Monokle policies as CRDs

.gitignore

@@ -1,3 +1,3 @@
 /.idea/
-webhook.yaml
-deployment.yaml
+k8s/manifests/webhook.yaml
+k8s/manifests/deployment.yaml

Dockerfile

@@ -1,11 +1,11 @@
 FROM node:18.16.0-bullseye-slim
 
 WORKDIR /workdir
-COPY kac-api/package*.json ./
+COPY admission-webhook/package*.json ./
 RUN npm ci --ignore-scripts
 
-COPY ./kac-api/src ./src
-COPY ./kac-api/tsconfig.json ./
+COPY ./admission-webhook/src ./src
+COPY ./admission-webhook/tsconfig.json ./
 
 CMD ["npm", "run", "prod"]
 EXPOSE 8443

README.md

@@ -1,78 +1,131 @@
-# K8s Admission Controller Demo
+# Monokle Admission Controller
 
-This was heavily inspired by https://github.com/stackrox/admission-controller-webhook-demo.
+Monokle Admission Controller is an admission controller for validating resources in the cluster.
 
-And since it is hackaton PoC there was massive amount of duct tape applied in some places ;)
+## Development
 
-## Prerequisites
+### Prerequisites
 
 * Minikube (or any other K8s cluster running)
 * kubectl
 * Skaffold
 * nodejs
 
-## Running
+### Running
 
-### Minikube
+#### Minikube
 
 Start Minikube:
 
 ```bash
 minikube start --uuid 00000000-0000-0000-0000-000000000001 --extra-config=apiserver.enable-admission-plugins=ValidatingAdmissionWebhook
 ```
 
-Every resource will be deployed to `webhook-demo` namespace, to watch it you can run:
+#### Deploying
 
 ```bash
-watch kubectl -n webhook-demo get all,ValidatingWebhookConfiguration,MutatingWebhookConfiguration
+./scripts/deploy.sh
 ```
 
-### Deploying
+Namespaced resources (webhook server) will be deployed to dedicated `monokle-admission-controller` namespace, to watch it you can run:
 
 ```bash
-./deploy.sh
+watch kubectl -n monokle-admission-controller get all,CustomResourceDefinition,ValidatingWebhookConfiguration,MutatingWebhookConfiguration
 ```
 
 After it runs, the result should be something like:
 
 ```bash
-NAME                                  READY   STATUS    RESTARTS   AGE
-pod/webhook-server-55dd5d6f44-lwwnw   1/1     Running   0          11s
+NAME                                  READY   STATUS   RESTARTS      AGE
+pod/webhook-server-7cd54c9fcf-wdkdn   0/1     Error    1 (13s ago)   25s
 
 NAME                     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
-service/webhook-server   ClusterIP   10.96.18.123   <none>        443/TCP   11s
+service/webhook-server   ClusterIP   10.97.66.194   <none>        443/TCP   25s
 
 NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
-deployment.apps/webhook-server   1/1     1            1           11s
+deployment.apps/webhook-server   0/1     1            0           25s
 
 NAME                                        DESIRED   CURRENT   READY   AGE
-replicaset.apps/webhook-server-55dd5d6f44   1         1         1       11s
+replicaset.apps/webhook-server-7cd54c9fcf   1         1         0       25s
+
+NAME                                                                       CREATED AT
+customresourcedefinition.apiextensions.k8s.io/policies.monokle.com         2023-10-02T12:17:02Z
+customresourcedefinition.apiextensions.k8s.io/policybindings.monokle.com   2023-10-02T12:17:02Z
 
 NAME                                                                       WEBHOOKS   AGE
-validatingwebhookconfiguration.admissionregistration.k8s.io/demo-webhook   1          6s
+validatingwebhookconfiguration.admissionregistration.k8s.io/demo-webhook   1          17s
+```
+
+For getting info about CRDs:
+
+```bash
+kubectl get crd
+kubectl describe crd policies.monokle.com
+kubectl describe crd policybindings.monokle.com
+```
+
+#### Testing
+
+First you need to create policy resource, for example:
+
+```bash
+kubectl apply -f examples/policy-sample-1.yaml
+kubectl apply -f examples/policy-sample-2.yaml
+```
+
+Then it needs to be bind to be used for validation. Either without scope (globally to all, but ignored namespaces) or with `matchResource` field:
+
+```bash
+kubectl apply -f examples/policy-binding-sample-1.yaml
+kubectl apply -f examples/policy-binding-sample-2.yaml
+kubectl apply -f examples/policy-binding-sample-3.yaml
 ```
 
-### Testing
+You can inspect deployed policies with:
 
-You can try to create sample resource and see webhook response:
+```bash
+kubectl get policy
+kubectl describe policy
+
+kubectl get policybinding
+kubectl describe policybinding
+```
+
+Then you can try to create sample resource and see webhook response:
 
 ```bash
-kubectl -n webhook-demo create -f examples/pod-with-conflict.yaml
+kubectl apply -f examples/pod-valid.yaml
+kubectl apply -f examples/pod-warning.yaml
+kubectl apply -f examples/pod-errors.yaml
 ```
 
-### Iterating
+#### Iterating
 
 After everything is running you can allow hot-reload by running:
 
 ```bash
-skaffold dev
+skaffold dev -f k8s/skaffold.yaml
 ```
 
 **Important**: Skaffold will recreate deployment on every change so make sure that webhook pod doesn't get rejected by it's previous version (via Validation Admission Controller).
 
-## Refs
+You can also do manual clean-up and re-run `./deploy.sh` script again:
+
+```bash
+kubectl delete all -n monokle-admission-controller --all && \
+kubectl delete validatingwebhookconfiguration.admissionregistration.k8s.io/demo-webhook -n monokle-admission-controller && \
+kubectl delete namespace monokle-admission-controller && \
+kubectl delete namespace nstest1 && \
+kubectl delete namespace nstest2 && \
+kubectl delete crd policies.monokle.com && \
+kubectl delete crd policybindings.monokle.com
+```
+
+### Refs
 
 * https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/
 * https://github.com/stackrox/admission-controller-webhook-demo/tree/master
 * https://www.witodelnat.eu/blog/2021/local-kubernetes-development
-* https://minikube.sigs.k8s.io/docs/tutorials/using_psp/
+* https://minikube.sigs.k8s.io/docs/tutorials/using_psp/
+* https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
+* https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/