Skip to content

Commit fd37dfc

Browse files
camilamacedo86camilamacedo86
committed
(kustomize/v2, go/v4): Fix ca injection for conversion webhooks
The CA injection patch has **not** worked for `go/v4` and `kustomize/v2` (release `3.5.0`) due to the need to replace `vars` with `replacements`, as `vars` are no longer supported in the latest major versions of Kustomize. However, since webhook `--conversion` was an incomplete feature until the upcoming Kubebuilder future release `v4.4.0` (where [PR #4254](#4254) is expected to be merged), users likely didn’t encounter this issue or addressed it manually by fixing the scaffold. **Note:** This change only affects projects that require a **conversion webhook**.
1 parent 5f8342e commit fd37dfc

File tree

48 files changed

+1246
-267
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+1246
-267
lines changed

‎.github/workflows/test-e2e-samples.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@ jobs:
4141
run: |
4242
KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml"
4343
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
44-
sed -i '50,177s/^#//' $KUSTOMIZATION_FILE_PATH
44+
# Uncomment all cert-manager injections
45+
sed -i '50,172s/^#//' $KUSTOMIZATION_FILE_PATH
46+
sed -i '174,198s/^#//' $KUSTOMIZATION_FILE_PATH
4547
cd testdata/project-v4/
4648
go mod tidy
4749
@@ -81,9 +83,12 @@ jobs:
8183
KUSTOMIZATION_FILE_PATH="testdata/project-v4-with-plugins/config/default/kustomization.yaml"
8284
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
8385
# Uncomment only ValidatingWebhookConfiguration
84-
# from cert-manager replaces
85-
sed -i '50,116s/^#//' $KUSTOMIZATION_FILE_PATH
86-
sed -i '148,177s/^#//' $KUSTOMIZATION_FILE_PATH
86+
# from cert-manager replaces; we are leaving defaulting uncommented
87+
# since this sample has no defaulting webhooks
88+
sed -i '50,155s/^#//' $KUSTOMIZATION_FILE_PATH
89+
# Uncomment only --conversion webhooks CA injection
90+
sed -i '144,163s/^#//' $KUSTOMIZATION_FILE_PATH
91+
sed -i '165,180s/^#//' $KUSTOMIZATION_FILE_PATH
8792
cd testdata/project-v4-with-plugins/
8893
go mod tidy
8994

‎docs/book/src/cronjob-tutorial/testdata/project/config/crd/kustomization.yaml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,11 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
19-
#configurations:
20-
#- kustomizeconfig.yaml
15+
configurations:
16+
- kustomizeconfig.yaml

‎docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -151,27 +151,13 @@ replacements:
151151
# version: v1
152152
# name: serving-cert # This name should match the one in certificate.yaml
153153
# fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
# targets:
155-
# - select:
156-
# kind: CustomResourceDefinition
157-
# fieldPaths:
158-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
159-
# options:
160-
# delimiter: '/'
161-
# index: 0
162-
# create: true
154+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163156
# - source:
164157
# kind: Certificate
165158
# group: cert-manager.io
166159
# version: v1
167160
# name: serving-cert # This name should match the one in certificate.yaml
168161
# fieldPath: .metadata.name
169-
# targets:
170-
# - select:
171-
# kind: CustomResourceDefinition
172-
# fieldPaths:
173-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
174-
# options:
175-
# delimiter: '/'
176-
# index: 1
177-
# create: true
162+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
163+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/getting-started/testdata/project/config/crd/kustomization.yaml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,11 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1212

13-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
14-
# patches here are for enabling the CA injection for each CRD
15-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
16-
1713
# [WEBHOOK] To enable webhook, uncomment the following section
1814
# the following config is for teaching kustomize how to do kustomization for CRDs.
19-
#configurations:
20-
#- kustomizeconfig.yaml
15+
configurations:
16+
- kustomizeconfig.yaml

‎docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -151,27 +151,13 @@ patches:
151151
# version: v1
152152
# name: serving-cert # This name should match the one in certificate.yaml
153153
# fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
# targets:
155-
# - select:
156-
# kind: CustomResourceDefinition
157-
# fieldPaths:
158-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
159-
# options:
160-
# delimiter: '/'
161-
# index: 0
162-
# create: true
154+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163156
# - source:
164157
# kind: Certificate
165158
# group: cert-manager.io
166159
# version: v1
167160
# name: serving-cert # This name should match the one in certificate.yaml
168161
# fieldPath: .metadata.name
169-
# targets:
170-
# - select:
171-
# kind: CustomResourceDefinition
172-
# fieldPaths:
173-
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
174-
# options:
175-
# delimiter: '/'
176-
# index: 1
177-
# create: true
162+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
163+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/kustomization.yaml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,11 @@ resources:
66
# +kubebuilder:scaffold:crdkustomizeresource
77

88
patches:
9-
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
9+
# [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
1010
# patches here are for enabling the conversion webhook for each CRD
1111
- path: patches/webhook_in_cronjobs.yaml
1212
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1313

14-
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
15-
# patches here are for enabling the CA injection for each CRD
16-
#- path: patches/cainjection_in_cronjobs.yaml
17-
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
18-
1914
# [WEBHOOK] To enable webhook, uncomment the following section
2015
# the following config is for teaching kustomize how to do kustomization for CRDs.
2116
configurations:

‎docs/book/src/multiversion-tutorial/testdata/project/config/crd/patches/cainjection_in_cronjobs.yaml

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docs/book/src/multiversion-tutorial/testdata/project/config/default/kustomization.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -144,34 +144,38 @@ replacements:
144144
delimiter: '/'
145145
index: 1
146146
create: true
147-
147+
#
148148
- source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
149149
kind: Certificate
150150
group: cert-manager.io
151151
version: v1
152152
name: serving-cert # This name should match the one in certificate.yaml
153153
fieldPath: .metadata.namespace # Namespace of the certificate CR
154-
targets:
154+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
155155
- select:
156156
kind: CustomResourceDefinition
157+
name: cronjobs.batch.tutorial.kubebuilder.io
157158
fieldPaths:
158159
- .metadata.annotations.[cert-manager.io/inject-ca-from]
159160
options:
160161
delimiter: '/'
161162
index: 0
162163
create: true
164+
# +kubebuilder:scaffold:crdkustomizecainjectionns
163165
- source:
164166
kind: Certificate
165167
group: cert-manager.io
166168
version: v1
167169
name: serving-cert # This name should match the one in certificate.yaml
168170
fieldPath: .metadata.name
169-
targets:
171+
targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
170172
- select:
171173
kind: CustomResourceDefinition
174+
name: cronjobs.batch.tutorial.kubebuilder.io
172175
fieldPaths:
173176
- .metadata.annotations.[cert-manager.io/inject-ca-from]
174177
options:
175178
delimiter: '/'
176179
index: 1
177180
create: true
181+
# +kubebuilder:scaffold:crdkustomizecainjectionname

‎docs/book/src/reference/markers/scaffold.md

Lines changed: 68 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -95,17 +95,74 @@ properly registered with the manager, so that the controller can reconcile the r
9595

9696
## List of `+kubebuilder:scaffold` Markers
9797

98-
| Marker | Usual Location | Function |
99-
|--------------------------------------------|------------------------------|---------------------------------------------------------------------------------|
100-
| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. |
101-
| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. |
102-
| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. |
103-
| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. |
104-
| `+kubebuilder:scaffold:crdkustomizeresource`| `config/crd` | Marks where CRD custom resource patches are added. |
105-
| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. |
106-
| `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhook. |
107-
| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. |
108-
| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. |
98+
| Marker | Usual Location | Function |
99+
|--------------------------------------------------------------------------------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
100+
| `+kubebuilder:scaffold:imports` | `main.go` | Marks where imports for new controllers, webhooks, or APIs should be injected. |
101+
| `+kubebuilder:scaffold:scheme` | `init()` in `main.go` | Used to add API versions to the scheme for runtime. |
102+
| `+kubebuilder:scaffold:builder` | `main.go` | Marks where new controllers should be registered with the manager. |
103+
| `+kubebuilder:scaffold:webhook` | `webhooks suite tests` files | Marks where webhook setup functions are added. |
104+
| `+kubebuilder:scaffold:crdkustomizeresource` | `config/crd` | Marks where CRD custom resource patches are added. |
105+
| `+kubebuilder:scaffold:crdkustomizewebhookpatch` | `config/crd` | Marks where CRD webhook patches are added. |
106+
| `+kubebuilder:scaffold:crdkustomizecainjectionns` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
107+
| `+kubebuilder:scaffold:crdkustomizecainjectioname` | `config/default` | Marks where CA injection patches are added for the conversion webhooks. |
108+
| `+kubebuilder:scaffold:manifestskustomizesamples` | `config/samples` | Marks where Kustomize sample manifests are injected. |
109+
| `+kubebuilder:scaffold:e2e-webhooks-checks` | `test/e2e` | Adds e2e checks for webhooks depending on the types of webhooks scaffolded. |
110+
| **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` | `config/crd` | Marks where CA injection patches are added for the webhooks. Replaced by `+kubebuilder:scaffold:crdkustomizecainjectionns` and `+kubebuilder:scaffold:crdkustomizecainjectioname` |
111+
112+
<aside class="note warning">
113+
<h1> **(No longer supported)** `+kubebuilder:scaffold:crdkustomizecainjectionpatch` </h1>
114+
115+
If you find this marker in your code please:
116+
117+
1. **Remove the CERTMANAGER Section from `config/crd/kustomization.yaml`:**
118+
119+
Delete the `CERTMANAGER` section to prevent unintended CA injection patches for CRDs. Ensure the following lines are removed or commented out:
120+
121+
```yaml
122+
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
123+
# patches here are for enabling the CA injection for each CRD
124+
#- path: patches/cainjection_in_firstmates.yaml
125+
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
126+
```
127+
128+
2. **Ensure CA Injection Configuration in `config/default/kustomization.yaml`:**
129+
130+
Under the `[CERTMANAGER]` replacement in `config/default/kustomization.yaml`, add the following code for proper CA injection generation:
131+
132+
**NOTE:** You must ensure that the code contains the following target markers:
133+
- `+kubebuilder:scaffold:crdkustomizecainjectionns`
134+
- `+kubebuilder:scaffold:crdkustomizecainjectioname`
135+
136+
```yaml
137+
# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
138+
# kind: Certificate
139+
# group: cert-manager.io
140+
# version: v1
141+
# name: serving-cert # This name should match the one in certificate.yaml
142+
# fieldPath: .metadata.namespace # Namespace of the certificate CR
143+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
144+
# +kubebuilder:scaffold:crdkustomizecainjectionns
145+
# - source:
146+
# kind: Certificate
147+
# group: cert-manager.io
148+
# version: v1
149+
# name: serving-cert # This name should match the one in certificate.yaml
150+
# fieldPath: .metadata.name
151+
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
152+
# +kubebuilder:scaffold:crdkustomizecainjectioname
153+
```
154+
155+
3. **Ensure Only Conversion Webhook Patches in `config/crd/patches`:**
156+
157+
The `config/crd/patches` directory and the corresponding entries in `config/crd/kustomization.yaml` should only contain files for conversion webhooks. Previously, a bug caused the patch file to be generated for any webhook, but only patches for webhooks scaffolded with the `--conversion` option should be included.
158+
159+
For further guidance, you can refer to examples in the `testdata/` directory in the Kubebuilder repository.
160+
161+
> **Alternatively**: You can use the [`alpha generate`](./../rescaffold.md) command to re-generate the project from scratch
162+
> using the latest release available. Afterward, you can re-add only your code implementation on top to ensure your project
163+
> includes all the latest bug fixes and enhancements.
164+
165+
</aside>
109166

110167
<aside class="note">
111168
<h1>Creating Your Own Markers</h1>

‎hack/docs/internal/multiversion-tutorial/generate_multiversion.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,13 @@ func (sp *Sample) updateDefaultKustomize() {
8787
// Enable CA for Conversion Webhook
8888
err := pluginutil.UncommentCode(
8989
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
90-
caConversionCRDDefaultKustomize, `#`)
90+
caInjectionNamespace, `#`)
91+
hackutils.CheckError("fixing default/kustomization", err)
92+
93+
// Enable CA for Conversion Webhook
94+
err = pluginutil.UncommentCode(
95+
filepath.Join(sp.ctx.Dir, "config/default/kustomization.yaml"),
96+
caInjectionCert, `#`)
9197
hackutils.CheckError("fixing default/kustomization", err)
9298
}
9399

0 commit comments

Comments
 (0)