operator: OpenShift support

On OpenShift we can use automatically generated certificates and have to use http for the scheduler extender. The scheduler extender and API webhooks then need services with different settings, therefore we now configure them separately. While at it, the formatting of the operator API documentation gets enhanced (remove unnecessary indention, odd placement of note). On 1.20, the operator testing still used the scheduler extensions whereas the YAML files didn't. Now both stop using them, for the sake of consistency.
intel · Jul 15, 2021 · 91601ed · 91601ed
1 parent 048767a
commit 91601ed
Show file tree

Hide file tree

Showing 47 changed files with 566 additions and 111 deletions.
diff --git a/deploy/crd/pmem-csi.intel.com_pmemcsideployments.yaml b/deploy/crd/pmem-csi.intel.com_pmemcsideployments.yaml
@@ -86,7 +86,9 @@ spec:
                 description: ControllerTLSSecret is the name of a secret which contains
                   ca.crt, tls.crt and tls.key data for the scheduler extender and
                   pod mutation webhook. A controller is started if (and only if) this
-                  secret is specified.
+                  secret is specified. The special string "-openshift-" enables the
+                  usage of https://docs.openshift.com/container-platform/4.6/security/certificates/service-serving-certificate.html
+                  to create certificates.
                 type: string
               deviceMode:
                 description: DeviceMode to use to manage PMEM devices.

diff --git a/deploy/kubernetes-1.19/direct/pmem-csi.yaml b/deploy/kubernetes-1.19/direct/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.19/direct/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/lvm/pmem-csi.yaml b/deploy/kubernetes-1.19/lvm/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.19/lvm/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.19/pmem-csi-direct-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/pmem-csi-direct.yaml b/deploy/kubernetes-1.19/pmem-csi-direct.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.19/pmem-csi-lvm-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.19/pmem-csi-lvm.yaml b/deploy/kubernetes-1.19/pmem-csi-lvm.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/direct/pmem-csi.yaml b/deploy/kubernetes-1.20/direct/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.20/direct/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/lvm/pmem-csi.yaml b/deploy/kubernetes-1.20/lvm/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.20/lvm/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.20/pmem-csi-direct-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/pmem-csi-direct.yaml b/deploy/kubernetes-1.20/pmem-csi-direct.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.20/pmem-csi-lvm-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.20/pmem-csi-lvm.yaml b/deploy/kubernetes-1.20/pmem-csi-lvm.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/direct/pmem-csi.yaml b/deploy/kubernetes-1.21/direct/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.21/direct/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/lvm/pmem-csi.yaml b/deploy/kubernetes-1.21/lvm/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.21/lvm/testing/pmem-csi.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.21/pmem-csi-direct-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/pmem-csi-direct.yaml b/deploy/kubernetes-1.21/pmem-csi-direct.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.21/pmem-csi-lvm-testing.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kubernetes-1.21/pmem-csi-lvm.yaml b/deploy/kubernetes-1.21/pmem-csi-lvm.yaml
@@ -364,7 +364,7 @@ spec:
         - -mode=webhooks
         - -drivername=$(PMEM_CSI_DRIVER_NAME)
         - -nodeSelector={"storage":"pmem"}
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kustomize/driver/pmem-csi.yaml b/deploy/kustomize/driver/pmem-csi.yaml
@@ -167,7 +167,7 @@ spec:
         - -nodeSelector={"storage":"pmem"}
         # ca.crt is present in pmem-csi-intel-com-controller-secret but not required for anything at
         # the moment.
-        - -caFile=/certs/ca.crt
+        - -caFile=
         - -certFile=/certs/tls.crt
         - -keyFile=/certs/tls.key
         - -schedulerListen=:8000

diff --git a/deploy/kustomize/webhook/kustomization.yaml b/deploy/kustomize/webhook/kustomization.yaml
@@ -1,2 +1,3 @@
 resources:
   - webhook.yaml
+  - webhook-service.yaml
diff --git a/deploy/kustomize/webhook/webhook-service.yaml b/deploy/kustomize/webhook/webhook-service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pmem-csi-intel-com-webhook
+  namespace: pmem-csi
+spec:
+  selector:
+    app.kubernetes.io/name: pmem-csi-controller
+    app.kubernetes.io/instance: pmem-csi.intel.com
+  ports:
+  - targetPort: 8000
+    port: 443
diff --git a/deploy/kustomize/webhook/webhook.yaml b/deploy/kustomize/webhook/webhook.yaml
@@ -24,7 +24,7 @@ webhooks:
     admissionReviewVersions: ["v1"]
     clientConfig:
       service:
-        name: pmem-csi-intel-com-scheduler
+        name: pmem-csi-intel-com-webhook
         namespace: pmem-csi
         path: /pod/mutate
       caBundle:

diff --git a/deploy/yamls.go b/deploy/yamls.go
@@ -19,6 +19,7 @@ import (
 //go:embed kubernetes-*/*/pmem-csi.yaml
 //go:embed kustomize/webhook/webhook.yaml
 //go:embed kustomize/scheduler/scheduler-service.yaml
+//go:embed kustomize/webhook/webhook-service.yaml
 var assets embed.FS
 
 // YamlFile contains all objects of a certain deployment.