Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update account-operator chart version to 0.5.61 and enable webhooks #251

Closed
wants to merge 3 commits into from
Closed

chore: update account-operator chart version to 0.5.61 and enable webhooks #251

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aee8f51
chore: update account-operator chart version to 0.5.61 and enable web…
akafazov Jan 22, 2025
155d120
update snapshot
akafazov Jan 22, 2025
0a43875
update docs
akafazov Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/account-operator/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: account-operator
description: A Helm chart to deploy OpenMFP Account-Operator
type: application
version: 0.5.60
version: 0.5.61
appVersion: "0.148.0"
dependencies:
- name: account-operator-crds
Expand Down
6 changes: 3 additions & 3 deletions charts/account-operator/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,19 +23,19 @@ A Helm chart to deploy OpenMFP Account-Operator
| kcp.enabled | bool | `false` | Enable KCP |
| kcp.virtualWorkspaceUrl | string | `""` | The URL for the virtual workspace |
| kubeconfigSecret | string | `""` | The secret for kubeconfig |
| logLevel | string | `"warn"` | The log level |
| logLevel | string | `"debug"` | The log level |
| security.mountServiceAccountToken | bool | `true` | Mount the service account token |
| subroutines.extension.enabled | bool | `true` | Enable extension subroutines |
| subroutines.extensionReady.enabled | bool | `true` | Enable extension ready subroutines |
| subroutines.fga.creatorRelation | string | `"owner"` | The creator relation for FGA |
| subroutines.fga.enabled | bool | `true` | Enable FGA subroutines |
| subroutines.fga.grpcAddr | string | `""` | The gRPC address for FGA |
| subroutines.fga.grpcAddr | string | `"openmfp-openfga:8081"` | The gRPC address for FGA |
| subroutines.fga.objectType | string | `"account"` | The object type for FGA |
| subroutines.fga.parentRelation | string | `"parent"` | The parent relation for FGA |
| subroutines.fga.rootNamespace | string | `"openmfp-root"` | The root namespace for FGA |
| subroutines.namespace.enabled | bool | `true` | Enable namespace subroutines |
| webhooks.certDir | string | `"/certs"` | The directory for webhook certificates |
| webhooks.enabled | bool | `false` | Enable webhooks |
| webhooks.enabled | bool | `true` | Enable webhooks |

## Overriding Values

Expand Down
170 changes: 158 additions & 12 deletions charts/account-operator/tests/__snapshot__/deployment_test.yaml.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,8 @@ operator match the snapshot:
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
name: account-operator
spec:
revisionHistoryLimit: 3
Expand All @@ -286,7 +288,8 @@ operator match the snapshot:
service: account-operator
template:
metadata:
annotations: null
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
labels:
control-plane: controller-manager
service: account-operator
Expand All @@ -296,15 +299,15 @@ operator match the snapshot:
- args:
- operator
- --leader-elect
- --log-level=warn
- --log-level=debug
- --health-probe-bind-address=:8081
env:
- name: SUBROUTINES_NAMESPACE_ENABLED
value: "true"
- name: SUBROUTINES_FGA_ENABLED
value: "true"
- name: SUBROUTINES_FGA_GRPC_ADDR
value: ""
value: openmfp-openfga:8081
- name: SUBROUTINES_FGA_ROOT_NAMESPACE
value: openmfp-root
- name: SUBROUTINES_FGA_OBJECT_TYPE
Expand All @@ -322,7 +325,7 @@ operator match the snapshot:
- name: KCP_VIRTUAL_WORKSPACE_URL
value: ""
- name: WEBHOOKS_ENABLED
value: "false"
value: "true"
- name: WEBHOOKS_CERT_DIR
value: /certs
image: ghcr.io/openmfp/account-operator:0.0.0
Expand All @@ -340,6 +343,9 @@ operator match the snapshot:
- containerPort: 8081
name: health-port
protocol: TCP
- containerPort: 9443
name: webhook-port
protocol: TCP
readinessProbe:
httpGet:
path: /readyz
Expand All @@ -364,7 +370,10 @@ operator match the snapshot:
path: /readyz
port: 8081
periodSeconds: 10
volumeMounts: null
volumeMounts:
- mountPath: /certs
name: cert
readOnly: true
hostAliases:
- hostnames:
- kcp.dev.local
Expand All @@ -375,14 +384,78 @@ operator match the snapshot:
type: RuntimeDefault
serviceAccountName: account-operator
terminationGracePeriodSeconds: 10
volumes: null
volumes:
- name: cert
secret:
defaultMode: 420
secretName: account-operator-webhook-server-cert
5: |
apiVersion: v1
imagePullSecrets:
- name: github
kind: ServiceAccount
metadata:
name: account-operator
6: |
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
name: account-operator-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: account-operator-webhook
namespace: NAMESPACE
path: /mutate-core-openmfp-io-v1alpha1-account
failurePolicy: Fail
name: maccount.kb.io
rules:
- apiGroups:
- core.openmfp.io
apiVersions:
- v1alpha1
operations:
- CREATE
resources:
- accounts
sideEffects: None
7: |
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: account-operator-selfsigned-issuer
spec:
selfSigned: {}
8: |
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: account-operator-serving-cert
spec:
dnsNames:
- account-operator-webhook.NAMESPACE.svc
- account-operator-webhook.NAMESPACE.svc.cluster.local
issuerRef:
kind: Issuer
name: account-operator-selfsigned-issuer
secretName: account-operator-webhook-server-cert
9: |
apiVersion: v1
kind: Service
metadata:
name: account-operator-webhook
spec:
ports:
- port: 443
protocol: TCP
targetPort: 9443
selector:
control-plane: controller-manager
service: account-operator
operator match the snapshot (with kubeconfigSecret):
1: |
apiVersion: apiextensions.k8s.io/v1
Expand Down Expand Up @@ -663,6 +736,8 @@ operator match the snapshot (with kubeconfigSecret):
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
name: account-operator
spec:
revisionHistoryLimit: 3
Expand All @@ -671,7 +746,8 @@ operator match the snapshot (with kubeconfigSecret):
service: account-operator
template:
metadata:
annotations: null
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
labels:
control-plane: controller-manager
service: account-operator
Expand All @@ -681,15 +757,15 @@ operator match the snapshot (with kubeconfigSecret):
- args:
- operator
- --leader-elect
- --log-level=warn
- --log-level=debug
- --health-probe-bind-address=:8081
env:
- name: SUBROUTINES_NAMESPACE_ENABLED
value: "true"
- name: SUBROUTINES_FGA_ENABLED
value: "true"
- name: SUBROUTINES_FGA_GRPC_ADDR
value: ""
value: openmfp-openfga:8081
- name: SUBROUTINES_FGA_ROOT_NAMESPACE
value: openmfp-root
- name: SUBROUTINES_FGA_OBJECT_TYPE
Expand All @@ -707,7 +783,7 @@ operator match the snapshot (with kubeconfigSecret):
- name: KCP_VIRTUAL_WORKSPACE_URL
value: ""
- name: WEBHOOKS_ENABLED
value: "false"
value: "true"
- name: WEBHOOKS_CERT_DIR
value: /certs
- name: KUBECONFIG
Expand All @@ -727,6 +803,9 @@ operator match the snapshot (with kubeconfigSecret):
- containerPort: 8081
name: health-port
protocol: TCP
- containerPort: 9443
name: webhook-port
protocol: TCP
readinessProbe:
httpGet:
path: /readyz
Expand Down Expand Up @@ -754,6 +833,9 @@ operator match the snapshot (with kubeconfigSecret):
volumeMounts:
- mountPath: /api-kubeconfig
name: external-api-server
- mountPath: /certs
name: cert
readOnly: true
securityContext:
runAsNonRoot: true
seccompProfile:
Expand All @@ -764,13 +846,77 @@ operator match the snapshot (with kubeconfigSecret):
- name: external-api-server
secret:
secretName: kubeconfig
- name: cert
secret:
defaultMode: 420
secretName: account-operator-webhook-server-cert
5: |
apiVersion: v1
imagePullSecrets:
- name: github
kind: ServiceAccount
metadata:
name: account-operator
6: |
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
name: account-operator-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: account-operator-webhook
namespace: NAMESPACE
path: /mutate-core-openmfp-io-v1alpha1-account
failurePolicy: Fail
name: maccount.kb.io
rules:
- apiGroups:
- core.openmfp.io
apiVersions:
- v1alpha1
operations:
- CREATE
resources:
- accounts
sideEffects: None
7: |
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: account-operator-selfsigned-issuer
spec:
selfSigned: {}
8: |
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: account-operator-serving-cert
spec:
dnsNames:
- account-operator-webhook.NAMESPACE.svc
- account-operator-webhook.NAMESPACE.svc.cluster.local
issuerRef:
kind: Issuer
name: account-operator-selfsigned-issuer
secretName: account-operator-webhook-server-cert
9: |
apiVersion: v1
kind: Service
metadata:
name: account-operator-webhook
spec:
ports:
- port: 443
protocol: TCP
targetPort: 9443
selector:
control-plane: controller-manager
service: account-operator
operator match the snapshot with webhook enabled:
1: |
apiVersion: apiextensions.k8s.io/v1
Expand Down Expand Up @@ -1072,15 +1218,15 @@ operator match the snapshot with webhook enabled:
- args:
- operator
- --leader-elect
- --log-level=warn
- --log-level=debug
- --health-probe-bind-address=:8081
env:
- name: SUBROUTINES_NAMESPACE_ENABLED
value: "true"
- name: SUBROUTINES_FGA_ENABLED
value: "true"
- name: SUBROUTINES_FGA_GRPC_ADDR
value: ""
value: openmfp-openfga:8081
- name: SUBROUTINES_FGA_ROOT_NAMESPACE
value: openmfp-root
- name: SUBROUTINES_FGA_OBJECT_TYPE
Expand Down
6 changes: 3 additions & 3 deletions charts/account-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ crds:

webhooks:
# -- Enable webhooks
enabled: false
enabled: true
# -- The directory for webhook certificates
certDir: /certs

Expand All @@ -29,7 +29,7 @@ subroutines:
# -- Enable FGA subroutines
enabled: true
# -- The gRPC address for FGA
grpcAddr: ""
grpcAddr: openmfp-openfga:8081
# -- The root namespace for FGA
rootNamespace: openmfp-root
# -- The object type for FGA
Expand All @@ -48,7 +48,7 @@ subroutines:
# -- The secret for kubeconfig
kubeconfigSecret: ""
# -- The log level
logLevel: warn
logLevel: debug

security:
# -- Mount the service account token
Expand Down
Loading