Skip to content

Commit 44e3eab

Browse files
omerap12omerap12
committed
Add Helm-managed webhook with kube-webhook-certgen
Signed-off-by: Omer Aplatony <[email protected]>
1 parent ffcbfee commit 44e3eab

15 files changed

+511
-31
lines changed

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md‎

Lines changed: 70 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,23 +18,87 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
1818
| adrianmoisey | <[email protected]> | |
1919
| omerap12 | <[email protected]> | |
2020

21+
## Webhook Management
22+
The admission controller requires a `MutatingWebhookConfiguration` and TLS certificates. This chart supports two mutually exclusive modes:
23+
24+
### Helm-managed (default)
25+
```yaml
26+
admissionController:
27+
registerWebhook: false
28+
certGen:
29+
enabled: true
30+
```
31+
In this mode:
32+
- Helm creates the MutatingWebhookConfiguration
33+
- The kube-webhook-certgen job generates TLS certificates and stores them in a Secret
34+
- The certificates are automatically injected into the webhook configuration
35+
36+
### Application-managed
37+
```yaml
38+
admissionController:
39+
registerWebhook: true
40+
certGen:
41+
enabled: false
42+
```
43+
In this mode:
44+
- The VPA admission controller creates and manages the webhook itself
45+
- The application handles its own certificate generation
46+
47+
## Migration Guides
48+
49+
### Migrating from vpa-up.sh script
50+
TBD
51+
52+
### Migrating from Application-managed to Helm-managed webhook
53+
If you previously deployed with registerWebhook: true and want to switch to Helm-managed:
54+
- Delete the existing webhook:
55+
```bash
56+
kubectl delete mutatingwebhookconfiguration vpa-webhook-config
57+
```
58+
- Delete the existing secret (to allow certgen to create new certificates):
59+
```bash
60+
kubectl delete secret -n <namespace> vpa-tls-certs
61+
```
62+
- Upgrade with the new values:
63+
```bash
64+
helm upgrade <release-name> <chart> \
65+
--set admissionController.registerWebhook=false \
66+
--set admissionController.certGen.enabled=true
67+
```
2168
## Values
2269

2370
| Key | Type | Default | Description |
2471
|-----|------|---------|-------------|
2572
| admissionController.affinity | object | `{}` | |
73+
| admissionController.certGen.affinity | object | `{}` | |
74+
| admissionController.certGen.enabled | bool | `true` | |
75+
| admissionController.certGen.env | object | `{}` | Additional environment variables to be added to the certgen container. Format is KEY: Value format |
76+
| admissionController.certGen.image.pullPolicy | string | `"IfNotPresent"` | The pull policy for the certgen image. Recommend not changing this |
77+
| admissionController.certGen.image.repository | string | `"registry.k8s.io/ingress-nginx/kube-webhook-certgen"` | An image that contains certgen for creating certificates. Only used if admissionController.generateCertificate is true |
78+
| admissionController.certGen.image.tag | string | `"v20231011-8b53cabe0"` | An image tag for the admissionController.certGen.image.repository image. Only used if admissionController.generateCertificate is true |
79+
| admissionController.certGen.nodeSelector | object | `{}` | |
80+
| admissionController.certGen.podSecurityContext | object | `{"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | The securityContext block for the certgen pod(s) |
81+
| admissionController.certGen.resources | object | `{}` | The resources block for the certgen pod |
82+
| admissionController.certGen.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | The securityContext block for the certgen container(s) |
83+
| admissionController.certGen.tolerations | list | `[]` | |
2684
| admissionController.enabled | bool | `true` | |
2785
| admissionController.extraArgs | list | `[]` | |
2886
| admissionController.extraEnv | list | `[]` | |
2987
| admissionController.image.pullPolicy | string | `"IfNotPresent"` | |
3088
| admissionController.image.repository | string | `"registry.k8s.io/autoscaling/vpa-admission-controller"` | |
3189
| admissionController.image.tag | string | `nil` | |
90+
| admissionController.mutatingWebhookConfiguration.annotations | object | `{}` | Additional annotations for the MutatingWebhookConfiguration |
91+
| admissionController.mutatingWebhookConfiguration.failurePolicy | string | `"Ignore"` | The failurePolicy for the mutating webhook. Allowed values are: Ignore, Fail |
92+
| admissionController.mutatingWebhookConfiguration.namespaceSelector | object | `{}` | The namespaceSelector controls which namespaces are affected by the webhook |
93+
| admissionController.mutatingWebhookConfiguration.objectSelector | object | `{}` | The objectSelector can filter objects on e.g. labels |
94+
| admissionController.mutatingWebhookConfiguration.timeoutSeconds | int | `5` | Sets the amount of time the API server will wait on a response from the webhook service |
3295
| admissionController.nodeSelector | object | `{}` | |
3396
| admissionController.podAnnotations | object | `{}` | |
3497
| admissionController.podDisruptionBudget.enabled | bool | `true` | |
3598
| admissionController.podDisruptionBudget.maxUnavailable | int or string | `nil` | Maximum number/percentage of pods that can be unavailable after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
3699
| admissionController.podDisruptionBudget.minAvailable | int or string | `1` | Minimum number/percentage of pods that must be available after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
37100
| admissionController.podLabels | object | `{}` | |
101+
| admissionController.registerWebhook | bool | `false` | |
38102
| admissionController.replicas | int | `2` | |
39103
| admissionController.resources.limits.cpu | string | `"200m"` | |
40104
| admissionController.resources.limits.memory | string | `"500Mi"` | |
@@ -48,17 +112,19 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
48112
| admissionController.serviceAccount.annotations | object | `{}` | |
49113
| admissionController.serviceAccount.create | bool | `true` | |
50114
| admissionController.serviceAccount.labels | object | `{}` | |
51-
| admissionController.tls.caCert | string | `""` | |
52-
| admissionController.tls.cert | string | `""` | |
53-
| admissionController.tls.existingSecret | string | `""` | |
54-
| admissionController.tls.key | string | `""` | |
55115
| admissionController.tls.secretName | string | `"vpa-tls-certs"` | |
56116
| admissionController.tolerations | list | `[]` | |
57117
| admissionController.volumeMounts[0].mountPath | string | `"/etc/tls-certs"` | |
58118
| admissionController.volumeMounts[0].name | string | `"tls-certs"` | |
59119
| admissionController.volumeMounts[0].readOnly | bool | `true` | |
60120
| admissionController.volumes[0].name | string | `"tls-certs"` | |
61121
| admissionController.volumes[0].secret.defaultMode | int | `420` | |
122+
| admissionController.volumes[0].secret.items[0].key | string | `"ca"` | |
123+
| admissionController.volumes[0].secret.items[0].path | string | `"caCert.pem"` | |
124+
| admissionController.volumes[0].secret.items[1].key | string | `"cert"` | |
125+
| admissionController.volumes[0].secret.items[1].path | string | `"serverCert.pem"` | |
126+
| admissionController.volumes[0].secret.items[2].key | string | `"key"` | |
127+
| admissionController.volumes[0].secret.items[2].path | string | `"serverKey.pem"` | |
62128
| admissionController.volumes[0].secret.secretName | string | `"vpa-tls-certs"` | |
63129
| commonLabels | object | `{}` | |
64130
| containerSecurityContext | object | `{}` | |

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md.gotmpl‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,51 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
1515

1616
{{ template "chart.requirementsSection" . }}
1717

18+
## Webhook Management
19+
The admission controller requires a `MutatingWebhookConfiguration` and TLS certificates. This chart supports two mutually exclusive modes:
20+
21+
### Helm-managed (default)
22+
```yaml
23+
admissionController:
24+
registerWebhook: false
25+
certGen:
26+
enabled: true
27+
```
28+
In this mode:
29+
- Helm creates the MutatingWebhookConfiguration
30+
- The kube-webhook-certgen job generates TLS certificates and stores them in a Secret
31+
- The certificates are automatically injected into the webhook configuration
32+
33+
### Application-managed
34+
```yaml
35+
admissionController:
36+
registerWebhook: true
37+
certGen:
38+
enabled: false
39+
```
40+
In this mode:
41+
- The VPA admission controller creates and manages the webhook itself
42+
- The application handles its own certificate generation
43+
44+
## Migration Guides
45+
46+
### Migrating from vpa-up.sh script
47+
TBD
48+
49+
### Migrating from Application-managed to Helm-managed webhook
50+
If you previously deployed with registerWebhook: true and want to switch to Helm-managed:
51+
- Delete the existing webhook:
52+
```bash
53+
kubectl delete mutatingwebhookconfiguration vpa-webhook-config
54+
```
55+
- Delete the existing secret (to allow certgen to create new certificates):
56+
```bash
57+
kubectl delete secret -n <namespace> vpa-tls-certs
58+
```
59+
- Upgrade with the new values:
60+
```bash
61+
helm upgrade <release-name> <chart> \
62+
--set admissionController.registerWebhook=false \
63+
--set admissionController.certGen.enabled=true
64+
```
1865
{{ template "chart.valuesSection" . }}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/_helpers.tpl‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,13 +66,33 @@ app.kubernetes.io/component: admission-controller
6666
Create the name of the tls secret to use
6767
*/}}
6868
{{- define "vertical-pod-autoscaler.admissionController.tls.secretName" -}}
69-
{{- if .Values.admissionController.tls.existingSecret -}}
70-
{{ .Values.admissionController.tls.existingSecret }}
69+
{{- if .Values.admissionController.tls.secretName -}}
70+
{{ .Values.admissionController.tls.secretName }}
7171
{{- else -}}
7272
{{- printf "%s-%s" (include "vertical-pod-autoscaler.admissionController.fullname" .) "tls" | trunc 63 | trimSuffix "-" -}}
7373
{{- end -}}
7474
{{- end -}}
7575

76+
{{/*
77+
admissionController webhook
78+
*/}}
79+
80+
{{- define "vertical-pod-autoscaler.admissionController.webhook.configName" -}}
81+
{{ include "vertical-pod-autoscaler.fullname" . }}-webhook-config
82+
{{- end }}
83+
84+
{{/*
85+
admissionController certGen
86+
*/}}
87+
{{- define "vertical-pod-autoscaler.admissionController.certGen.fullname" -}}
88+
{{ include "vertical-pod-autoscaler.fullname" . }}-admission-certgen
89+
{{- end }}
90+
91+
{{- define "vertical-pod-autoscaler.admissionController.certGen.labels" -}}
92+
{{ include "vertical-pod-autoscaler.labels" . }}
93+
app.kubernetes.io/component: admission-certgen
94+
{{- end }}
95+
7696

7797
{{/*
7898
updater

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-clusterrole.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
annotations:
7+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
8+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
9+
"helm.sh/hook-weight": "-10"
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
rules:
13+
- apiGroups:
14+
- admissionregistration.k8s.io
15+
resources:
16+
- mutatingwebhookconfigurations
17+
verbs:
18+
- get
19+
- update
20+
- patch
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-clusterrolebinding.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
annotations:
7+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
8+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
9+
"helm.sh/hook-weight": "-10"
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
16+
subjects:
17+
- kind: ServiceAccount
18+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
19+
namespace: {{ .Release.Namespace }}
20+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-patch.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}-patch
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
labels:
11+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
12+
spec:
13+
ttlSecondsAfterFinished: 300
14+
template:
15+
metadata:
16+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}-patch
17+
labels:
18+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 8 }}
19+
spec:
20+
restartPolicy: OnFailure
21+
serviceAccountName: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
22+
{{- with .Values.imagePullSecrets }}
23+
imagePullSecrets:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
{{- with .Values.priorityClassName }}
27+
priorityClassName: {{ . }}
28+
{{- end }}
29+
containers:
30+
- name: patch
31+
image: {{ printf "%s:%s" .Values.admissionController.certGen.image.repository .Values.admissionController.certGen.image.tag }}
32+
imagePullPolicy: {{ .Values.admissionController.certGen.image.pullPolicy }}
33+
args:
34+
- patch
35+
- --webhook-name={{ include "vertical-pod-autoscaler.admissionController.webhook.configName" . }}
36+
- --namespace={{ .Release.Namespace }}
37+
- --secret-name={{ include "vertical-pod-autoscaler.admissionController.tls.secretName" . }}
38+
- --patch-validating=false
39+
{{- with .Values.admissionController.certGen.env }}
40+
env:
41+
{{- range $key, $value := . }}
42+
- name: {{ $key }}
43+
value: {{ $value | quote }}
44+
{{- end }}
45+
{{- end }}
46+
{{- with .Values.admissionController.certGen.resources }}
47+
resources:
48+
{{- toYaml . | nindent 12 }}
49+
{{- end }}
50+
{{- with .Values.admissionController.certGen.securityContext }}
51+
securityContext:
52+
{{- toYaml . | nindent 12 }}
53+
{{- end }}
54+
{{- with .Values.admissionController.certGen.podSecurityContext }}
55+
securityContext:
56+
{{- toYaml . | nindent 8 }}
57+
{{- end }}
58+
{{- with .Values.admissionController.certGen.nodeSelector }}
59+
nodeSelector:
60+
{{- toYaml . | nindent 8 }}
61+
{{- end }}
62+
{{- with .Values.admissionController.certGen.affinity }}
63+
affinity:
64+
{{- toYaml . | nindent 8 }}
65+
{{- end }}
66+
{{- with .Values.admissionController.certGen.tolerations }}
67+
tolerations:
68+
{{- toYaml . | nindent 8 }}
69+
{{- end }}
70+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-role.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
rules:
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- secrets
18+
verbs:
19+
- get
20+
- create
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-rolebinding.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: Role
16+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
17+
subjects:
18+
- kind: ServiceAccount
19+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
20+
namespace: {{ .Release.Namespace }}
21+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller-certgen-serviceaccount.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if and .Values.admissionController.enabled .Values.admissionController.certGen.enabled -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.admissionController.certGen.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
10+
"helm.sh/hook-weight": "-10"
11+
labels:
12+
{{- include "vertical-pod-autoscaler.admissionController.certGen.labels" . | nindent 4 }}
13+
{{- end -}}

0 commit comments

Comments
 (0)