Documentation
¶
Index ¶
- Constants
- func EnsureCRDConversionWebhookCABundles(ctx context.Context, c client.Client, namespace, serviceName string) error
- func EnsureLegacyServiceCAMigration(ctx context.Context, c client.Client, namespace, serviceName string) error
- func EnsureWebhookCerts(ctx context.Context, c client.Client, namespace, serviceName string) error
- func GenerateInitialWebhookCerts(namespace, serviceName string) (*corev1.Secret, *corev1.Secret, []byte, error)
- type WebhookCertReconciler
Constants ¶
const ( // CASecretName is the name of the Secret containing the self-signed CA used to sign webhook serving certs. CASecretName = "webhook-serving-ca" // ServingCertSecretName is the name of the Secret containing the serving cert for the webhook server. ServingCertSecretName = "manager-serving-cert" )
Variables ¶
This section is empty.
Functions ¶
func EnsureCRDConversionWebhookCABundles ¶ added in v0.1.86
func EnsureCRDConversionWebhookCABundles(ctx context.Context, c client.Client, namespace, serviceName string) error
EnsureCRDConversionWebhookCABundles patches the caBundle field on all CRDs with conversion webhooks pointing to the HyperShift operator service. This must be called during bootstrap, before the controller manager starts, to avoid a deadlock where:
- CAPI CRDs have conversion webhooks but no caBundle
- Informers cannot sync because conversion webhook TLS verification fails
- Controller manager waits for cache sync before starting controllers
- Webhookcerts controller never starts, so CRDs never get patched
This function breaks the deadlock by patching CRDs synchronously before informers start.
func EnsureLegacyServiceCAMigration ¶ added in v0.1.86
func EnsureLegacyServiceCAMigration(ctx context.Context, c client.Client, namespace, serviceName string) error
EnsureLegacyServiceCAMigration handles the migration from service-ca managed certs to self-managed certs during bootstrap. This must be called before patching CRD bundles to avoid a situation where:
- A legacy service-ca serving cert exists alongside a self-managed CA
- CRD bundles get patched to trust the self-managed CA
- But the webhook still serves the service-ca cert
- Conversion-dependent informers fail to sync, preventing the webhookcerts controller from starting
This function removes service-ca annotations and deletes service-ca managed serving certs so the webhook will serve a cert signed by the self-managed CA that matches the patched CRD bundles.
func EnsureWebhookCerts ¶ added in v0.1.77
EnsureWebhookCerts ensures that webhook cert secrets exist so the webhook server can start. If the serving cert secret already exists with valid data, this is a no-op (the volume mount handles file delivery). If the secret is missing or has empty data, new certs are generated and persisted as secrets.
func GenerateInitialWebhookCerts ¶
func GenerateInitialWebhookCerts(namespace, serviceName string) (*corev1.Secret, *corev1.Secret, []byte, error)
GenerateInitialWebhookCerts generates the CA and serving cert secrets for use at install time. It also returns the CA bundle bytes for injection into CRDs and webhook configs.
Types ¶
type WebhookCertReconciler ¶
type WebhookCertReconciler struct {
Client client.Client
Namespace string
ServiceName string
// contains filtered or unexported fields
}
WebhookCertReconciler reconciles the self-managed webhook CA and serving cert. It is used on non-OpenShift clusters where the service-ca operator is not available.
func (*WebhookCertReconciler) SetupWithManager ¶
func (r *WebhookCertReconciler) SetupWithManager(mgr ctrl.Manager, createOrUpdate upsert.CreateOrUpdateProvider) error
Source Files