src/foundation/scripts/cni/danm/integration/manifests/webhook/webhook.yaml

   1 # yamllint disable rule:hyphens rule:commas rule:indentation rule:brackets rule:line-length
   2 apiVersion: v1
   3 kind: ServiceAccount
   4 metadata:
   5   name: danm-webhook
   6   namespace: kube-system
   7 ---
   8 apiVersion: rbac.authorization.k8s.io/v1
   9 kind: ClusterRole
  10 metadata:
  11   name: caas:danm-webhook
  12 rules:
  13 - apiGroups:
  14   - danm.k8s.io
  15   resources:
  16   - tenantconfigs
  17   verbs: [ "*" ]
  18 ---
  19 apiVersion: rbac.authorization.k8s.io/v1
  20 kind: ClusterRoleBinding
  21 metadata:
  22   name: caas:danm-webhook
  23 roleRef:
  24   apiGroup: rbac.authorization.k8s.io
  25   kind: ClusterRole
  26   name: caas:danm-webhook
  27 subjects:
  28 - kind: ServiceAccount
  29   name: danm-webhook
  30   namespace: kube-system
  31 ---
  32 apiVersion: admissionregistration.k8s.io/v1beta1
  33 kind: MutatingWebhookConfiguration
  34 metadata:
  35   name: danm-webhook-config
  36   namespace: kube-system
  37 webhooks:
  38   - name: danm-netvalidation.nokia.k8s.io
  39     clientConfig:
  40       service:
  41         name: danm-webhook-svc
  42         namespace: kube-system
  43         path: "/netvalidation"
  44       # Configure your pre-generated certificate matching the details of your environment
  45       caBundle: <CA_BUNDLE>
  46     rules:
  47       - operations: ["CREATE","UPDATE"]
  48         apiGroups: ["danm.k8s.io"]
  49         apiVersions: ["v1"]
  50         resources: ["danmnets","clusternetworks","tenantnetworks"]
  51     failurePolicy: Fail
  52   - name: danm-configvalidation.nokia.k8s.io
  53     clientConfig:
  54       service:
  55         name: danm-webhook-svc
  56         namespace: kube-system
  57         path: "/confvalidation"
  58       # Configure your pre-generated certificate matching the details of your environment
  59       caBundle: <CA_BUNDLE>
  60     rules:
  61       - operations: ["CREATE","UPDATE"]
  62         apiGroups: ["danm.k8s.io"]
  63         apiVersions: ["v1"]
  64         resources: ["tenantconfigs"]
  65     failurePolicy: Fail
  66   - name: danm-netdeletion.nokia.k8s.io
  67     clientConfig:
  68       service:
  69         name: danm-webhook-svc
  70         namespace: kube-system
  71         path: "/netdeletion"
  72       # Configure your pre-generated certificate matching the details of your environment
  73       caBundle: <CA_BUNDLE>
  74     rules:
  75       - operations: ["DELETE"]
  76         apiGroups: ["danm.k8s.io"]
  77         apiVersions: ["v1"]
  78         resources: ["tenantnetworks"]
  79     failurePolicy: Fail
  80 ---
  81 apiVersion: v1
  82 kind: Service
  83 metadata:
  84   name: danm-webhook-svc
  85   namespace: kube-system
  86   labels:
  87     danm: webhook
  88 spec:
  89   ports:
  90   - name: webhook
  91     port: 443
  92     targetPort: 8443
  93   selector:
  94     danm: webhook
  95 ---
  96 apiVersion: apps/v1
  97 kind: Deployment
  98 metadata:
  99   name: danm-webhook-deployment
 100   namespace: kube-system
 101   labels:
 102     danm: webhook
 103 spec:
 104   selector:
 105     matchLabels:
 106      danm: webhook
 107   template:
 108     metadata:
 109       annotations:
 110         # Adapt to your own network environment!
 111         danm.k8s.io/interfaces: |
 112           [
 113             {
 114               "network":"flannel"
 115             }
 116           ]
 117       name: danm-webhook
 118       labels:
 119         danm: webhook
 120     spec:
 121       serviceAccountName: danm-webhook
 122       containers:
 123         - name: danm-webhook
 124           image: danm_webhook
 125           command: [ "/usr/local/bin/webhook", "-tls-cert-bundle=/etc/webhook/certs/danm_webhook.crt", "-tls-private-key-file=/etc/webhook/certs/danm_webhook.key", "bind-port=8443" ]
 126           imagePullPolicy: IfNotPresent
 127           volumeMounts:
 128             - name: webhook-certs
 129               mountPath: /etc/webhook/certs
 130               readOnly: true
 131       # Configure the directory holding the Webhook's server certificates
 132       volumes:
 133         - name: webhook-certs
 134           hostPath:
 135             path: /etc/kubernetes/ssl/