Skip to content

Commit d8585d7

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #10581 from k8s-infra-cherrypick-robot/cherry-pick-10551-to-release-1.7
[release-1.7] 🌱 Allow users to specify webhook server cert and key names
2 parents 512dc36 + c05b21b commit d8585d7

File tree

8 files changed

+111
-35
lines changed

8 files changed

+111
-35
lines changed

‎bootstrap/kubeadm/main.go

+14-4
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ var (
7575
restConfigBurst int
7676
webhookPort int
7777
webhookCertDir string
78+
webhookCertName string
79+
webhookKeyName string
7880
healthAddr string
7981
tlsOptions = flags.TLSOptions{}
8082
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -149,7 +151,13 @@ func InitFlags(fs *pflag.FlagSet) {
149151
"Webhook Server port")
150152

151153
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
152-
"Webhook cert dir, only used when webhook-port is specified.")
154+
"Webhook cert dir.")
155+
156+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
157+
"Webhook cert name.")
158+
159+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
160+
"Webhook key name.")
153161

154162
fs.StringVar(&healthAddr, "health-addr", ":9440",
155163
"The address the health endpoint binds to.")
@@ -243,9 +251,11 @@ func main() {
243251
},
244252
WebhookServer: webhook.NewServer(
245253
webhook.Options{
246-
Port: webhookPort,
247-
CertDir: webhookCertDir,
248-
TLSOpts: tlsOptionOverrides,
254+
Port: webhookPort,
255+
CertDir: webhookCertDir,
256+
CertName: webhookCertName,
257+
KeyName: webhookKeyName,
258+
TLSOpts: tlsOptionOverrides,
249259
},
250260
),
251261
}

‎controlplane/kubeadm/main.go

+14-4
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ var (
7979
restConfigBurst int
8080
webhookPort int
8181
webhookCertDir string
82+
webhookCertName string
83+
webhookKeyName string
8284
healthAddr string
8385
tlsOptions = flags.TLSOptions{}
8486
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -148,7 +150,13 @@ func InitFlags(fs *pflag.FlagSet) {
148150
"Webhook Server port")
149151

150152
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
151-
"Webhook cert dir, only used when webhook-port is specified.")
153+
"Webhook cert dir.")
154+
155+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
156+
"Webhook cert name.")
157+
158+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
159+
"Webhook key name.")
152160

153161
fs.StringVar(&healthAddr, "health-addr", ":9440",
154162
"The address the health endpoint binds to.")
@@ -253,9 +261,11 @@ func main() {
253261
},
254262
WebhookServer: webhook.NewServer(
255263
webhook.Options{
256-
Port: webhookPort,
257-
CertDir: webhookCertDir,
258-
TLSOpts: tlsOptionOverrides,
264+
Port: webhookPort,
265+
CertDir: webhookCertDir,
266+
CertName: webhookCertName,
267+
KeyName: webhookKeyName,
268+
TLSOpts: tlsOptionOverrides,
259269
},
260270
),
261271
}

‎docs/book/src/tasks/experimental-features/runtime-sdk/implement-extensions.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ func InitFlags(fs *pflag.FlagSet) {
8484
"Webhook Server port")
8585

8686
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
87-
"Webhook cert dir, only used when webhook-port is specified.")
87+
"Webhook cert dir.")
8888
}
8989

9090
func main() {
@@ -279,7 +279,7 @@ well with practices like unit testing and generally makes the entire system more
279279

280280
### Error messages
281281

282-
RuntimeExtension authors should be aware that error messages are surfaced as a conditions in Kubernetes resources
282+
RuntimeExtension authors should be aware that error messages are surfaced as a conditions in Kubernetes resources
283283
and recorded in Cluster API controller's logs. As a consequence:
284284

285285
- Error message must not contain any sensitive information.
@@ -291,16 +291,16 @@ and recorded in Cluster API controller's logs. As a consequence:
291291
<h1>Caution</h1>
292292

293293
If an error message is not deterministic and it changes at every call even if the problem is the same, it could
294-
lead to to Kubernetes resources conditions continuously changing, and this generates a denial attack to
294+
lead to to Kubernetes resources conditions continuously changing, and this generates a denial attack to
295295
controllers processing those resource that might impact system stability.
296296

297297
</aside>
298298

299299
### ExtensionConfig
300300

301-
To register your runtime extension apply the ExtensionConfig resource in the management cluster, including your CA
302-
certs, ClusterIP service associated with the app and namespace, and the target namespace for the given extension. Once
303-
created, the extension will detect the associated service and discover the associated Hooks. For clarification, you can
301+
To register your runtime extension apply the ExtensionConfig resource in the management cluster, including your CA
302+
certs, ClusterIP service associated with the app and namespace, and the target namespace for the given extension. Once
303+
created, the extension will detect the associated service and discover the associated Hooks. For clarification, you can
304304
check the status of the ExtensionConfig. Below is an example of `ExtensionConfig` -
305305

306306
```yaml
@@ -328,7 +328,7 @@ spec:
328328
329329
Settings can be added to the ExtensionConfig object in the form of a map with string keys and values. These settings are
330330
sent with each request to hooks registered by that ExtensionConfig. Extension developers can implement behavior in their
331-
extensions to alter behavior based on these settings. Settings should be well documented by extension developers so that
331+
extensions to alter behavior based on these settings. Settings should be well documented by extension developers so that
332332
ClusterClass authors can understand usage and expected behaviour.
333333
334334
Settings can be provided for individual external patches by providing them in the ClusterClass `.spec.patches[*].external.settings`.
@@ -380,7 +380,7 @@ curl -X 'POST' 'http://127.0.0.1:8001/api/v1/namespaces/default/services/https:w
380380
-d '{"apiVersion":"hooks.runtime.cluster.x-k8s.io/v1alpha1","kind":"DiscoveryRequest"}' | jq
381381
```
382382

383-
For more details about the API of the Runtime Extensions please see <button onclick="openSwaggerUI()">Swagger UI</button>.
383+
For more details about the API of the Runtime Extensions please see <button onclick="openSwaggerUI()">Swagger UI</button>.
384384
For more details on proxy support please see [Proxies in Kubernetes](https://kubernetes.io/docs/concepts/cluster-administration/proxies/).
385385

386386
<script>

‎exp/runtime/server/server.go

+18-2
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,16 @@ type Options struct {
7070
// It is used to set webhook.Server.CertDir.
7171
CertDir string
7272

73+
// CertName is the server certificate name. Defaults to tls.crt.
74+
//
75+
// Note: This option is only used when TLSOpts does not set GetCertificate.
76+
CertName string
77+
78+
// KeyName is the server key name. Defaults to tls.key.
79+
//
80+
// Note: This option is only used when TLSOpts does not set GetCertificate.
81+
KeyName string
82+
7383
// TLSOpts is used to allow configuring the TLS config used for the server.
7484
// This also allows providing a certificate via GetCertificate.
7585
TLSOpts []func(*tls.Config)
@@ -86,14 +96,20 @@ func New(options Options) (*Server, error) {
8696
if options.CertDir == "" {
8797
options.CertDir = filepath.Join(os.TempDir(), "k8s-webhook-server", "serving-certs")
8898
}
99+
if options.CertName == "" {
100+
options.CertName = "tls.crt"
101+
}
102+
if options.KeyName == "" {
103+
options.KeyName = "tls.key"
104+
}
89105

90106
webhookServer := webhook.NewServer(
91107
webhook.Options{
92108
Port: options.Port,
93109
Host: options.Host,
94110
CertDir: options.CertDir,
95-
CertName: "tls.crt",
96-
KeyName: "tls.key",
111+
CertName: options.CertName,
112+
KeyName: options.KeyName,
97113
TLSOpts: options.TLSOpts,
98114
WebhookMux: http.NewServeMux(),
99115
},

‎main.go

+14-4
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ var (
9696
restConfigBurst int
9797
webhookPort int
9898
webhookCertDir string
99+
webhookCertName string
100+
webhookKeyName string
99101
healthAddr string
100102
tlsOptions = flags.TLSOptions{}
101103
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -216,7 +218,13 @@ func InitFlags(fs *pflag.FlagSet) {
216218
"Webhook Server port")
217219

218220
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
219-
"Webhook cert dir, only used when webhook-port is specified.")
221+
"Webhook cert dir.")
222+
223+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
224+
"Webhook cert name.")
225+
226+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
227+
"Webhook key name.")
220228

221229
fs.StringVar(&healthAddr, "health-addr", ":9440",
222230
"The address the health endpoint binds to.")
@@ -325,9 +333,11 @@ func main() {
325333
},
326334
WebhookServer: webhook.NewServer(
327335
webhook.Options{
328-
Port: webhookPort,
329-
CertDir: webhookCertDir,
330-
TLSOpts: tlsOptionOverrides,
336+
Port: webhookPort,
337+
CertDir: webhookCertDir,
338+
CertName: webhookCertName,
339+
KeyName: webhookKeyName,
340+
TLSOpts: tlsOptionOverrides,
331341
},
332342
),
333343
}

‎test/extension/main.go

+15-5
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ var (
8282
restConfigBurst int
8383
webhookPort int
8484
webhookCertDir string
85+
webhookCertName string
86+
webhookKeyName string
8587
healthAddr string
8688
tlsOptions = flags.TLSOptions{}
8789
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -140,7 +142,13 @@ func InitFlags(fs *pflag.FlagSet) {
140142
"Webhook Server port")
141143

142144
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
143-
"Webhook cert dir, only used when webhook-port is specified.")
145+
"Webhook cert dir.")
146+
147+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
148+
"Webhook cert name.")
149+
150+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
151+
"Webhook key name.")
144152

145153
fs.StringVar(&healthAddr, "health-addr", ":9440",
146154
"The address the health endpoint binds to.")
@@ -203,10 +211,12 @@ func main() {
203211

204212
// Create an HTTP server for serving Runtime Extensions.
205213
runtimeExtensionWebhookServer, err := server.New(server.Options{
206-
Port: webhookPort,
207-
CertDir: webhookCertDir,
208-
TLSOpts: tlsOptionOverrides,
209-
Catalog: catalog,
214+
Port: webhookPort,
215+
CertDir: webhookCertDir,
216+
CertName: webhookCertName,
217+
KeyName: webhookKeyName,
218+
TLSOpts: tlsOptionOverrides,
219+
Catalog: catalog,
210220
})
211221
if err != nil {
212222
setupLog.Error(err, "error creating runtime extension webhook server")

‎test/infrastructure/docker/main.go

+14-4
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ var (
8282
restConfigBurst int
8383
webhookPort int
8484
webhookCertDir string
85+
webhookCertName string
86+
webhookKeyName string
8587
healthAddr string
8688
tlsOptions = flags.TLSOptions{}
8789
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -150,7 +152,13 @@ func InitFlags(fs *pflag.FlagSet) {
150152
"Webhook Server port")
151153

152154
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
153-
"Webhook cert dir, only used when webhook-port is specified.")
155+
"Webhook cert dir.")
156+
157+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
158+
"Webhook cert name.")
159+
160+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
161+
"Webhook key name.")
154162

155163
fs.StringVar(&healthAddr, "health-addr", ":9440",
156164
"The address the health endpoint binds to.")
@@ -249,9 +257,11 @@ func main() {
249257
},
250258
WebhookServer: webhook.NewServer(
251259
webhook.Options{
252-
Port: webhookPort,
253-
CertDir: webhookCertDir,
254-
TLSOpts: tlsOptionOverrides,
260+
Port: webhookPort,
261+
CertDir: webhookCertDir,
262+
CertName: webhookCertName,
263+
KeyName: webhookKeyName,
264+
TLSOpts: tlsOptionOverrides,
255265
},
256266
),
257267
}

‎test/infrastructure/inmemory/main.go

+14-4
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ var (
7676
restConfigBurst int
7777
webhookPort int
7878
webhookCertDir string
79+
webhookCertName string
80+
webhookKeyName string
7981
healthAddr string
8082
tlsOptions = flags.TLSOptions{}
8183
diagnosticsOptions = flags.DiagnosticsOptions{}
@@ -145,7 +147,13 @@ func InitFlags(fs *pflag.FlagSet) {
145147
"Webhook Server port")
146148

147149
fs.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/",
148-
"Webhook cert dir, only used when webhook-port is specified.")
150+
"Webhook cert dir.")
151+
152+
fs.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt",
153+
"Webhook cert name.")
154+
155+
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
156+
"Webhook key name.")
149157

150158
fs.StringVar(&healthAddr, "health-addr", ":9440",
151159
"The address the health endpoint binds to.")
@@ -228,9 +236,11 @@ func main() {
228236
},
229237
WebhookServer: webhook.NewServer(
230238
webhook.Options{
231-
Port: webhookPort,
232-
CertDir: webhookCertDir,
233-
TLSOpts: tlsOptionOverrides,
239+
Port: webhookPort,
240+
CertDir: webhookCertDir,
241+
CertName: webhookCertName,
242+
KeyName: webhookKeyName,
243+
TLSOpts: tlsOptionOverrides,
234244
},
235245
),
236246
}

0 commit comments

Comments
 (0)