|
| 1 | +package v1alpha1 |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "encoding/json" |
| 6 | + |
| 7 | + admissionv1 "k8s.io/api/admissionregistration/v1" |
| 8 | + "k8s.io/apimachinery/pkg/api/errors" |
| 9 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 10 | + "k8s.io/apimachinery/pkg/types" |
| 11 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 12 | + |
| 13 | + "github.com/NVIDIA/k8s-nim-operator/internal/config" |
| 14 | + "github.com/NVIDIA/k8s-nim-operator/internal/k8sutil" |
| 15 | +) |
| 16 | + |
| 17 | +// EnsureValidatingWebhook creates or updates the ValidatingWebhookConfiguration |
| 18 | +// that used to be templated by Helm. It is a best-effort reconciliation and |
| 19 | +// returns an error only when we cannot make the desired state match the spec. |
| 20 | +func EnsureValidatingWebhook( |
| 21 | + ctx context.Context, |
| 22 | + apiReader client.Reader, |
| 23 | + writer client.Client, |
| 24 | + namespace string, |
| 25 | + fullNamePrefix string, |
| 26 | +) error { |
| 27 | + // Desired validatingwebhookconfiguration spec. |
| 28 | + desired := buildConfigurationSpec(namespace, fullNamePrefix) |
| 29 | + |
| 30 | + // Check if there is already a spec. |
| 31 | + existing := &admissionv1.ValidatingWebhookConfiguration{} |
| 32 | + err := apiReader.Get(ctx, types.NamespacedName{Name: desired.Name}, existing) |
| 33 | + if err != nil && !errors.IsNotFound(err) { |
| 34 | + return err |
| 35 | + } |
| 36 | + |
| 37 | + if errors.IsNotFound(err) { |
| 38 | + return writer.Create(ctx, desired) |
| 39 | + } |
| 40 | + |
| 41 | + // Deep-compare; update only if something differs. |
| 42 | + cur, _ := json.Marshal(existing.Webhooks) |
| 43 | + want, _ := json.Marshal(desired.Webhooks) |
| 44 | + |
| 45 | + if string(cur) == string(want) { |
| 46 | + return nil |
| 47 | + } |
| 48 | + |
| 49 | + existing.Webhooks = desired.Webhooks |
| 50 | + existing.Annotations = desired.Annotations |
| 51 | + return writer.Update(ctx, existing) |
| 52 | +} |
| 53 | + |
| 54 | +// buildDesired reproduces the spec that used to be in Helm. |
| 55 | +func buildConfigurationSpec(namespace, namePrefix string) *admissionv1.ValidatingWebhookConfiguration { |
| 56 | + pathCache := "/validate-apps-nvidia-com-v1alpha1-nimcache" |
| 57 | + pathService := "/validate-apps-nvidia-com-v1alpha1-nimservice" |
| 58 | + |
| 59 | + // Use appropriate annotations/labels as per deployment mode. |
| 60 | + var annotations map[string]string |
| 61 | + var labels map[string]string |
| 62 | + var clientconfignimcache admissionv1.WebhookClientConfig |
| 63 | + var clientconfignimservice admissionv1.WebhookClientConfig |
| 64 | + |
| 65 | + clientconfignimcache = admissionv1.WebhookClientConfig{ |
| 66 | + Service: &admissionv1.ServiceReference{ |
| 67 | + Namespace: namespace, |
| 68 | + Name: namePrefix + "-webhook-service", |
| 69 | + Path: &pathCache, |
| 70 | + }, |
| 71 | + } |
| 72 | + clientconfignimservice = admissionv1.WebhookClientConfig{ |
| 73 | + Service: &admissionv1.ServiceReference{ |
| 74 | + Namespace: namespace, |
| 75 | + Name: namePrefix + "-webhook-service", |
| 76 | + Path: &pathService, |
| 77 | + }, |
| 78 | + } |
| 79 | + |
| 80 | + // Deployment specific values. |
| 81 | + if config.OrchestratorType == k8sutil.K8s { |
| 82 | + annotations = map[string]string{"cert-manager.io/inject-ca-from": namespace + "/" + namePrefix + "-serving-cert"} |
| 83 | + labels = map[string]string{ |
| 84 | + "app.kubernetes.io/name": "k8s-nim-operator", |
| 85 | + "app.kubernetes.io/managed-by": "helm", |
| 86 | + } |
| 87 | + } else { |
| 88 | + annotations = map[string]string{"service.beta.openshift.io/inject-cabundle": "true"} |
| 89 | + labels = map[string]string{ |
| 90 | + "app.kubernetes.io/name": "k8s-nim-operator", |
| 91 | + "app.kubernetes.io/managed-by": "openshift", |
| 92 | + } |
| 93 | + } |
| 94 | + |
| 95 | + return &admissionv1.ValidatingWebhookConfiguration{ |
| 96 | + ObjectMeta: metav1.ObjectMeta{ |
| 97 | + Name: namePrefix + "-validating-webhook-configuration", |
| 98 | + Annotations: annotations, |
| 99 | + Labels: labels, |
| 100 | + }, |
| 101 | + Webhooks: []admissionv1.ValidatingWebhook{ |
| 102 | + { |
| 103 | + Name: "vnimcache-v1alpha1.kb.io", |
| 104 | + AdmissionReviewVersions: []string{"v1"}, |
| 105 | + ClientConfig: clientconfignimcache, |
| 106 | + FailurePolicy: func() *admissionv1.FailurePolicyType { |
| 107 | + fp := admissionv1.Fail |
| 108 | + return &fp |
| 109 | + }(), |
| 110 | + SideEffects: func() *admissionv1.SideEffectClass { |
| 111 | + s := admissionv1.SideEffectClassNone |
| 112 | + return &s |
| 113 | + }(), |
| 114 | + Rules: []admissionv1.RuleWithOperations{{ |
| 115 | + Operations: []admissionv1.OperationType{ |
| 116 | + admissionv1.Create, admissionv1.Update, |
| 117 | + }, |
| 118 | + Rule: admissionv1.Rule{ |
| 119 | + APIGroups: []string{"apps.nvidia.com"}, |
| 120 | + APIVersions: []string{"v1alpha1"}, |
| 121 | + Resources: []string{"nimcaches"}, |
| 122 | + }, |
| 123 | + }}, |
| 124 | + }, |
| 125 | + { |
| 126 | + Name: "vnimservice-v1alpha1.kb.io", |
| 127 | + AdmissionReviewVersions: []string{"v1"}, |
| 128 | + ClientConfig: clientconfignimservice, |
| 129 | + FailurePolicy: func() *admissionv1.FailurePolicyType { |
| 130 | + fp := admissionv1.Fail |
| 131 | + return &fp |
| 132 | + }(), |
| 133 | + SideEffects: func() *admissionv1.SideEffectClass { |
| 134 | + s := admissionv1.SideEffectClassNone |
| 135 | + return &s |
| 136 | + }(), |
| 137 | + Rules: []admissionv1.RuleWithOperations{{ |
| 138 | + Operations: []admissionv1.OperationType{ |
| 139 | + admissionv1.Create, admissionv1.Update, |
| 140 | + }, |
| 141 | + Rule: admissionv1.Rule{ |
| 142 | + APIGroups: []string{"apps.nvidia.com"}, |
| 143 | + APIVersions: []string{"v1alpha1"}, |
| 144 | + Resources: []string{"nimservices"}, |
| 145 | + }, |
| 146 | + }}, |
| 147 | + }, |
| 148 | + }, |
| 149 | + } |
| 150 | +} |
0 commit comments