feat: custom sidecar config

[parkanzky]

Summary

Add CRD for applying patches to sidecar and init containers.

Two small deviations from the proposal -

1. Only one global config rather than one under each of sidecar and init. This is because the CRD already covers both.
2. Just validates that the CRD can be use to generate a jsonpatch rather than validating that a patched pod is valid. This is because users can chain patches together, and all that really matters is that the final result is valid, not any intermediate step. If they end up with an invalid config, they will get a useful error message from k8s.

Making this a draft until I can get the injector tests working locally.

Full changelog

• Add CRD to patch injected sidecar and init containers

Issues resolved

Fix #4273

Documentation

• Link to the website documentation PR

Testing

• Unit tests
• E2E tests
• Manual testing on Universal
• Manual testing on Kubernetes

Backwards compatibility

• Update UPGRADE.md with any steps users will need to take when upgrading.
• Add backport-to-stable label if the code follows our backporting policy

[lahabana]

Patch is a []Operation and Operation is a map[string]*json.RawMessage, RawMessage is a []byte.

So to me you can rebuild this all more easily with a

func ToJsonPatch(in []patchBlock) (jsonpatch.Patch) {
res := []jsonPath.Operation{}
for _, o := range in {
   res = append(res, map[string]*json.RawMessage{
       "op": (&o.op).(*json.RawMessage),
       ....
   })
}
return res
}

Seems like you'd solve potential injection problems and also a json deserialization cost

[parkanzky]

Nice, also building raw json by appending strings is pretty ugly.

[jakubdyszkiewicz]

Changed, not exactly like in the comment. Please take a look

[lahabana]

BTW I don't see the default in the CP no problem for adding it in a follow up PR but can you open an issue and add it to the project so we don't forget about it :)

[jakubdyszkiewicz]

BTW I don't see the default in the CP no problem for adding it in a follow up PR but can you open an issue and add it to the project so we don't forget about it :)

Why do we need a default?

[codecov-commenter]

Codecov Report

Merging #4280 (adfae5c) into master (bb4e42b) will decrease coverage by 0.09%.
The diff coverage is 37.16%.

@@            Coverage Diff             @@
##           master    #4280      +/-   ##
==========================================
- Coverage   55.75%   55.65%   -0.10%     
==========================================
  Files         935      937       +2     
  Lines       56434    56569     +135     
==========================================
+ Hits        31462    31483      +21     
- Misses      22498    22599     +101     
- Partials     2474     2487      +13     

Impacted Files	Coverage Δ
...s/k8s/native/api/v1alpha1/zz_generated.deepcopy.go	35.65% <0.00%> (-1.63%)	⬇️
pkg/plugins/runtime/k8s/metadata/annotations.go	100.00% <ø> (ø)
pkg/plugins/runtime/k8s/plugin.go	1.04% <0.00%> (-0.03%)	⬇️
...s/runtime/k8s/webhooks/containerpatch_validator.go	0.00% <0.00%> (ø)
pkg/plugins/runtime/k8s/webhooks/pod_mutator.go	0.00% <0.00%> (ø)
...est/framework/deployments/testserver/deployment.go	0.00% <0.00%> (ø)
...est/framework/deployments/testserver/kubernetes.go	0.00% <0.00%> (ø)
.../plugins/runtime/k8s/webhooks/injector/injector.go	68.77% <70.37%> (-0.28%)	⬇️
pkg/config/plugins/runtime/k8s/config.go	86.54% <100.00%> (+0.07%)	⬆️
...sources/k8s/native/api/v1alpha1/container_patch.go	100.00% <100.00%> (ø)
... and 10 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bb4e42b...adfae5c. Read the comment docs.

[lahabana]

That's getting in a good shape! One question re:selecting a patch that doesn't exist and should we add a webhook to validate that patches are only installed in the namespace of the CP?

[jakubdyszkiewicz]

That's getting in a good shape! One question re:selecting a patch that doesn't exist and should we add a webhook to validate that patches are only installed in the namespace of the CP?

yes we should, let me do it