</code> |
| webhook.ssl.certManager.issuer.kind | The kind of the existing issuer to use. | <code>ClusterIssuer</code> |
| webhook.ssl.certManager.issuer.name | The name of the existing (Cluster)Issuer to use. Required if using cert-manager. | <code>""</code> |
| webhook.ssl.reuseTLSSecret | Reuse existing TLS Secret during chart upgrade. | <code>false</code> |
| webhook.ssl.ca.cert | Used for outbound connections, such as Secure backend and proxy. <br/>Used also for inbound connections to serve HttpRequests as Kubernetes Webhook. <br/>A PEM-encoded x509 certificate authority. | <code>""</code> |
| webhook.ssl.ca.certs | For outbound connections (secure backend, proxy,...) A PEM-encoded x509 certificate. This can also be a bundle with multiple certificates. | <code>[]</code> |
Expand Down
12 changes: 9 additions & 3 deletions charts/admission-controller/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,9 @@ webhooks:
name: {{ include "admissionController.webhook.fullname" . }}
path: /validate
port: {{ .Values.webhook.v2.service.port }}
caBundle: {{ .Cert }}
{{- with .Cert }}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was the laziest way I could think of to avoid reimplementing this template.

caBundle: {{ . }}
{{- end }}

admissionReviewVersions: ["v1", "v1beta1"]
sideEffects: None
Expand Down Expand Up @@ -453,7 +455,9 @@ webhooks:
name: {{ include "admissionController.webhook.fullname" . }}
path: /allow-pod
port: {{ .Values.webhook.service.port }}
caBundle: {{ .Cert }}
{{- with .Cert }}
caBundle: {{ . }}
{{- end }}
admissionReviewVersions: ["v1", "v1beta1"]
sideEffects: None
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
Expand All @@ -476,7 +480,9 @@ webhooks:
name: {{ include "admissionController.webhook.fullname" . }}
path: /k8s-audit
port: {{ .Values.webhook.service.port }}
caBundle: {{ .Cert }}
{{- with .Cert }}
caBundle: {{ . }}
{{- end }}
admissionReviewVersions: ["v1", "v1beta1"]
sideEffects: None
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
Expand Down
17 changes: 17 additions & 0 deletions charts/admission-controller/templates/webhook/admissionregistration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,19 @@
{{- if .Values.webhook.ssl.certManager.enabled }}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: {{ include "admissionController.namespace" . }}/{{ include "admissionController.webhook.fullname" . }}
helm.sh/hook: "post-install, post-upgrade"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what the thinking is behind all the $existingVac logic, so I just skipped it here.

meta.helm.sh/release-name: {{ .Release.Name }}
meta.helm.sh/release-namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/managed-by: Helm
name: {{ include "admissionController.webhook.fullname" . }}
namespace: {{ include "admissionController.namespace" . }}
{{- include "admissionController.webhookTemplate" . }}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that I don't inject any Cert value here so the resulting ValidatingWebhookConfiguration manifest won't contain any caBundle as per the _helper.tpl changes above.

{{- else }}
{{/*
We need to put all resources that need certificate or CA Bundle together,
so the template is executed just once
Expand Down Expand Up @@ -38,3 +54,4 @@ data:
tls.crt: {{ $certList._0 }}
tls.key: {{ $certList._1 }}
ca.crt: {{ $certList._2 }}
{{- end }}
24 changes: 24 additions & 0 deletions charts/admission-controller/templates/webhook/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
{{- if .Values.webhook.ssl.certManager.enabled }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
labels:
{{- include "admissionController.webhook.labels" . | nindent 4 }}
name: {{ include "admissionController.webhook.fullname" . }}
namespace: {{ include "admissionController.namespace" . }}
spec:
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a lot we could parameterize here, but I figure we should start simple and can always iterate.

dnsNames:
- {{ include "admissionController.webhook.fullname" . }}
- {{ include "admissionController.webhook.fullname" . }}.{{ include "admissionController.namespace" . }}.svc
issuerRef:
{{- with .Values.webhook.ssl.certManager.issuer.group }}
Copy link
Contributor Author

@yurrriq yurrriq Jun 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've deliberately done it this we so we can easily add a boolean parameter like webhook.ssl.certManager.issuer.create later to determine whether we should create an issuer.

group: {{ . }}
{{- end }}
{{- with .Values.webhook.ssl.certManager.issuer.kind }}
kind: {{ . }}
{{- end }}
{{- with .Values.webhook.ssl.certManager.issuer.name }}
name: {{ . }}
{{- end }}
secretName: {{ include "admissionController.webhook.fullname" . }}-tls
{{- end }}
8 changes: 8 additions & 0 deletions charts/admission-controller/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,6 +300,14 @@ webhook:
logLevel: info

ssl:
certManager:
# Use cert-manager for certificate management
enabled: false
issuer:
group: cert-manager.io
kind: ClusterIssuer
# Required if webhook.ssl.certManager.enabled is true
name: ""
# Reuse existing TLS Secret during chart upgrade.
reuseTLSSecret: false
ca:
Expand Down
4 changes: 2 additions & 2 deletions charts/sysdig-deploy/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: sysdig-deploy
description: A chart with various Sysdig components for Kubernetes
type: application
version: 1.56.11
version: 1.57.0
maintainers:
- name: AlbertoBarba
email: [email protected]
Expand All @@ -20,7 +20,7 @@ dependencies:
- name: admission-controller
# repository: https://charts.sysdig.com
repository: file://../admission-controller
version: ~0.16.3
version: ~0.17.0
alias: admissionController
condition: admissionController.enabled
- name: agent
Expand Down
Loading