Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make webhook admission kind of work #16861

Merged
merged 6 commits into from
Oct 17, 2017
Merged

make webhook admission kind of work #16861

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d7cdcba
UPSTREAM: 52673: default service resolver for webhook admission
deads2k Oct 12, 2017
0db40a6
turn admission webhooks on in cluster up
deads2k Oct 12, 2017
ea12582
UPSTREAM: 53823: allow fail close webhook admission
deads2k Oct 12, 2017
099f600
UPSTREAM: 50476: fix the webhook unit test; the server cert needs to…
deads2k Oct 13, 2017
e8061fe
UPSTREAM: 53896: decode admission responses into a fresh object
deads2k Oct 13, 2017
b8e3c19
UPSTREAM: <drop>: drop in 1.9 rebase. Shims enough admission webhook…
deads2k Oct 13, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion pkg/cmd/server/api/latest/helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,6 @@ func ConvertOpenshiftAdmissionConfigToKubeAdmissionConfig(in map[string]configap
for _, pluginName := range sets.StringKeySet(in).List() {
openshiftConfig := in[pluginName]

fmt.Printf("#### adding for %T\n", openshiftConfig.Configuration)
kubeConfig := apiserver.AdmissionPluginConfiguration{
Name: pluginName,
Path: openshiftConfig.Location,
Expand Down
9 changes: 9 additions & 0 deletions pkg/cmd/server/origin/admission/plugin_initializer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ import (
kubeclientgoinformers "k8s.io/client-go/informers"
kubeclientgoclient "k8s.io/client-go/kubernetes"
"k8s.io/client-go/rest"
aggregatorapiserver "k8s.io/kube-aggregator/pkg/apiserver"
kclientsetexternal "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
kclientsetinternal "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
kexternalinformers "k8s.io/kubernetes/pkg/client/informers/informers_generated/externalversions"
Expand Down Expand Up @@ -144,6 +145,14 @@ func NewPluginInitializer(
cloudConfig,
restMapper,
quotaRegistry)
// upstream broke this, so we can't use their mechanism. We need to get an actual client cert and practically speaking privileged loopback will always have one
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

broke what?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

broke what?

They wire to the wrong client cert: kubernetes/kubernetes#53828 . Also, it's built such that using the "normal" constructor produces a plugin initializer that will panic on a "normal" admission chain.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That link helps. Next time I read your PR description.

kubePluginInitializer.SetClientCert(privilegedLoopbackConfig.TLSClientConfig.CertData, privilegedLoopbackConfig.TLSClientConfig.KeyData)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where can a webhook find the CA that signs this cert?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where can a webhook find the CA that signs this cert?

This cert is signed by the client CA for the apiservers. Since the our webhook apiservers are run as aggregated API servers, they automatically trust that CA (though a user could wire it differently). That means that normal cluster authentication and authorization (rbac) rules apply.

// this is a really problematic thing, because it breaks DNS resolution and IP routing, but its for an alpha feature that
// I need to work cluster-up
kubePluginInitializer.SetServiceResolver(aggregatorapiserver.NewClusterIPServiceResolver(
informers.GetClientGoKubeInformers().Core().V1().Services().Lister(),
))

openshiftPluginInitializer := &oadmission.PluginInitializer{
OpenshiftInternalAuthorizationClient: authorizationClient,
OpenshiftInternalBuildClient: buildClient,
Expand Down
37 changes: 19 additions & 18 deletions pkg/cmd/server/origin/aggregator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,24 +176,25 @@ var apiVersionPriorities = map[schema.GroupVersion]priority{
// can reasonably expect seems questionable.
{Group: "extensions", Version: "v1beta1"}: {group: 17900, version: 1},
// to my knowledge, nothing below here collides
{Group: "apps", Version: "v1beta1"}: {group: 17800, version: 1},
{Group: "authentication.k8s.io", Version: "v1"}: {group: 17700, version: 15},
{Group: "authentication.k8s.io", Version: "v1beta1"}: {group: 17700, version: 9},
{Group: "authorization.k8s.io", Version: "v1"}: {group: 17600, version: 15},
{Group: "authorization.k8s.io", Version: "v1beta1"}: {group: 17600, version: 9},
{Group: "autoscaling", Version: "v1"}: {group: 17500, version: 15},
{Group: "autoscaling", Version: "v2alpha1"}: {group: 17500, version: 9},
{Group: "batch", Version: "v1"}: {group: 17400, version: 15},
{Group: "batch", Version: "v2alpha1"}: {group: 17400, version: 9},
{Group: "certificates.k8s.io", Version: "v1beta1"}: {group: 17300, version: 9},
{Group: "networking.k8s.io", Version: "v1"}: {group: 17200, version: 15},
{Group: "policy", Version: "v1beta1"}: {group: 17100, version: 9},
{Group: "rbac.authorization.k8s.io", Version: "v1beta1"}: {group: 17000, version: 12},
{Group: "rbac.authorization.k8s.io", Version: "v1alpha1"}: {group: 17000, version: 9},
{Group: "settings.k8s.io", Version: "v1alpha1"}: {group: 16900, version: 9},
{Group: "storage.k8s.io", Version: "v1"}: {group: 16800, version: 15},
{Group: "storage.k8s.io", Version: "v1beta1"}: {group: 16800, version: 9},
{Group: "apiextensions.k8s.io", Version: "v1beta1"}: {group: 16700, version: 9},
{Group: "apps", Version: "v1beta1"}: {group: 17800, version: 1},
{Group: "authentication.k8s.io", Version: "v1"}: {group: 17700, version: 15},
{Group: "authentication.k8s.io", Version: "v1beta1"}: {group: 17700, version: 9},
{Group: "authorization.k8s.io", Version: "v1"}: {group: 17600, version: 15},
{Group: "authorization.k8s.io", Version: "v1beta1"}: {group: 17600, version: 9},
{Group: "autoscaling", Version: "v1"}: {group: 17500, version: 15},
{Group: "autoscaling", Version: "v2alpha1"}: {group: 17500, version: 9},
{Group: "batch", Version: "v1"}: {group: 17400, version: 15},
{Group: "batch", Version: "v2alpha1"}: {group: 17400, version: 9},
{Group: "certificates.k8s.io", Version: "v1beta1"}: {group: 17300, version: 9},
{Group: "networking.k8s.io", Version: "v1"}: {group: 17200, version: 15},
{Group: "policy", Version: "v1beta1"}: {group: 17100, version: 9},
{Group: "rbac.authorization.k8s.io", Version: "v1beta1"}: {group: 17000, version: 12},
{Group: "rbac.authorization.k8s.io", Version: "v1alpha1"}: {group: 17000, version: 9},
{Group: "settings.k8s.io", Version: "v1alpha1"}: {group: 16900, version: 9},
{Group: "storage.k8s.io", Version: "v1"}: {group: 16800, version: 15},
{Group: "storage.k8s.io", Version: "v1beta1"}: {group: 16800, version: 9},
{Group: "apiextensions.k8s.io", Version: "v1beta1"}: {group: 16700, version: 9},
{Group: "admissionregistration.k8s.io", Version: "v1alpha1"}: {group: 16700, version: 9},

// arbitrarily starting openshift around 10000.
// bump authorization above RBAC
Expand Down
16 changes: 9 additions & 7 deletions pkg/oc/bootstrap/docker/openshift/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -696,16 +696,21 @@ func useAggregator(version semver.Version) bool {
return version.GTE(version37)
}

func useTemplateServiceBroker(version semver.Version) bool {
return version.GTE(version37)
}

func (h *Helper) updateConfig(configDir string, opt *StartOptions) error {
cfg, configPath, err := h.GetConfigFromLocalDir(configDir)
if err != nil {
return err
}

// turn on admission webhooks by default. They are no-ops until someone explicitly tries to configure one
if cfg.AdmissionConfig.PluginConfig == nil {
cfg.AdmissionConfig.PluginConfig = map[string]configapi.AdmissionPluginConfig{}
}
cfg.AdmissionConfig.PluginConfig["GenericAdmissionWebhook"] = configapi.AdmissionPluginConfig{
Configuration: &configapi.DefaultAdmissionConfig{},
}
cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"] = append(cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"], "apis/admissionregistration.k8s.io/v1alpha1=true")

if len(opt.RoutingSuffix) > 0 {
cfg.RoutingConfig.Subdomain = opt.RoutingSuffix
} else {
Expand All @@ -721,9 +726,6 @@ func (h *Helper) updateConfig(configDir string, opt *StartOptions) error {
}

if len(opt.HTTPProxy) > 0 || len(opt.HTTPSProxy) > 0 || len(opt.NoProxy) > 0 {
if cfg.AdmissionConfig.PluginConfig == nil {
cfg.AdmissionConfig.PluginConfig = map[string]configapi.AdmissionPluginConfig{}
}

var buildDefaults *defaultsapi.BuildDefaultsConfig
buildDefaultsConfig, ok := cfg.AdmissionConfig.PluginConfig[defaultsapi.BuildDefaultsPlugin]
Expand Down
17 changes: 13 additions & 4 deletions vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/server.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 7 additions & 6 deletions vendor/k8s.io/kubernetes/pkg/apis/admissionregistration/validation/validation.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions vendor/k8s.io/kubernetes/pkg/apis/admissionregistration/validation/validation_test.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

25 changes: 20 additions & 5 deletions vendor/k8s.io/kubernetes/pkg/kubeapiserver/admission/initializer.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions vendor/k8s.io/kubernetes/plugin/pkg/admission/webhook/BUILD
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading