make webhook configurable

go.mod

@@ -75,7 +75,7 @@ require (
 	github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e // indirect
 	github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273 // indirect
 	github.com/renstrom/dedent v1.1.0 // indirect
-	github.com/robfig/cron v1.1.0 // indirect
+	github.com/robfig/cron v1.1.0
 	github.com/russross/blackfriday v1.5.2+incompatible // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.0.6

manifests/create-cert.sh

@@ -14,11 +14,35 @@ detailed explantion and additional instructions.
 
 The server key/cert k8s CA cert are stored in a k8s secret.
 
+       -n,--namespace        Namespace where webhook service and secret reside.
 EOF
     exit 1
 }
 
-namespace=default
+optstring=":-:n"
+
+while getopts "$optstring" opt; do
+    case $opt in
+        -)
+            case "$OPTARG" in
+                namespace)
+                    namespace="${2}"
+                    ;;
+                *)
+                    usage
+                    ;;
+            esac
+            ;;
+        n)
+            namespace="${2}"
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+
+namespace=${namespace:-tidb-admin}
 service=admission-controller-svc
 secret=admission-controller-certs
 
@@ -27,6 +51,12 @@ if [ ! -x "$(command -v openssl)" ]; then
     exit 1
 fi
 
+CURDIR=$(cd $(dirname ${BASH_SOURCE[0]}); pwd )
+
+# reset namespace and ca_bundle of webhook.yaml
+sed -i "s/caBundle:.*/caBundle: \${CA_BUNDLE}/g" $CURDIR/webhook.yaml
+sed -i "s/namespace:.*/namespace: \${NAMESPACE}/g" $CURDIR/webhook.yaml
+
 csrName=${service}.${namespace}
 tmpdir=$(mktemp -d)
 
@@ -99,3 +129,5 @@ kubectl create secret generic ${secret} \
         --from-file=cert.pem=${tmpdir}/server-cert.pem \
         --dry-run -o yaml |
     kubectl -n ${namespace} apply -f -
+
+sed -i "s/namespace: .*$/namespace: ${namespace}/g" $CURDIR/webhook.yaml

manifests/webhook.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: admission-controller-cr
-  namespace: default
+  namespace: ${NAMESPACE}
   labels:
     app: admission-webhook
 rules:
@@ -17,21 +17,21 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: admission-controller-sa
-  namespace: default
+  namespace: ${NAMESPACE}
   labels:
     app: admission-controller
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: admission-controller-crb
-  namespace: default
+  namespace: ${NAMESPACE}
   labels:
     app: admission-controller
 subjects:
 - kind: ServiceAccount
   name: admission-controller-sa
-  namespace: default
+  namespace: ${NAMESPACE}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -41,7 +41,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: admission-controller-svc
-  namespace: default
+  namespace: ${NAMESPACE}
   labels:
     app: admission-controller
 spec:
@@ -55,7 +55,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: admission-controller
-  namespace: default
+  namespace: ${NAMESPACE}
   labels:
     app: admission-controller
 spec:
@@ -99,7 +99,7 @@ webhooks:
     clientConfig:
       service:
         name: admission-controller-svc
-        namespace: default
+        namespace: ${NAMESPACE}
         path: "/statefulsets"
       caBundle: ${CA_BUNDLE}
     rules:

tests/actions.go

@@ -387,7 +387,7 @@ func (oa *operatorActions) DeployOperator(info *OperatorConfig) error {
 	}
 
 	// create cert and secret for webhook
-	cmd = fmt.Sprintf("%s/create-cert.sh", oa.manifestPath(info.Tag))
+	cmd = fmt.Sprintf("%s/create-cert.sh --namespace %s", oa.manifestPath(info.Tag), info.Namespace)
 	glog.Info(cmd)
 
 	res, err = exec.Command("/bin/sh", "-c", cmd).CombinedOutput()