From 033adffc2f3c1e91f2dcfba2a1fb93b8f19f43aa Mon Sep 17 00:00:00 2001 From: Eric Promislow Date: Tue, 14 Jan 2025 14:16:34 -0800 Subject: [PATCH] make charts --- .../rancher-webhook-104.0.6+up0.5.6-rc.2.tgz | Bin 0 -> 2793 bytes .../104.0.6+up0.5.6-rc.2/Chart.yaml | 14 +++ .../templates/_helpers.tpl | 22 +++++ .../templates/deployment.yaml | 82 ++++++++++++++++++ .../104.0.6+up0.5.6-rc.2/templates/rbac.yaml | 12 +++ .../templates/secret.yaml | 11 +++ .../templates/service.yaml | 13 +++ .../templates/serviceaccount.yaml | 11 +++ .../templates/webhook.yaml | 9 ++ .../104.0.6+up0.5.6-rc.2/tests/README.md | 16 ++++ .../tests/deployment_test.yaml | 73 ++++++++++++++++ .../tests/service_test.yaml | 18 ++++ .../104.0.6+up0.5.6-rc.2/values.yaml | 30 +++++++ index.yaml | 18 ++++ 14 files changed, 329 insertions(+) create mode 100644 assets/rancher-webhook/rancher-webhook-104.0.6+up0.5.6-rc.2.tgz create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/Chart.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/_helpers.tpl create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/deployment.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/rbac.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/secret.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/service.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/serviceaccount.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/webhook.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/README.md create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/deployment_test.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/service_test.yaml create mode 100644 charts/rancher-webhook/104.0.6+up0.5.6-rc.2/values.yaml diff --git a/assets/rancher-webhook/rancher-webhook-104.0.6+up0.5.6-rc.2.tgz b/assets/rancher-webhook/rancher-webhook-104.0.6+up0.5.6-rc.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..9c8f4f6bbc92ff30ecce1cd0a5472d3cd5994905 GIT binary patch literal 2793 zcmVDc zVQyr3R8em|NM&qo0PGuGZyPr<&-*I|@*VPU+0}<7xmmOasEXSQ5G#glq&O6XOYM#% z#$0kka^?eT(0?X5_} zUOX9eI-Sn2-?yKgPN)9aHQ&4alYVzF>~@C37oBduH|V^8&eMso9TKI9e9?I{ulnTv zCO|kBnrJGx@*RMHXu`zY3y9VXJu2D(N=;`JLmx6-X+&GlFhuS{OUndXjVL$C6x}6C zMFscad+2({U9aPI8j(4PP{kxbAJRrwt(3;75m_i780Eg`!%>RiQ%dx+(!^GWTIw(jNdz z;XGmNTre7}e0V#X2z@S5A=i#GXJSfN=36wgyZ};TeuFcTFnxh@s^mo*5zK**$p5Mw4*5pwOpB_b@ej+NiG zen@iEsEo;mB2eu>@Bm}2+A3IJm@vxcE-q!3rYpM);}OJC zENO@#P+qW1g*E~QMs-qoh+&W6c#>+ta~t;;K;8dqjABMKs`m8)S&UM7I)3C)u*3g% zP6oZ2{~r#Ahxl(VaChfIh%?F&TB%dM4pXmuEi<>=0{8yjF^F^q-iI_mNZooK`ZT)p zVpuFG*E4ASQ?*-PMF5$?;zw&O5Aty1yHlP~O}jltrpQ!EfW+};u#{7(6S8rmYrJ~t z5XcC*aD(RTD#xS78`)6G&&HYtoXs%MKC~v{GCgN(q%2}X&zuvj(@zOut?lzEiJ`L7 zC6%Firmf@Q5~b$--){e<^XQS$;12um4?8C{`#|Dmu=`};Fw zjsQX$Xs{Nu&R<9ztM;<%+)y6+@TSleCqhj^qKSzVniCQgV_ z=6TDc5x?YYDq_@JWGNnAqgH}s8x3!vS&KyPfbxJP;WlUD!Drx+&Q34SN8{5v$)BW%%Bl}AqsYPwoK;)1_H&{a zeqp{|ap6vfGqK z?spytlsve0`%MSL|nKj(s`y1Vw%qv1PJI#tb#NH~`j$(Aind^o*lP~KHU3dq=77XxN*UD@RdxAE7*-oxn4Df+|M+(D=KAvV;=|jLXWEcY zr9zB?z^udM0aL5ZW8+37Oh8^y+(zvo`>Zw+?ZKS@KW$GCx= z@qefG{@3gDdM5|_-v`tzzA=j4?FL-et^1CzqvWb2G#NmxEG;h{u>~9D`l#0BC@X^q z2!|;GjbfBaaH7+yis>pQO4ZrGGOMc+y!G5W@Vv0y{_{7}J)Hl8{^t2VJlOv}pz@}d zml$Rj+Rax0>ypH*5^*f}jLwr3eY=UT%Op44#g{QYOZ4N|KKELGi?C_`N~`w8>FCYb zsTYM$!ei(8e^R&q{>iX+u>XC4b94ku1cX6|OE9}n`5Y)$S|(|Ap5wf?hb?q{_$grw zf(4Np#&1C;9B!#z0I@G9`Q@DB{QmpzQ=%4**G`XW)wW|)JD^}X3z9t_u25-1NdcJ? z!`Bwwr91>@D_D~|vT_l|EXo2|1TjnIl*5clrNOPV<+yp-=bY+AGW7xxwGEn^aH`FG ztG~QC)sEq2*2B%kucD|$I*I4ryQhF=`(M}oT-zBxE(X|P|Hmi&<9hwiuzRTg+Y6|K zYRs&#RK-(-fobAis|9l$t0rk5)jp_&NLUC8b*cI~&EIW0pZ=>L&B~R+(i^l3_$f*2 z!>jMBD#pOe#qjK}b>YRYo!{&|f&Ef>tloV7f1Teq7-ku+`U-x?m$esimzxEdf zH^9QgYIRBFYL4pv7fKx;#Z&Blb-i|2V^eWRQ{5x%sC|5thE}%e5n_L3G0c{7nEklJ z=2Ex99aeSamC=v~&;RE5FT4AFis0`H^1s3HM*X+>IK+Q@fO7nozXH{Qzw$%i-Xgyu v99h2-Z3*oj3Z&A(Paa2ok#Lsub8qhf4sd`2Y=!>?00960U;b#a07L))$OC}! literal 0 HcmV?d00001 diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/Chart.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/Chart.yaml new file mode 100644 index 000000000..17bb8e518 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/Chart.yaml @@ -0,0 +1,14 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: < 1.31.0-0 + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-webhook +apiVersion: v2 +appVersion: 0.5.6-rc.2 +description: ValidatingAdmissionWebhook for Rancher types +name: rancher-webhook +version: 104.0.6+up0.5.6-rc.2 diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/_helpers.tpl b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/_helpers.tpl new file mode 100644 index 000000000..c37a65c6f --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "rancher-webhook.labels" -}} +app: rancher-webhook +{{- end }} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/deployment.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/deployment.yaml new file mode 100644 index 000000000..b8a7201da --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/deployment.yaml @@ -0,0 +1,82 @@ +{{- $auth := .Values.auth | default dict }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rancher-webhook +spec: + selector: + matchLabels: + app: rancher-webhook + template: + metadata: + labels: + app: rancher-webhook + spec: + {{- if $auth.clientCA }} + volumes: + - name: client-ca + secret: + secretName: client-ca + {{- end }} + {{- if .Values.global.hostNetwork }} + hostNetwork: true + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} + {{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 6 }} + {{- end }} + containers: + - env: + - name: STAMP + value: "{{.Values.stamp}}" + - name: ENABLE_MCM + value: "{{.Values.mcm.enabled}}" + - name: CATTLE_PORT + value: {{.Values.port | default 9443 | quote}} + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $auth.allowedCNs }} + - name: ALLOWED_CNS + value: '{{ join "," $auth.allowedCNs }}' + {{- end }} + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: rancher-webhook + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + ports: + - name: https + containerPort: {{ .Values.port | default 9443 }} + startupProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + failureThreshold: 60 + periodSeconds: 5 + livenessProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + periodSeconds: 5 + {{- if $auth.clientCA }} + volumeMounts: + - name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + {{- end }} + {{- if .Values.capNetBindService }} + securityContext: + capabilities: + add: + - NET_BIND_SERVICE + {{- end }} + serviceAccountName: rancher-webhook + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/rbac.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/rbac.yaml new file mode 100644 index 000000000..f4364995c --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/rbac.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: rancher-webhook + namespace: {{.Release.Namespace}} \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/secret.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/secret.yaml new file mode 100644 index 000000000..9fd331dc1 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/secret.yaml @@ -0,0 +1,11 @@ +{{- $auth := .Values.auth | default dict }} +{{- if $auth.clientCA }} +apiVersion: v1 +data: + ca.crt: {{ $auth.clientCA }} +kind: Secret +metadata: + name: client-ca + namespace: cattle-system +type: Opaque +{{- end }} diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/service.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/service.yaml new file mode 100644 index 000000000..220afebea --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: rancher-webhook + namespace: cattle-system +spec: + ports: + - port: 443 + targetPort: {{ .Values.port | default 9443 }} + protocol: TCP + name: https + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/serviceaccount.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/serviceaccount.yaml new file mode 100644 index 000000000..9e7ad7e1f --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook-sudo + annotations: + cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation" \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/webhook.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/webhook.yaml new file mode 100644 index 000000000..53a0687b6 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/templates/webhook.yaml @@ -0,0 +1,9 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: rancher.cattle.io +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: rancher.cattle.io diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/README.md b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/README.md new file mode 100644 index 000000000..6d3059a00 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/README.md @@ -0,0 +1,16 @@ + +## local dev testing instructions + +Option 1: Full chart CI run with a live cluster + +```bash +./scripts/charts/ci +``` + +Option 2: Test runs against the chart only + +```bash +# install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git +bash dev-scripts/helm-unittest.sh +``` + diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/deployment_test.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/deployment_test.yaml new file mode 100644 index 000000000..bbd6e3044 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/deployment_test.yaml @@ -0,0 +1,73 @@ +suite: Test Deployment +templates: + - deployment.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 9443 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "9443" + + - it: should set updated webhook port + set: + port: 2319 + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 2319 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "2319" + + - it: should not set capabilities by default. + asserts: + - isNull: + path: spec.template.spec.containers[0].securityContext + + - it: should set net capabilities when capNetBindService is true. + set: + capNetBindService: true + asserts: + - contains: + path: spec.template.spec.containers[0].securityContext.capabilities.add + content: NET_BIND_SERVICE + + - it: should not set volumes or volumeMounts by default + asserts: + - isNull: + path: spec.template.spec.volumes + - isNull: + path: spec.template.spec.volumeMounts + + - it: should set CA fields when CA options are set + set: + auth.clientCA: base64-encoded-cert + auth.allowedCNs: + - kube-apiserver + - joe + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: client-ca + secret: + secretName: client-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + - contains: + path: spec.template.spec.containers[0].env + content: + name: ALLOWED_CNS + value: kube-apiserver,joe diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/service_test.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/service_test.yaml new file mode 100644 index 000000000..03172ad03 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/tests/service_test.yaml @@ -0,0 +1,18 @@ +suite: Test Service +templates: + - service.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.ports[0].targetPort + value: 9443 + + - it: should set updated target port + set: + port: 2319 + asserts: + - equal: + path: spec.ports[0].targetPort + value: 2319 diff --git a/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/values.yaml b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/values.yaml new file mode 100644 index 000000000..2edc33a15 --- /dev/null +++ b/charts/rancher-webhook/104.0.6+up0.5.6-rc.2/values.yaml @@ -0,0 +1,30 @@ +image: + repository: rancher/rancher-webhook + tag: v0.5.6-rc.2 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + hostNetwork: false + +mcm: + enabled: true + +# tolerations for the webhook deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info +tolerations: [] +nodeSelector: {} + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +# port assigns which port to use when running rancher-webhook +port: 9443 + +# Parameters for authenticating the kube-apiserver. +auth: + # CA for authenticating kube-apiserver client certs. If empty, client connections will not be authenticated. + # Must be base64-encoded. + clientCA: "" + # Allowlist of CNs for kube-apiserver client certs. If empty, any cert signed by the CA provided in clientCA will be accepted. + allowedCNs: [] diff --git a/index.yaml b/index.yaml index c74788ce9..a45b39e3c 100755 --- a/index.yaml +++ b/index.yaml @@ -28260,6 +28260,24 @@ entries: - assets/rancher-vsphere-csi/rancher-vsphere-csi-2.1.000.tgz version: 2.1.000 rancher-webhook: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: < 1.31.0-0 + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-webhook + apiVersion: v2 + appVersion: 0.5.6-rc.2 + created: "2025-01-14T14:16:23.235707-08:00" + description: ValidatingAdmissionWebhook for Rancher types + digest: df71a3297c1dfa8654467d31412e859728c0e1845e30776054244a8532a1da96 + name: rancher-webhook + urls: + - assets/rancher-webhook/rancher-webhook-104.0.6+up0.5.6-rc.2.tgz + version: 104.0.6+up0.5.6-rc.2 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true"