Use-case: deploying an admission webhook

[sttts]

My first journey with kustomize (embedded in kubectl 1.14) was an attempt to deploy a webhook with TLS certificates, and I either miss something in the feature set or this is out of scope.

Setup:

1. tls.crt + tls.key files created with a two liner openssl command.
2. both files must go into a secret
3. the tls.crt also has to be injected into a ValidatingWebhookConfiguration as a base64 encoded field, compare https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly

I understand the secret generator can do (1) if the command feature is enabled (it is not. Will it?) and obviously (2). (3) is a kind of templating. I thought the kustomize var feature can help, but it doesn't as the field paths are limited and cannot go into arrays or maps (secret's data field is a map, the key is tls.crt which cannot be part of a field part to my understanding).

Will this use-case be supported eventually? Is it in-scope for kustomize embedded in kubectl?

[soltysh]

/assign @Liujingfang1 @monopole

[petersutter]

@sttts I got (2) and (3) to work with the sample below (tested with kustomize v3.0.1).

DEMO_HOME=$(mktemp -d)

cat > $DEMO_HOME/kustomizeconfig.yaml << EOF
varReference:
  - path: webhooks/clientConfig/caBundle
    kind: ValidatingWebhookConfiguration
  - path: webhooks/clientConfig/caBundle
    kind: MutatingWebhookConfiguration

EOF


mkdir $DEMO_HOME/secret
cat > $DEMO_HOME/secret/tls.cert << EOF
-----BEGIN CERTIFICATE-----
Li4u
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Li4u
-----END CERTIFICATE-----

EOF

cat > $DEMO_HOME/secret/tls.key << EOF
-----BEGIN RSA PRIVATE KEY-----
Li4u
-----END RSA PRIVATE KEY-----

EOF

cat > $DEMO_HOME/admission_configurations.yaml << EOF
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: mutating-webhook-configuration
webhooks:
  - name: mutating-create-update
    clientConfig:
      url: https://example.com
      caBundle: \$(TLSCERT)
    failurePolicy: Fail
    rules:
      - apiGroups:
          - mygroup
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - myresource
    sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: validating-webhook-configuration
webhooks:
  - name: validating-create-update
    clientConfig:
      url: https://example.com
      caBundle: \$(TLSCERT)
    failurePolicy: Fail
    rules:
      - apiGroups:
          - mygroup
        apiVersions:
          - v1alpha1
        operations:
          - CREATE
          - UPDATE
        resources:
          - myresource
    sideEffects: None

EOF

cat > $DEMO_HOME/kustomization.yaml << EOF
resources:
- admission_configurations.yaml

namePrefix: test-

commonLabels:
  foo: bar

configurations:
  - kustomizeconfig.yaml

secretGenerator:
- name: webhook-server-cert
  files:
  - tls.crt=secret/tls.cert
  - tls.key=secret/tls.key
  type: "kubernetes.io/tls"

vars:
  - name: TLSCERT
    objref:
      kind: Secret
      version: v1
      name: webhook-server-cert
    fieldref:
      fieldpath: data[tls.crt]

EOF

kustomize build $DEMO_HOME

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[sttts]

/remove-lifecycle stale

[chainhead]

@sttts for your step (1), don't you also need to create a CertificateSigningRequest object in the cluster? And, then kubectl certificate approve csrName? Did you use kustomize for the CertificateSigningRequest YAML?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.