Add overriding webhook operations

Signed-off-by: Yi Rae Kim <[email protected]>
stolostron · Nov 13, 2023 · 0b1ef2e · 0b1ef2e
1 parent d891239
commit 0b1ef2e
Show file tree

Hide file tree

Showing 12 changed files with 197 additions and 35 deletions.
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
@@ -93,6 +93,10 @@ jobs:
         echo "::group::Operator Logs"
         cat operator.log
         echo "::endgroup::"
+        echo "::group::Deployments"
+        kubectl -n gatekeeper-system get deployments -o yaml
+        echo "::endgroup::"
+
   
   configsync-e2e-test:
     name: Run configsync e2e tests 
@@ -134,6 +138,10 @@ jobs:
         echo "::group::Operator Logs"
         cat operator.log
         echo "::endgroup::"
+        echo "::group::Deployments"
+        kubectl -n gatekeeper-system get deployments -o yaml
+        echo "::endgroup::"
+
 
   gatekeeper-e2e-tests:
     name: Run gatekeeper e2e tests

diff --git a/api/v1alpha1/gatekeeper_types.go b/api/v1alpha1/gatekeeper_types.go
@@ -127,9 +127,14 @@ type WebhookConfig struct {
 	// +optional
 	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
 	// +optional
+	Operations *[]OperationType `json:"operations,omitempty"`
+	// +optional
 	DisabledBuiltins []string `json:"disabledBuiltins,omitempty"`
 }
 
+// +kubebuilder:validation:Enum:=CONNECT;CREATE;UPDATE;DELETE;*
+type OperationType admregv1.OperationType
+
 // +kubebuilder:validation:Enum:=DEBUG;INFO;WARNING;ERROR
 type LogLevelMode string
 

diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/bundle/manifests/gatekeeper-operator.clusterserviceversion.yaml b/bundle/manifests/gatekeeper-operator.clusterserviceversion.yaml
@@ -367,6 +367,8 @@ spec:
                   capabilities:
                     drop:
                     - ALL
+                  seccompProfile:
+                    type: RuntimeDefault
               - args:
                 - --health-probe-bind-address=:8081
                 - --metrics-bind-address=127.0.0.1:8080
@@ -403,6 +405,8 @@ spec:
                   capabilities:
                     drop:
                     - ALL
+                  seccompProfile:
+                    type: RuntimeDefault
               securityContext:
                 runAsNonRoot: true
               serviceAccountName: gatekeeper-operator-controller-manager

diff --git a/bundle/manifests/operator.gatekeeper.sh_gatekeepers.yaml b/bundle/manifests/operator.gatekeeper.sh_gatekeepers.yaml
@@ -1085,6 +1085,17 @@ spec:
                           "value". The requirements are ANDed.
                         type: object
                     type: object
+                  operations:
+                    items:
+                      description: OperationType specifies an operation for a request.
+                      enum:
+                      - CONNECT
+                      - CREATE
+                      - UPDATE
+                      - DELETE
+                      - '*'
+                      type: string
+                    type: array
                   replicas:
                     format: int32
                     minimum: 0

diff --git a/config/crd/bases/operator.gatekeeper.sh_gatekeepers.yaml b/config/crd/bases/operator.gatekeeper.sh_gatekeepers.yaml
@@ -1085,6 +1085,17 @@ spec:
                           "value". The requirements are ANDed.
                         type: object
                     type: object
+                  operations:
+                    items:
+                      description: OperationType specifies an operation for a request.
+                      enum:
+                      - CONNECT
+                      - CREATE
+                      - UPDATE
+                      - DELETE
+                      - '*'
+                      type: string
+                    type: array
                   replicas:
                     format: int32
                     minimum: 0

diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml
@@ -25,6 +25,8 @@ spec:
           capabilities:
             drop:
             - ALL
+          seccompProfile:
+                type: RuntimeDefault
       - name: manager
         args:
         - "--health-probe-bind-address=:8081"

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -34,6 +34,8 @@ spec:
         imagePullPolicy: Always
         securityContext:
           allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL

diff --git a/config/samples/gatekeeper_operations.yaml b/config/samples/gatekeeper_operations.yaml
@@ -0,0 +1,12 @@
+apiVersion: operator.gatekeeper.sh/v1alpha1
+kind: Gatekeeper
+metadata:
+  name: gatekeeper
+spec:
+  # Add fields here
+  webhook:
+    operations: 
+      - CREATE
+      - UPDATE
+      - DELETE
+      - CONNECT
diff --git a/controllers/gatekeeper_controller.go b/controllers/gatekeeper_controller.go
@@ -38,6 +38,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
+	"github.com/gatekeeper/gatekeeper-operator/api/v1alpha1"
 	operatorv1alpha1 "github.com/gatekeeper/gatekeeper-operator/api/v1alpha1"
 	"github.com/gatekeeper/gatekeeper-operator/controllers/merge"
 	"github.com/gatekeeper/gatekeeper-operator/pkg/platform"
@@ -620,6 +621,7 @@ func webhookOverrides(obj *unstructured.Unstructured, webhook *operatorv1alpha1.
 	return nil
 }
 
+// override common properties
 func webhookConfigurationOverrides(
 	obj *unstructured.Unstructured,
 	webhook *operatorv1alpha1.WebhookConfig,
@@ -644,9 +646,15 @@ func webhookConfigurationOverrides(
 				return err
 			}
 		}
+
+		if err := setOperators(obj, webhook.Operations, webhookName); err != nil {
+			return err
+		}
+
 		if err := setNamespaceSelector(obj, webhook.NamespaceSelector, gatekeeperNamespace, webhookName); err != nil {
 			return err
 		}
+
 	} else if err := setNamespaceSelector(obj, nil, gatekeeperNamespace, webhookName); err != nil {
 		return err
 	}
@@ -964,6 +972,44 @@ func setNamespaceSelector(
 	return setWebhookConfigurationWithFn(obj, webhookName, setNamespaceSelectorFn)
 }
 
+func setOperators(
+	obj *unstructured.Unstructured, operations *[]v1alpha1.OperationType, webhookName string,
+) error {
+	// If no operations is provided, no override for operations
+	if operations == nil {
+		return nil
+	}
+
+	setOperatorsFn := func(webhook map[string]interface{}) error {
+		rules := webhook["rules"].([]interface{})
+		if rules[0] == nil {
+			return nil
+		}
+
+		converted := make([]interface{}, len(*operations))
+		for i, op := range *operations {
+			converted[i] = string(op)
+		}
+
+		firtRuleObj := rules[0].(map[string]interface{})
+		newfirstRule := map[string]interface{}{
+			"apiGroups":   firtRuleObj["apiGroups"],
+			"apiVersions": firtRuleObj["apiVersions"],
+			"operations":  converted,
+			"resources":   firtRuleObj["resources"],
+			"scope":       firtRuleObj["scope"],
+		}
+
+		if err := unstructured.SetNestedSlice(webhook, []interface{}{newfirstRule}, "rules"); err != nil {
+			return errors.Wrapf(err, "Failed to set webhook namespace selector")
+		}
+
+		return nil
+	}
+
+	return setWebhookConfigurationWithFn(obj, webhookName, setOperatorsFn)
+}
+
 // Generic setters
 
 func setAffinity(obj *unstructured.Unstructured, spec operatorv1alpha1.GatekeeperSpec) error {

diff --git a/deploy/gatekeeper-operator.yaml b/deploy/gatekeeper-operator.yaml
@@ -1705,6 +1705,8 @@ spec:
           capabilities:
             drop:
             - ALL
+          seccompProfile:
+                type: RuntimeDefault
       - args:
         - --health-probe-bind-address=:8081
         - --metrics-bind-address=127.0.0.1:8080
@@ -1738,6 +1740,8 @@ spec:
             memory: 20Mi
         securityContext:
           allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL