WIP: sig controller-runtime grace period testing

cmd/machineset/main.go

@@ -80,21 +80,37 @@ func main() {
 	}
 
 	// Enable defaulting and validating webhooks
-	defaulter, err := v1beta1.NewMachineDefaulter()
+	machineDefaulter, err := v1beta1.NewMachineDefaulter()
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	validator, err := v1beta1.NewMachineValidator()
+	machineValidator, err := v1beta1.NewMachineValidator()
 	if err != nil {
 		log.Fatal(err)
 	}
 
+	machineSetDefaulter, err := v1beta1.NewMachineSetDefaulter()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	machineSetValidator, err := v1beta1.NewMachineSetValidator()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	machineSetCPValidator := v1beta1.NewMachineSetCPValidator()
+
 	if *webhookEnabled {
 		mgr.GetWebhookServer().Port = *webhookPort
 		mgr.GetWebhookServer().CertDir = *webhookCertdir
-		mgr.GetWebhookServer().Register("/mutate-machine-openshift-io-v1beta1-machine", &webhook.Admission{Handler: defaulter})
-		mgr.GetWebhookServer().Register("/validate-machine-openshift-io-v1beta1-machine", &webhook.Admission{Handler: validator})
+		mgr.GetWebhookServer().Register("/mutate-machine-openshift-io-v1beta1-machine", &webhook.Admission{Handler: machineDefaulter})
+		mgr.GetWebhookServer().Register("/validate-machine-openshift-io-v1beta1-machine", &webhook.Admission{Handler: machineValidator})
+		mgr.GetWebhookServer().Register("/mutate-machine-openshift-io-v1beta1-machineset", &webhook.Admission{Handler: machineSetDefaulter})
+		mgr.GetWebhookServer().Register("/validate-machine-openshift-io-v1beta1-machineset", &webhook.Admission{Handler: machineSetValidator})
+		mgr.GetWebhookServer().Register("/validate-machine-openshift-io-v1beta1-machineset-cp-delete", &webhook.Admission{Handler: machineSetCPValidator})
+		mgr.GetWebhookServer().Register("/validate-machine-openshift-io-v1beta1-machineset-cp-update", &webhook.Admission{Handler: machineSetCPValidator})
 	}
 
 	log.Printf("Registering Components.")

go.mod

@@ -39,3 +39,5 @@ replace sigs.k8s.io/cluster-api-provider-aws => github.com/openshift/cluster-api
 replace sigs.k8s.io/cluster-api-provider-azure => github.com/openshift/cluster-api-provider-azure v0.1.0-alpha.3.0.20200529030741-17d4edc5142f
 
 replace sigs.k8s.io/cluster-api-provider-gcp => github.com/openshift/cluster-api-provider-gcp v0.0.1-0.20200528175251-4f2fdeb49fe1
+
+replace sigs.k8s.io/controller-runtime => github.com/alvaroaleman/controller-runtime v0.1.5-0.20200619152754-4a802fb9b747

go.sum

@@ -36,6 +36,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alvaroaleman/controller-runtime v0.1.5-0.20200619152754-4a802fb9b747 h1:l5sFFGjYd9YsVYN8u1JRsa4pSURnxBEpM80B1W2y46E=
+github.com/alvaroaleman/controller-runtime v0.1.5-0.20200619152754-4a802fb9b747/go.mod h1:qN/IYzFHXI7mP9qhUiGRN9uDH3fdAAqBTCqP1YkMEtQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=

install/0000_30_machine-api-operator_08_webhook.yaml

@@ -28,6 +28,26 @@ webhooks:
         resources:
           - machines
     sideEffects: None
+  - clientConfig:
+      service:
+        name: machine-api-operator-webhook
+        namespace: openshift-machine-api
+        path: /mutate-machine-openshift-io-v1beta1-machineset
+    # failurePolicy is ignore so we don't want to block machine lifecycle on the webhook operational aspects.
+    # This would be particularly problematic for chicken egg issues when bootstrapping a cluster.
+    failurePolicy: Ignore
+    matchPolicy: Equivalent
+    name: default.machineset.machine.openshift.io
+    rules:
+      - apiGroups:
+          - machine.openshift.io
+        apiVersions:
+          - v1beta1
+        operations:
+          - CREATE
+        resources:
+          - machinesets
+    sideEffects: None
 ---
 apiVersion: admissionregistration.k8s.io/v1beta1
 kind: ValidatingWebhookConfiguration
@@ -59,3 +79,64 @@ webhooks:
         resources:
           - machines
     sideEffects: None
+  - clientConfig:
+      service:
+        name: machine-api-operator-webhook
+        namespace: openshift-machine-api
+        path: /validate-machine-openshift-io-v1beta1-machineset
+    # failurePolicy is ignore so we don't want to block machine lifecycle on the webhook operational aspects.
+    # This would be particularly problematic for chicken egg issues when bootstrapping a cluster.
+    failurePolicy: Ignore
+    matchPolicy: Equivalent
+    name: validation.machineset.machine.openshift.io
+    rules:
+      - apiGroups:
+          - machine.openshift.io
+        apiVersions:
+          - v1beta1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - machinesets
+    sideEffects: None
+  - clientConfig:
+      service:
+        name: machine-api-operator-webhook
+        namespace: openshift-machine-api
+        path: /validate-machine-openshift-io-v1beta1-machineset-cp-delete
+    # failurePolicy is Fail so we ensure control plane machinesets are never
+    # deleted.
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    name: delete.cp.validation.machineset.machine.openshift.io
+    rules:
+      - apiGroups:
+          - machine.openshift.io
+        apiVersions:
+          - v1beta1
+        operations:
+          - DELETE
+        resources:
+          - machinesets
+    sideEffects: None
+  - clientConfig:
+      service:
+        name: machine-api-operator-webhook
+        namespace: openshift-machine-api
+        path: /validate-machine-openshift-io-v1beta1-machineset-cp-update
+    # failurePolicy is Fail so we ensure control plane machinesets are never
+    # made non-CP machinesets.
+    failurePolicy: Fail
+    matchPolicy: Equivalent
+    name: update.cp.validation.machineset.machine.openshift.io
+    rules:
+      - apiGroups:
+          - machine.openshift.io
+        apiVersions:
+          - v1beta1
+        operations:
+          - UPDATE
+        resources:
+          - machinesets
+    sideEffects: None