Fixes #2075 (This supersedes #2508 because it was easier to redo this in master than rebasing that PR. It addresses all the feedback received in #2508) The new webhook endpoint is created in a new container in the linkerd-controller pod. The proxy injector webhook was refactored to extract-out the scaffolding to be reused by the validation webhook (and eventually by any other admission webhooks we'd like to create in the future). The new common stuff now reside under controller/webhook. The validation webhook simply sets up the endpoint server and the webhook config using pkg/webhook, and calls the old profiles.Validate to perform the actual validation. I Also got rid of the unused -no-init-container flag in the proxy injector. Todo in a follow-up PRs: remove the SP check from the CLI check. Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>

Commits

Commits on Apr 5, 2019

Add validation webhook for service profiles

Address @siggy's feedback

Addressed feedback, rebase, separate validator into its own service

Update deps

Address all feedback

Update test

Another rebase

Address @siggy 's feedback