Remove crd conversion webhook

Signed-off-by: nshankar13 <[email protected]>
openservicemesh · Sep 2, 2022 · 37c6c3a · 37c6c3a
1 parent ab69461
commit 37c6c3a
Show file tree

Hide file tree

Showing 34 changed files with 101 additions and 963 deletions.
diff --git a/charts/osm/templates/osm-bootstrap-deployment.yaml b/charts/osm/templates/osm-bootstrap-deployment.yaml
@@ -33,18 +33,10 @@ spec:
       {{- if not (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
       {{- include "restricted.securityContext" . | nindent 6 }}
       {{- end }}
-      initContainers:
-        - name: init-osm-bootstrap
-          image: "{{ include "osmCRDs.image" . }}"
-          imagePullPolicy: {{ .Values.osm.image.pullPolicy }}
-          command:
-          - sh
-          - -c
-          - >
-            kubectl apply -f /osm-crds;
-            {{- if .Values.osm.enableReconciler }}
-            kubectl label -f /osm-crds openservicemesh.io/reconcile=true --overwrite;
-            {{- end }}
+      # initContainers:
+      #   - name: init-osm-bootstrap
+      #     image: "{{ include "osmCRDs.image" . }}"
+      #     imagePullPolicy: {{ .Values.osm.image.pullPolicy }}
       containers:
         - name: osm-bootstrap
           image: "{{ include "osmBootstrap.image" . }}"

diff --git a/charts/osm/templates/osm-deployment.yaml b/charts/osm/templates/osm-deployment.yaml
@@ -36,10 +36,10 @@ spec:
       {{- if not (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
       {{- include "restricted.securityContext" . | nindent 6 }}
       {{- end }}
-      initContainers:
-        - name: init-osm-controller
-          image: {{ .Values.osm.curlImage }}
-          command: ["curl", "http://osm-bootstrap.{{ include "osm.namespace" . }}.svc.cluster.local:9091/healthz", "--connect-timeout", "2", "--retry", "50", "--retry-connrefused", "--retry-delay", "5"]
+      # initContainers:
+      #   - name: init-osm-controller
+      #     image: {{ .Values.osm.curlImage }}
+      #     command: ["curl", "http://osm-bootstrap.{{ include "osm.namespace" . }}.svc.cluster.local:9091/healthz", "--connect-timeout", "2", "--retry", "50", "--retry-connrefused", "--retry-delay", "5"]
       containers:
         - name: osm-controller
           image: "{{ include "osmController.image" . }}"

diff --git a/cmd/osm-bootstrap/crds/config_mesh_root_certificate.yaml b/cmd/osm-bootstrap/crds/config_mesh_root_certificate.yaml
@@ -30,6 +30,8 @@ spec:
       - mrc
     singular: meshrootcertificate
     plural: meshrootcertificates
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha2
       served: true

diff --git a/cmd/osm-bootstrap/crds/config_meshconfig.yaml b/cmd/osm-bootstrap/crds/config_meshconfig.yaml
@@ -30,6 +30,8 @@ spec:
       - meshconfig
     singular: meshconfig
     plural: meshconfigs
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha2
       served: true

diff --git a/cmd/osm-bootstrap/crds/patch_crds.sh b/cmd/osm-bootstrap/crds/patch_crds.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -x
+set -e
+
+cd bin
+
+CRD_LIST="meshconfigs.config.openservicemesh.io egresses.policy.openservicemesh.io ingressbackends.policy.openservicemesh.io httproutegroups.specs.smi-spec.io httproutegroups.specs.smi-spec.io tcproutes.specs.smi-spec.io traffictargets.access.smi-spec.io trafficsplits.split.smi-spec.io"
+
+for CRD in $CRD_LIST
+do
+    # First ensure that crd exists
+    get_crd=$(./kubectl get crd "$CRD" --ignore-not-found)
+    if [ "$get_crd" != "" ]; then
+        # Patch the crd conversion spec by setting the strategy to `None` if it isn't already set to `None`
+        conv_strategy=$(kubectl get crd "$CRD" -n osm-system -o jsonpath='{.spec.conversion.strategy}{"\n"}')
+        if [ "$conv_strategy" != "None" ]; then
+            ./kubectl patch crd "$CRD" --type='json' -p '[{"op" : "remove", "path" : "/spec/conversion/webhook"},{"op":"replace", "path":"/spec/conversion/strategy","value" : "None"}]'
+        fi
+    fi
+done
+
+./kubectl apply -f /osm-crds
diff --git a/cmd/osm-bootstrap/crds/policy_egress.yaml b/cmd/osm-bootstrap/crds/policy_egress.yaml
@@ -30,6 +30,8 @@ spec:
       - egress
     singular: egress
     plural: egresses
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha1
       served: true

diff --git a/cmd/osm-bootstrap/crds/policy_ingress_backend.yaml b/cmd/osm-bootstrap/crds/policy_ingress_backend.yaml
@@ -30,6 +30,8 @@ spec:
       - ingressbackend
     singular: ingressbackend
     plural: ingressbackends
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha1
       served: true

diff --git a/cmd/osm-bootstrap/crds/policy_retry.yaml b/cmd/osm-bootstrap/crds/policy_retry.yaml
@@ -30,6 +30,8 @@ spec:
       - retry
     singular: retry
     plural: retries
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha1
       served: true

diff --git a/cmd/osm-bootstrap/crds/policy_upstream_traffic_setting.yaml b/cmd/osm-bootstrap/crds/policy_upstream_traffic_setting.yaml
@@ -30,6 +30,8 @@ spec:
       - upstreamtrafficsetting
     singular: upstreamtrafficsetting
     plural: upstreamtrafficsettings
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha1
       served: true

diff --git a/cmd/osm-bootstrap/crds/smi_http_route_group.yaml b/cmd/osm-bootstrap/crds/smi_http_route_group.yaml
@@ -29,6 +29,8 @@ spec:
       - htr
     plural: httproutegroups
     singular: httproutegroup
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha4
       served: true

diff --git a/cmd/osm-bootstrap/crds/smi_tcp_route.yaml b/cmd/osm-bootstrap/crds/smi_tcp_route.yaml
@@ -29,6 +29,8 @@ spec:
       - tr
     plural: tcproutes
     singular: tcproute
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha4
       served: true

diff --git a/cmd/osm-bootstrap/crds/smi_traffic_access.yaml b/cmd/osm-bootstrap/crds/smi_traffic_access.yaml
@@ -29,6 +29,8 @@ spec:
       - tt
     plural: traffictargets
     singular: traffictarget
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha3
       served: true

diff --git a/cmd/osm-bootstrap/crds/smi_traffic_split.yaml b/cmd/osm-bootstrap/crds/smi_traffic_split.yaml
@@ -30,6 +30,8 @@ spec:
     - ts
     plural: trafficsplits
     singular: trafficsplit
+  conversion:
+    strategy: None
   versions:
     - name: v1alpha4
       served: false

diff --git a/cmd/osm-bootstrap/osm-bootstrap.go b/cmd/osm-bootstrap/osm-bootstrap.go
@@ -11,36 +11,33 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"time"
+	"path/filepath"
 
 	"github.com/spf13/pflag"
 	admissionv1 "k8s.io/api/admissionregistration/v1"
 	corev1 "k8s.io/api/core/v1"
+	apiv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	clientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	apiclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/client-go/kubernetes"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/kubectl/pkg/util"
 
 	configv1alpha2 "github.com/openservicemesh/osm/pkg/apis/config/v1alpha2"
-	"github.com/openservicemesh/osm/pkg/certificate"
 	configClientset "github.com/openservicemesh/osm/pkg/gen/client/config/clientset/versioned"
 	"github.com/openservicemesh/osm/pkg/health"
-	"github.com/openservicemesh/osm/pkg/k8s"
 
 	"github.com/openservicemesh/osm/pkg/certificate/providers"
 	"github.com/openservicemesh/osm/pkg/constants"
-	"github.com/openservicemesh/osm/pkg/crdconversion"
 	"github.com/openservicemesh/osm/pkg/httpserver"
 	"github.com/openservicemesh/osm/pkg/k8s/events"
-	"github.com/openservicemesh/osm/pkg/k8s/informers"
 	"github.com/openservicemesh/osm/pkg/logger"
-	"github.com/openservicemesh/osm/pkg/messaging"
 	"github.com/openservicemesh/osm/pkg/metricsstore"
 	"github.com/openservicemesh/osm/pkg/reconciler"
 	"github.com/openservicemesh/osm/pkg/signals"
@@ -175,6 +172,50 @@ func main() {
 		namespace:    osmNamespace,
 	}
 
+	crd_files, err := filepath.Glob("/osm-crds/*.yaml")
+
+    if err != nil {
+        log.Fatal().Err(err).Msgf("error reading files from /osm-crds")
+    }
+
+	scheme = runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	decode := codecs.UniversalDeserializer().Decode
+
+    for _, file := range crd_files {
+		yaml, err := os.ReadFile(filepath.Clean(file))
+		if err != nil {
+			log.Fatal().Err(err).Msgf("Error reading CRD file %s", file)
+		}
+
+		crd := &apiv1.CustomResourceDefinition{}
+		_, _, err = decode(yaml, nil, crd)
+		if err != nil {
+			log.Fatal().Err(err).Msgf("Error decoding CRD file %s", file)
+		}
+
+		crd.Labels[constants.ReconcileLabel] = fmt.Sprintf("%t", enableReconciler)
+
+		crdExisting, err := crdClient.CustomResourceDefinitions().Get(context.Background(), crd.Name, metav1.GetOptions{})
+		if apierrors.IsNotFound(err) {
+			if _, err = crdClient.CustomResourceDefinitions().Create(context.Background(), crd, metav1.CreateOptions{}); err != nil {
+				log.Fatal().Err(err).Msgf("Error creating crd : %s", crd.Name)
+			}
+			log.Info().Msgf("Successfully created crd: %s", crd.Name)
+		} else {
+			log.Info().Msgf("Patching conversion webhook configuration for crd: %s, setting to \"None\"", crd.Name)
+
+			crdExisting.Spec = crd.Spec
+			crdExisting.Spec.Conversion = &apiv1.CustomResourceConversion{
+				Strategy: apiv1.NoneConverter,
+			}
+			if _, err = crdClient.CustomResourceDefinitions().Update(context.Background(), crdExisting, metav1.UpdateOptions{}); err != nil {
+				log.Fatal().Err(err).Msgf("Error updating conversion webhook configuration for crd : %s", crd.Name)
+			}
+			log.Info().Msgf("successfully set conversion webhook configuration for crd : %s to \"None\"", crd.Name)
+		}
+    }
+
 	err = bootstrap.ensureMeshConfig()
 	if err != nil {
 		log.Fatal().Err(err).Msgf("Error setting up default MeshConfig %s from ConfigMap %s", meshConfigName, presetMeshConfigName)
@@ -194,7 +235,7 @@ func main() {
 		log.Fatal().Err(err).Msg("Error initializing Kubernetes events recorder")
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
+	_, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	stop := signals.RegisterExitHandlers(cancel)
 
@@ -203,48 +244,9 @@ func main() {
 		metricsstore.DefaultMetricsStore.ErrCodeCounter,
 		metricsstore.DefaultMetricsStore.HTTPResponseTotal,
 		metricsstore.DefaultMetricsStore.HTTPResponseDuration,
-		metricsstore.DefaultMetricsStore.ConversionWebhookResourceTotal,
 		metricsstore.DefaultMetricsStore.ReconciliationTotal,
 	)
 
-	msgBroker := messaging.NewBroker(stop)
-
-	informerCollection, err := informers.NewInformerCollection(meshName, stop,
-		informers.WithKubeClient(kubeClient),
-		informers.WithConfigClient(configClient, osmMeshConfigName, osmNamespace),
-	)
-
-	if err != nil {
-		events.GenericEventRecorder().FatalEvent(err, events.InitializationError, "Error creating informer collection")
-	}
-
-	certOpts, err := getCertOptions()
-	if err != nil {
-		log.Fatal().Err(err).Msg("Error getting certificate options")
-	}
-
-	k8sClient := k8s.NewClient(osmNamespace, osmMeshConfigName, informerCollection, nil, msgBroker)
-
-	var certManager *certificate.Manager
-	if enableMeshRootCertificate {
-		certManager, err = providers.NewCertificateManagerFromMRC(ctx, kubeClient, kubeConfig, osmNamespace, certOpts, k8sClient, informerCollection, 5*time.Second)
-		if err != nil {
-			events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
-				"Error initializing certificate manager of kind %s from MRC", certProviderKind)
-		}
-	} else {
-		certManager, err = providers.NewCertificateManager(ctx, kubeClient, kubeConfig, osmNamespace, certOpts, k8sClient, 5*time.Second, trustDomain)
-		if err != nil {
-			events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
-				"Error initializing certificate manager of kind %s", certProviderKind)
-		}
-	}
-
-	// Initialize the crd conversion webhook server to support the conversion of OSM's CRDs
-	if err := crdconversion.NewConversionWebhook(ctx, crdClient, certManager, osmNamespace); err != nil {
-		events.GenericEventRecorder().FatalEvent(err, events.InitializationError, fmt.Sprintf("Error creating crd conversion webhook: %s", err))
-	}
-
 	version.SetMetric()
 	/*
 	 * Initialize osm-bootstrap's HTTP server

diff --git a/dockerfiles/Dockerfile.osm-bootstrap b/dockerfiles/Dockerfile.osm-bootstrap
@@ -21,3 +21,4 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 FROM $FINAL_BASE_IMAGE
 ENV GOFIPS=1
 COPY --from=builder /osm/osm-bootstrap /
+COPY ./cmd/osm-bootstrap/crds /osm-crds/
diff --git a/dockerfiles/Dockerfile.osm-crds b/dockerfiles/Dockerfile.osm-crds
@@ -2,7 +2,7 @@ FROM --platform=$BUILDPLATFORM busybox:1.33 AS builder
 ARG TARGETPLATFORM
 # Talking to the internet in an arm64 container doesn't seem to work from a
 # amd64 Mac, so download the kubectl binary in a stage running the native arch.
-RUN wget https://dl.k8s.io/release/v1.23.5/bin/$TARGETPLATFORM/kubectl -O /bin/kubectl && \
+RUN wget https://dl.k8s.io/release/v1.22.2/bin/$TARGETPLATFORM/kubectl -O /bin/kubectl && \
     chmod +x /bin/kubectl
 FROM busybox:1.33
 COPY --from=builder /bin/kubectl /bin

diff --git a/go.mod b/go.mod
@@ -30,7 +30,6 @@ require (
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/mitchellh/gox v1.0.1
 	github.com/mitchellh/hashstructure/v2 v2.0.1
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
 	github.com/norwoodj/helm-docs v1.4.0
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/onsi/ginkgo v1.16.5

diff --git a/go.sum b/go.sum
@@ -1401,7 +1401,6 @@ github.com/mozilla/tls-observatory v0.0.0-20200317151703-4fa42e1c2dee/go.mod h1:
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/munnerz/crd-schema-fuzz v1.0.0/go.mod h1:4z/rcm37JxUkSsExFcLL6ZIT1SgDRdLiu7qq1evdVS0=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=

diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go
@@ -147,9 +147,6 @@ const (
 
 	// OSMMeshConfig is the name of the OSM MeshConfig
 	OSMMeshConfig = "osm-mesh-config"
-
-	// CRDConversionWebhookPort is the port of the CRD conversion webhook service
-	CRDConversionWebhookPort = 9443
 )
 
 // HealthProbe constants