Skip to content

Commit 96d4460

Browse files
cwiklikcwiklik
authored
Merge pull request #261 from cwiklik/feat/webhook-forward-port
feat: migrate AuthBridge webhook from extensions into operator
2 parents 0d97ea3 + bcb4b66 commit 96d4460

46 files changed

Lines changed: 7522 additions & 52 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎charts/kagenti-operator/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ apiVersion: v2
22
name: kagenti-operator-chart
33
description: A Helm chart to distribute the project kagenti-operator
44
type: application
5-
version: 0.1.0
6-
appVersion: "0.1.0"
5+
version: 0.2.0-alpha.24
6+
appVersion: "0.2.0-alpha.24"
77
icon: "https://example.com/icon.png"

‎charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.17.1
7+
name: agentruntimes.agent.kagenti.dev
8+
spec:
9+
group: agent.kagenti.dev
10+
names:
11+
kind: AgentRuntime
12+
listKind: AgentRuntimeList
13+
plural: agentruntimes
14+
shortNames:
15+
- art
16+
- agentrt
17+
singular: agentruntime
18+
scope: Namespaced
19+
versions:
20+
- additionalPrinterColumns:
21+
- description: Workload Type
22+
jsonPath: .spec.type
23+
name: Type
24+
type: string
25+
- description: Target Workload
26+
jsonPath: .spec.targetRef.name
27+
name: Target
28+
type: string
29+
- description: Runtime Phase
30+
jsonPath: .status.phase
31+
name: Phase
32+
type: string
33+
- jsonPath: .metadata.creationTimestamp
34+
name: Age
35+
type: date
36+
name: v1alpha1
37+
schema:
38+
openAPIV3Schema:
39+
description: AgentRuntime is the Schema for the agentruntimes API.
40+
properties:
41+
apiVersion:
42+
description: |-
43+
APIVersion defines the versioned schema of this representation of an object.
44+
Servers should convert recognized schemas to the latest internal value, and
45+
may reject unrecognized values.
46+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
47+
type: string
48+
kind:
49+
description: |-
50+
Kind is a string value representing the REST resource this object represents.
51+
Servers may infer this from the endpoint the client submits requests to.
52+
Cannot be updated.
53+
In CamelCase.
54+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
55+
type: string
56+
metadata:
57+
type: object
58+
spec:
59+
description: AgentRuntimeSpec defines the desired state of AgentRuntime.
60+
properties:
61+
identity:
62+
description: Identity specifies optional per-workload identity overrides
63+
properties:
64+
spiffe:
65+
description: SPIFFE specifies SPIFFE identity configuration overrides
66+
properties:
67+
trustDomain:
68+
description: |-
69+
TrustDomain overrides the operator-level --spire-trust-domain for this workload.
70+
If empty, the operator flag value is used.
71+
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-\.]*[a-zA-Z0-9])?$
72+
type: string
73+
type: object
74+
type: object
75+
targetRef:
76+
description: TargetRef identifies the workload backing this agent
77+
runtime (duck typing).
78+
properties:
79+
apiVersion:
80+
description: APIVersion is the API version of the target resource
81+
(e.g., "apps/v1")
82+
minLength: 1
83+
type: string
84+
kind:
85+
description: Kind is the kind of the target resource (e.g., "Deployment",
86+
"StatefulSet")
87+
minLength: 1
88+
type: string
89+
name:
90+
minLength: 1
91+
type: string
92+
required:
93+
- apiVersion
94+
- kind
95+
- name
96+
type: object
97+
trace:
98+
description: Trace specifies optional per-workload observability overrides
99+
properties:
100+
endpoint:
101+
description: Endpoint is the OTEL collector endpoint override
102+
type: string
103+
protocol:
104+
description: Protocol is the OTEL export protocol (grpc or http)
105+
enum:
106+
- grpc
107+
- http
108+
type: string
109+
sampling:
110+
description: Sampling specifies trace sampling configuration
111+
properties:
112+
rate:
113+
description: Rate is the sampling rate (0.0-1.0)
114+
maximum: 1
115+
minimum: 0
116+
type: number
117+
required:
118+
- rate
119+
type: object
120+
type: object
121+
type:
122+
description: Type classifies the workload as an agent or tool
123+
enum:
124+
- agent
125+
- tool
126+
type: string
127+
required:
128+
- targetRef
129+
- type
130+
type: object
131+
status:
132+
description: AgentRuntimeStatus defines the observed state of AgentRuntime.
133+
properties:
134+
conditions:
135+
description: Conditions represent the current state of the AgentRuntime
136+
items:
137+
description: Condition contains details for one aspect of the current
138+
state of this API Resource.
139+
properties:
140+
lastTransitionTime:
141+
description: |-
142+
lastTransitionTime is the last time the condition transitioned from one status to another.
143+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
144+
format: date-time
145+
type: string
146+
message:
147+
description: |-
148+
message is a human readable message indicating details about the transition.
149+
This may be an empty string.
150+
maxLength: 32768
151+
type: string
152+
observedGeneration:
153+
description: |-
154+
observedGeneration represents the .metadata.generation that the condition was set based upon.
155+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
156+
with respect to the current state of the instance.
157+
format: int64
158+
minimum: 0
159+
type: integer
160+
reason:
161+
description: |-
162+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
163+
Producers of specific condition types may define expected values and meanings for this field,
164+
and whether the values are considered a guaranteed API.
165+
The value should be a CamelCase string.
166+
This field may not be empty.
167+
maxLength: 1024
168+
minLength: 1
169+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
170+
type: string
171+
status:
172+
description: status of the condition, one of True, False, Unknown.
173+
enum:
174+
- "True"
175+
- "False"
176+
- Unknown
177+
type: string
178+
type:
179+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
180+
maxLength: 316
181+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
182+
type: string
183+
required:
184+
- lastTransitionTime
185+
- message
186+
- reason
187+
- status
188+
- type
189+
type: object
190+
type: array
191+
configuredPods:
192+
description: ConfiguredPods is the count of pods with expected labels/config
193+
format: int32
194+
type: integer
195+
phase:
196+
description: Phase is the high-level state of the AgentRuntime
197+
enum:
198+
- Pending
199+
- Active
200+
- Error
201+
type: string
202+
type: object
203+
required:
204+
- spec
205+
type: object
206+
served: true
207+
storage: true
208+
subresources:
209+
status: {}

‎charts/kagenti-operator/templates/manager/configmap-feature-gates.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.webhook.enable }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: kagenti-feature-gates
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "chart.labels" . | nindent 4 }}
9+
app.kubernetes.io/component: feature-gates
10+
data:
11+
feature-gates.yaml: |
12+
{{- .Values.featureGates | default dict | toYaml | nindent 4 }}
13+
{{- end }}

‎charts/kagenti-operator/templates/manager/configmap-platform-defaults.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.webhook.enable }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: kagenti-platform-config
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "chart.labels" . | nindent 4 }}
9+
app.kubernetes.io/component: platform-defaults
10+
data:
11+
config.yaml: |
12+
{{- .Values.defaults | default dict | toYaml | nindent 4 }}
13+
{{- end }}

‎charts/kagenti-operator/templates/manager/manager.yaml‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ spec:
6666
env:
6767
{{- range $key, $value := .Values.controllerManager.container.env }}
6868
- name: {{ $key }}
69-
value: {{ $value }}
69+
value: {{ $value | quote }}
7070
{{- end }}
7171
{{- end }}
7272
livenessProbe:
@@ -83,8 +83,15 @@ spec:
8383
{{- toYaml .Values.controllerManager.container.resources | nindent 12 }}
8484
securityContext:
8585
{{- toYaml .Values.controllerManager.container.securityContext | nindent 12 }}
86-
{{- if and .Values.certmanager.enable (or .Values.webhook.enable .Values.metrics.enable) }}
8786
volumeMounts:
87+
{{- if .Values.webhook.enable }}
88+
- name: platform-config
89+
mountPath: /etc/kagenti
90+
readOnly: true
91+
- name: feature-gates
92+
mountPath: /etc/kagenti/feature-gates
93+
readOnly: true
94+
{{- end }}
8895
{{- if and .Values.webhook.enable .Values.certmanager.enable }}
8996
- name: webhook-cert
9097
mountPath: /tmp/k8s-webhook-server/serving-certs
@@ -95,13 +102,19 @@ spec:
95102
mountPath: /tmp/k8s-metrics-server/metrics-certs
96103
readOnly: true
97104
{{- end }}
98-
{{- end }}
99105
securityContext:
100106
{{- toYaml .Values.controllerManager.securityContext | nindent 8 }}
101107
serviceAccountName: {{ .Values.controllerManager.serviceAccountName }}
102108
terminationGracePeriodSeconds: {{ .Values.controllerManager.terminationGracePeriodSeconds }}
103-
{{- if and .Values.certmanager.enable (or .Values.webhook.enable .Values.metrics.enable) }}
104109
volumes:
110+
{{- if .Values.webhook.enable }}
111+
- name: platform-config
112+
configMap:
113+
name: kagenti-platform-config
114+
- name: feature-gates
115+
configMap:
116+
name: kagenti-feature-gates
117+
{{- end }}
105118
{{- if and .Values.webhook.enable .Values.certmanager.enable }}
106119
- name: webhook-cert
107120
secret:
@@ -112,4 +125,3 @@ spec:
112125
secret:
113126
secretName: kagenti-operator-metrics-server-cert
114127
{{- end }}
115-
{{- end }}

‎charts/kagenti-operator/templates/rbac/role.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,32 @@ rules:
120120
- get
121121
- patch
122122
- update
123+
- apiGroups:
124+
- agent.kagenti.dev
125+
resources:
126+
- agentruntimes
127+
verbs:
128+
- create
129+
- delete
130+
- get
131+
- list
132+
- patch
133+
- update
134+
- watch
135+
- apiGroups:
136+
- agent.kagenti.dev
137+
resources:
138+
- agentruntimes/finalizers
139+
verbs:
140+
- update
141+
- apiGroups:
142+
- agent.kagenti.dev
143+
resources:
144+
- agentruntimes/status
145+
verbs:
146+
- get
147+
- patch
148+
- update
123149
- apiGroups:
124150
- networking.k8s.io
125151
resources:

0 commit comments

Comments
 (0)