fix: rename webhook secret name and remove leader election (#126)

Rename the secret name so that it is specific to workspace webhook. The workspace controller only runs single instance so that webhook HA is not needed. Co-authored-by: guofei <[email protected]>
kaito-project · Nov 2, 2023 · ab74683 · ab74683
1 parent 0a5a9a2
commit ab74683
Show file tree

Hide file tree

Showing 6 changed files with 10 additions and 15 deletions.
diff --git a/charts/kaito/workspace/templates/clusterrole.yaml b/charts/kaito/workspace/templates/clusterrole.yaml
@@ -39,4 +39,4 @@ rules:
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["validatingwebhookconfigurations"]
     verbs: ["update"]
-    resourceNames: ["validation.webhook.kaito.sh"]
+    resourceNames: ["validation.workspace.kaito.sh"]
diff --git a/charts/kaito/workspace/templates/role.yaml b/charts/kaito/workspace/templates/role.yaml
@@ -19,11 +19,4 @@ rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["update"]
-    resourceNames: ["webhook-cert"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["patch", "update"]
-    resourceNames: ["webhook.validationwebhook.00-of-01", "webhook.webhookcertificates.00-of-01"]
+    resourceNames: ["workspace-webhook-cert"]
diff --git a/charts/kaito/workspace/templates/secret-webhook-cert.yaml b/charts/kaito/workspace/templates/secret-webhook-cert.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: webhook-cert
+  name: workspace-webhook-cert
   namespace: {{ include "kaito.fullname" .}}
   labels:
     {{- include "kaito.labels" . | nindent 4 }}

diff --git a/charts/kaito/workspace/templates/webhooks.yaml b/charts/kaito/workspace/templates/webhooks.yaml
@@ -1,11 +1,11 @@
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: validation.webhook.kaito.sh
+  name: validation.workspace.kaito.sh
   labels:
     {{- include "kaito.labels" . | nindent 4 }}
 webhooks:
-  - name: validation.webhook.kaito.sh
+  - name: validation.workspace.kaito.sh
     admissionReviewVersions: ["v1"]
     clientConfig:
       service:

diff --git a/cmd/main.go b/cmd/main.go
@@ -129,9 +129,11 @@ func main() {
 			ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
 				ServiceName: os.Getenv(WebhookServiceName),
 				Port:        p,
-				SecretName:  "webhook-cert",
+				SecretName:  "workspace-webhook-cert",
 			})
-			sharedmain.MainWithConfig(sharedmain.WithHealthProbesDisabled(ctx), "webhook", ctrl.GetConfigOrDie(), webhooks.NewWebhooks()...)
+			ctx = sharedmain.WithHealthProbesDisabled(ctx)
+			ctx = sharedmain.WithHADisabled(ctx)
+			sharedmain.MainWithConfig(ctx, "webhook", ctrl.GetConfigOrDie(), webhooks.NewWebhooks()...)
 		}()
 		// wait 2 seconds to allow reconciling webhookconfiguration and service endpoint.
 		time.Sleep(2 * time.Second)

diff --git a/pkg/webhooks/webhooks.go b/pkg/webhooks/webhooks.go
@@ -25,7 +25,7 @@ func NewWebhooks() []knativeinjection.ControllerConstructor {
 
 func NewCRDValidationWebhook(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	return validation.NewAdmissionController(ctx,
-		"validation.webhook.kaito.sh",
+		"validation.workspace.kaito.sh",
 		"/validate/workspace.kaito.sh",
 		Resources,
 		func(ctx context.Context) context.Context { return ctx },