diff --git a/charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml b/charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml index 4d81b475cb1d..4ab04bc4aad1 100644 --- a/charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml +++ b/charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml @@ -1343,7 +1343,7 @@ spec: clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} diff --git a/charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml b/charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml index d32ab39da36c..ee2011bcad20 100644 --- a/charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml +++ b/charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml @@ -840,7 +840,7 @@ spec: clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} diff --git a/charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml b/charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml index f656ac273252..2a7374c5595e 100644 --- a/charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml +++ b/charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml @@ -1091,7 +1091,7 @@ spec: clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} diff --git a/charts/karpenter-crd/values.yaml b/charts/karpenter-crd/values.yaml index f9c9ae3eabef..4bd07029d05b 100644 --- a/charts/karpenter-crd/values.yaml +++ b/charts/karpenter-crd/values.yaml @@ -1,7 +1,6 @@ webhook: - # -- Whether to enable the webhooks and webhook permissions. + # -- Whether to enable the webhooks. enabled: true serviceName: karpenter - serviceNamespace: kube-system # -- The container port to use for the webhook. port: 8443 \ No newline at end of file diff --git a/charts/karpenter/templates/_helpers.tpl b/charts/karpenter/templates/_helpers.tpl index 8c5ffeb059d3..701fab128153 100644 --- a/charts/karpenter/templates/_helpers.tpl +++ b/charts/karpenter/templates/_helpers.tpl @@ -75,17 +75,6 @@ Karpenter image to use {{- end }} {{- end }} -{{/* -Karpenter post-install hook image to use -*/}} -{{- define "karpenter.postInstallHook.image" -}} -{{- if .Values.postInstallHook.image.digest }} -{{- printf "%s:%s@%s" .Values.postInstallHook.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.postInstallHook.image.tag) .Values.postInstallHook.image.digest }} -{{- else }} -{{- printf "%s:%s" .Values.postInstallHook.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.postInstallHook.image.tag) }} -{{- end }} -{{- end }} - {{/* Get PodDisruptionBudget API Version */}} {{- define "karpenter.pdb.apiVersion" -}} diff --git a/charts/karpenter/templates/clusterrole-core.yaml b/charts/karpenter/templates/clusterrole-core.yaml index bf39ed0c0f62..d46de7d7036a 100644 --- a/charts/karpenter/templates/clusterrole-core.yaml +++ b/charts/karpenter/templates/clusterrole-core.yaml @@ -44,11 +44,7 @@ rules: {{- if .Values.webhook.enabled }} - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] - verbs: ["get", "watch", "list"] - {{- else }} - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["get"] + verbs: ["watch", "list"] {{- end }} - apiGroups: ["policy"] resources: ["poddisruptionbudgets"] @@ -75,11 +71,7 @@ rules: {{- if .Values.webhook.enabled }} - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] - verbs: ["update", "patch"] - {{- else }} - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["patch"] + verbs: ["update"] {{- end }} {{- with .Values.additionalClusterRoleRules -}} {{ toYaml . | nindent 2 }} diff --git a/charts/karpenter/templates/post-install-hook.yaml b/charts/karpenter/templates/post-install-hook.yaml deleted file mode 100644 index b2fd22824b8d..000000000000 --- a/charts/karpenter/templates/post-install-hook.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ .Release.Name }}-post-install-hook - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": post-install,post-upgrade,post-rollback - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed - {{- with .Values.additionalAnnotations }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - ttlSecondsAfterFinished: 0 - template: - spec: - serviceAccountName: {{ include "karpenter.serviceAccountName" . }} - restartPolicy: OnFailure - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: post-install-job - image: {{ include "karpenter.postInstallHook.image" . }} - command: - - /bin/sh - - -c - - | - {{- if .Values.webhook.enabled }} - kubectl patch customresourcedefinitions nodepools.karpenter.sh --type='merge' -p '{"spec":{"conversion":{"strategy": "Webhook", "webhook":{"conversionReviewVersions": ["v1beta1", "v1"], "clientConfig":{"service":{"name":"{{ include "karpenter.fullname" . }}", "port": {{ .Values.webhook.port }} ,"namespace": "{{ .Release.Namespace }}"}}}}}}' - kubectl patch customresourcedefinitions nodeclaims.karpenter.sh --type='merge' -p '{"spec":{"conversion":{"strategy": "Webhook", "webhook":{"conversionReviewVersions": ["v1beta1", "v1"], "clientConfig":{"service":{"name":"{{ include "karpenter.fullname" . }}", "port": {{ .Values.webhook.port }} ,"namespace": "{{ .Release.Namespace }}"}}}}}}' - kubectl patch customresourcedefinitions ec2nodeclasses.karpenter.k8s.aws --type='merge' -p '{"spec":{"conversion":{"strategy": "Webhook", "webhook":{"conversionReviewVersions": ["v1beta1", "v1"], "clientConfig":{"service":{"name":"{{ include "karpenter.fullname" . }}", "port": {{ .Values.webhook.port }} ,"namespace": "{{ .Release.Namespace }}"}}}}}}' - {{- else }} - echo "disabled webhooks" - kubectl patch customresourcedefinitions nodepools.karpenter.sh --type='json' -p '[{'op': 'remove', 'path': '/spec/conversion'}]' - kubectl patch customresourcedefinitions nodeclaims.karpenter.sh --type='json' -p '[{'op': 'remove', 'path': '/spec/conversion'}]' - kubectl patch customresourcedefinitions ec2nodeclasses.karpenter.k8s.aws --type='json' -p '[{'op': 'remove', 'path': '/spec/conversion'}]' - {{- end }} - diff --git a/charts/karpenter/values.yaml b/charts/karpenter/values.yaml index 62f65a77d934..f6d1462ab3f4 100644 --- a/charts/karpenter/values.yaml +++ b/charts/karpenter/values.yaml @@ -137,14 +137,6 @@ controller: healthProbe: # -- The container port to use for http health probe. port: 8081 -postInstallHook: - image: - # -- Repository path to the post-install hook. This minimally needs to have `kubectl` installed - repository: public.ecr.aws/bitnami/kubectl - # -- Tag of the post-install hook image. - tag: "1.30" - # -- SHA256 digest of the post-install hook image. - digest: sha256:13a2ad1bd37ce42ee2a6f1ab0d30595f42eb7fe4a90d6ec848550524104a1ed6 webhook: # -- Whether to enable the webhooks and webhook permissions. enabled: true diff --git a/hack/mutation/conversion_webhooks_injection.sh b/hack/mutation/conversion_webhooks_injection.sh index 1a466499d041..65a3ab3c8503 100755 --- a/hack/mutation/conversion_webhooks_injection.sh +++ b/hack/mutation/conversion_webhooks_injection.sh @@ -18,7 +18,7 @@ echo "{{- if .Values.webhook.enabled }} clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} " >> charts/karpenter-crd/templates/karpenter.sh_nodepools.yaml @@ -33,7 +33,7 @@ echo "{{- if .Values.webhook.enabled }} clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} " >> charts/karpenter-crd/templates/karpenter.sh_nodeclaims.yaml @@ -48,7 +48,7 @@ echo "{{- if .Values.webhook.enabled }} clientConfig: service: name: {{ .Values.webhook.serviceName }} - namespace: {{ .Values.webhook.serviceNamespace }} + namespace: {{ .Release.Namespace }} port: {{ .Values.webhook.port }} {{- end }} " >> charts/karpenter-crd/templates/karpenter.k8s.aws_ec2nodeclasses.yaml \ No newline at end of file