Fix certificate generation script arguments

.github/workflows/release-chart.yaml

@@ -52,4 +52,4 @@ jobs:
         with:
           charts_dir: 'helm'
         env:
-          CR_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          CR_TOKEN: '${{ secrets.CR_TOKEN }}'

.github/workflows/release-docker.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - devel
 
 jobs:
   release:
@@ -13,7 +12,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v1
         with:
-          ref: ${{ github.ref }}
+          ref: main
 
       - name: Configure Git
         run: |
@@ -23,8 +22,8 @@ jobs:
       - name: Build and push docker images (make image)
         run: make image
         env:
-          DOCKER_USER: ${GITHUB_ACTOR}
-          DOCKER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKER_USER: '${{ secrets.DOCKER_USER }}'
+          DOCKER_TOKEN: '${{ secrets.DOCKER_TOKEN }}'
 
       - name: Logout from dockerhub (make docker-logout)
         run: make docker-logout

Makefile

@@ -1,8 +1,7 @@
 # Image URL to use all building/pushing image targets;
 # Use your own docker registry and image name for dev/test by overridding the
 # IMAGE_REPO, IMAGE_NAME and IMAGE_TAG environment variable.
-REPOSITORY_BASE ?= ghcr.io
-IMAGE_REPO ?= $(REPOSITORY_BASE)/ysoftdevs/imagepullsecret-injector
+IMAGE_REPO ?= marshallmarshall
 IMAGE_NAME ?= imagepullsecret-injector
 GENERATOR_IMAGE_NAME ?= webhook-cert-generator
 
@@ -82,7 +81,7 @@ build-linux:
 image: docker-login build-image push-image
 
 docker-login:
-	@echo "$(DOCKER_TOKEN)" | docker login -u "$(DOCKER_USER)" --password-stdin "$(REPOSITORY_BASE)"
+	@echo ${DOCKER_TOKEN} | docker login -u ${DOCKER_USER} --password-stdin
 
 docker-logout:
 	@docker logout

README.md

@@ -3,8 +3,10 @@
 The responsibility of this webhook is to patch all newly created/updated service account and make sure they all contained proper imagepullsecret configuration. 
 
 This repo produces one helm chart available via helm repository https://ysoftdevs.github.io/imagepullsecret-injector. There are also 2 docker images:
-- `ghcr.io/ysoftdevs/imagepullsecret-injector/imagepullsecret-injector` - the image containing the webhook itself
-- `ghcr.io/ysoftdevs/imagepullsecret-injector/webhook-cert-generator` - helper image responsible for (re)generating the certificates
+- `marshallmarshall/imagepullsecret-injector` - the image containing the webhook itself
+- `marshallmarshall/webhook-cert-generator` - helper image responsible for (re)generating the certificates
+
+
 
 ## Helm description
 The helm chart consists of 2 parts: the certificate generator and the webhook configuration itself.
@@ -57,6 +59,3 @@ Of note is also a fact that the chart runs a lookup to the connected cluster to
     kubectl get sa -n yolo default -ojsonpath='{.imagePullSecrets}'
     ```
     The `get` command should display _some_ non-empty result.
-
-## Releasing locally
-To authenticate to the docker registry to push the images manually, you will need your own Github Personal Access Token. For more information follow this guide https://docs.github.com/en/packages/guides/migrating-to-github-container-registry-for-docker-images#authenticating-with-the-container-registry

VERSION

@@ -1 +1 @@
-0.0.10
+0.0.9

cmd/main.go

@@ -60,9 +60,9 @@ func main() {
 
 	glog.Infof("Running with config: %+v", parameters)
 
-	whsvr, err := NewWebhookServer(
-		&parameters,
-		&http.Server{
+	whsvr := &WebhookServer{
+		config: &parameters,
+		server: &http.Server{
 			Addr: fmt.Sprintf(":%v", parameters.port),
 			// This is quite inefficient as it loads file contents on every TLS ClientHello, but ¯\_(ツ)_/¯
 			TLSConfig: &tls.Config{GetCertificate: func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
@@ -71,9 +71,6 @@ func main() {
 				return &cert, err
 			}},
 		},
-	)
-	if err != nil {
-		glog.Exitf("Could not create the Webhook server: %v", err)
 	}
 
 	// define http server and server handler

cmd/webhook.go

@@ -30,7 +30,6 @@ var (
 type WebhookServer struct {
 	server *http.Server
 	config *WhSvrParameters
-	client *kubernetes.Clientset
 }
 
 // Webhook Server parameters
@@ -58,26 +57,6 @@ var (
 	}
 )
 
-func NewWebhookServer(parameters *WhSvrParameters, server *http.Server) (*WebhookServer, error) {
-	config, err := rest.InClusterConfig()
-	if err != nil {
-		glog.Errorf("Could not create k8s client: %v", err)
-		return nil, err
-	}
-	clientset, err := kubernetes.NewForConfig(config)
-	if err != nil {
-		glog.Errorf("Could not create k8s clientset: %v", err)
-		return nil, err
-	}
-
-	return &WebhookServer{
-		config: parameters,
-		server: server,
-		client: clientset,
-	}, nil
-
-}
-
 func DefaultParametersObject() WhSvrParameters {
 	return WhSvrParameters{
 		port:                           8443,
@@ -147,41 +126,46 @@ func getCurrentNamespace() string {
 
 func (whsvr *WebhookServer) ensureSecrets(ar *v1beta1.AdmissionReview) error {
 	glog.Infof("Ensuring existing secrets")
-	targetNamespace := ar.Request.Namespace
+	namespace := ar.Request.Namespace
 
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		glog.Errorf("Could not create k8s client: %v", err)
+		return err
+	}
+	clientset, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		glog.Errorf("Could not create k8s clientset: %v", err)
+		return err
+	}
 	currentNamespace := getCurrentNamespace()
 
 	glog.Infof("Looking for the source secret")
-	sourceSecret, err := whsvr.client.CoreV1().Secrets(whsvr.config.sourceImagePullSecretNamespace).Get(whsvr.config.sourceImagePullSecretName, metav1.GetOptions{})
+	sourceSecret, err := clientset.CoreV1().Secrets(whsvr.config.sourceImagePullSecretNamespace).Get(whsvr.config.sourceImagePullSecretName, metav1.GetOptions{})
 	if err != nil {
 		glog.Errorf("Could not fetch source secret %s in namespace %s: %v", whsvr.config.sourceImagePullSecretName, currentNamespace, err)
 		return err
 	}
-	if sourceSecret.Type != corev1.SecretTypeDockerConfigJson {
-		err := fmt.Errorf("source secret %s in namespace %s exists, but has incorrect type (is %s, should be %s)", whsvr.config.sourceImagePullSecretName, currentNamespace, sourceSecret.Type, corev1.SecretTypeDockerConfigJson)
-		glog.Errorf("%v", err)
-		return err
-	}
 	glog.Infof("Source secret found")
 
 	glog.Infof("Looking for the existing target secret")
-	secret, err := whsvr.client.CoreV1().Secrets(targetNamespace).Get(whsvr.config.targetImagePullSecretName, metav1.GetOptions{})
+	secret, err := clientset.CoreV1().Secrets(namespace).Get(whsvr.config.targetImagePullSecretName, metav1.GetOptions{})
 	if err != nil && !errors.IsNotFound(err) {
-		glog.Errorf("Could not fetch secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, targetNamespace, err)
+		glog.Errorf("Could not fetch secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, namespace, err)
 		return err
 	}
 
 	if err != nil && errors.IsNotFound(err) {
 		glog.Infof("Target secret not found, creating a new one")
-		if _, createErr := whsvr.client.CoreV1().Secrets(targetNamespace).Create(&corev1.Secret{
+		if _, createErr := clientset.CoreV1().Secrets(namespace).Create(&corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      whsvr.config.targetImagePullSecretName,
-				Namespace: targetNamespace,
+				Namespace: namespace,
 			},
 			Data: sourceSecret.Data,
 			Type: sourceSecret.Type,
 		}); createErr != nil {
-			glog.Errorf("Could not create secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, targetNamespace, err)
+			glog.Errorf("Could not create secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, namespace, err)
 			return err
 		}
 		glog.Infof("Target secret created successfully")
@@ -190,8 +174,8 @@ func (whsvr *WebhookServer) ensureSecrets(ar *v1beta1.AdmissionReview) error {
 
 	glog.Infof("Target secret found, updating")
 	secret.Data = sourceSecret.Data
-	if _, err := whsvr.client.CoreV1().Secrets(targetNamespace).Update(secret); err != nil {
-		glog.Errorf("Could not update secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, targetNamespace, err)
+	if _, err := clientset.CoreV1().Secrets(namespace).Update(secret); err != nil {
+		glog.Errorf("Could not update secret %s in namespace %s: %v", whsvr.config.targetImagePullSecretName, namespace, err)
 		return err
 	}
 	glog.Infof("Target secret updated successfully")

helm/imagepullsecret-injector/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.0.18
+version: 0.0.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 0.0.10
+appVersion: 0.0.9

helm/imagepullsecret-injector/scripts/create-signed-cert.sh

@@ -89,7 +89,6 @@ apiVersion: certificates.k8s.io/v1
 kind: CertificateSigningRequest
 metadata:
   name: ${csrName}
-  namespace: ${namespace}
 spec:
   signerName: kubernetes.io/kubelet-serving
   groups:

helm/imagepullsecret-injector/templates/certificate-gen/cronjob-certificate-gen.yaml

@@ -5,14 +5,13 @@ metadata:
   labels:
     {{- include "imagepullsecret-injector.labels" . | nindent 4 }}
 spec:
-  schedule: '* * * * 0'
+  schedule: '* * * * *'
   jobTemplate:
     metadata:
       name: "{{ .Release.Name }}"
       labels:
         {{- include "imagepullsecret-injector.labels" . | nindent 8 }}
     spec:
-      ttlSecondsAfterFinished: 30
       template:
         spec:
           serviceAccountName: imagepullsecret-injector-cert-gen
@@ -22,12 +21,9 @@ spec:
               image: "{{ .Values.certificateGeneratorImage.registry }}/{{ .Values.certificateGeneratorImage.repository }}:{{ .Values.certificateGeneratorImage.tag | default .Chart.AppVersion }}"
               command: ["/entrypoint/entrypoint.sh"]
               args:
-                - --service
-                - "{{ include "imagepullsecret-injector.serviceName" . }}"
-                - --namespace
-                - "{{ .Release.Namespace }}"
-                - --secret
-                - "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
+                - --service "{{ include "imagepullsecret-injector.serviceName" . }}"
+                - --namespace "{{ .Release.Namespace }}"
+                - --secret "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
               volumeMounts:
                 - mountPath: "/entrypoint"
                   name: entrypoint

helm/imagepullsecret-injector/templates/certificate-gen/job-certificate-gen.yaml

@@ -5,7 +5,6 @@ metadata:
   labels:
     {{- include "imagepullsecret-injector.labels" . | nindent 4 }}
 spec:
-  ttlSecondsAfterFinished: 30
   template:
     spec:
       serviceAccountName: imagepullsecret-injector-cert-gen
@@ -15,12 +14,9 @@ spec:
           image: "{{ .Values.certificateGeneratorImage.registry }}/{{ .Values.certificateGeneratorImage.repository }}:{{ .Values.certificateGeneratorImage.tag | default .Chart.AppVersion }}"
           command: ["/entrypoint/entrypoint.sh"]
           args:
-            - --service
-            - "{{ include "imagepullsecret-injector.serviceName" . }}"
-            - --namespace
-            - "{{ .Release.Namespace }}"
-            - --secret
-            - "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
+            - --service "{{ include "imagepullsecret-injector.serviceName" . }}"
+            - --namespace "{{ .Release.Namespace }}"
+            - --secret "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
           volumeMounts:
             - mountPath: "/entrypoint"
               name: entrypoint

helm/imagepullsecret-injector/templates/certificate-gen/rbac-certificate-gen.yaml

@@ -30,16 +30,15 @@ rules:
       - list
       - get
   - apiGroups:
-      - certificates.k8s.io
+      - "certificates.k8s.io/v1"
     resources:
       - certificatesigningrequests
     verbs:
       - create
       - list
       - get
-      - delete
   - apiGroups:
-      - certificates.k8s.io
+      - "certificates.k8s.io/v1"
     resources:
       - certificatesigningrequests/approval
     verbs:

helm/imagepullsecret-injector/templates/mutatingwebhook.yaml

@@ -21,5 +21,3 @@ webhooks:
     resources: ["serviceaccounts"]
   admissionReviewVersions: ["v1", "v1beta1"]
   sideEffects: None
-  # The default "Fail" option prevents Gardener cluster to be hibernated
-  failurePolicy: Ignore

helm/imagepullsecret-injector/values.yaml

@@ -1,12 +1,12 @@
 image:
-  registry: ghcr.io/ysoftdevs/imagepullsecret-injector
+  registry: marshallmarshall
   repository: imagepullsecret-injector
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
 
 certificateGeneratorImage:
-  registry: ghcr.io/ysoftdevs/imagepullsecret-injector
+  registry: marshallmarshall
   repository: webhook-cert-generator
   tag: ""