Monokle policies as CRDs

README.md

@@ -57,7 +57,7 @@ validatingwebhookconfiguration.admissionregistration.k8s.io/demo-webhook   1
 You can try to create sample resource and see webhook response:
 
 ```bash
-kubectl -n webhook-demo create -f examples/pod-with-conflict.yaml
+kubectl -n webhook-demo create -f examples/pod-warning.yaml
 ```
 
 ### Iterating
@@ -70,9 +70,65 @@ skaffold dev
 
 **Important**: Skaffold will recreate deployment on every change so make sure that webhook pod doesn't get rejected by it's previous version (via Validation Admission Controller).
 
+You can also do manual clean-up and run `./deploy.sh` script again:
+
+```bash
+kubectl delete all -n webhook-demo --all && \
+kubectl delete validatingwebhookconfiguration.admissionregistration.k8s.io/demo-webhook -n webhook-demo && \
+kubectl delete namespace webhook-demo && \
+kubectl delete crd monoklepolicies.monokle.com
+```
+
 ## Refs
 
 * https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/
 * https://github.com/stackrox/admission-controller-webhook-demo/tree/master
 * https://www.witodelnat.eu/blog/2021/local-kubernetes-development
-* https://minikube.sigs.k8s.io/docs/tutorials/using_psp/
+* https://minikube.sigs.k8s.io/docs/tutorials/using_psp/
+
+## Policy as CRDs
+
+> https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
+> https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/
+
+1. Start minikube.
+1. Apply resource definition:
+
+```bash
+kubectl apply -f monokle.policy.crd.yaml
+```
+
+3. Test if it was applied correctly:
+
+```bash
+kubectl get crd
+kubectl get monoklepolicy
+kubectl describe crd monoklepolicies.monokle.com
+```
+
+4. Create sample policy resource:
+
+```bash
+kubectl apply -f policy.yaml
+```
+
+5. Test if it was applied correctly:
+
+```bash
+kubectl get monoklepolicy
+kubectl describe monoklepolicy policy-sample
+```
+
+### CRDs Informer
+
+You can test how watching CRDs changes works by running:
+
+```bash
+node kac-api/scripts/list-policies.js
+```
+
+and (re)applying sample policy:
+
+```bash
+kubectl apply -f policy.yaml
+```

deploy.sh

@@ -48,6 +48,8 @@ cp deployment/deployment.yaml.template deployment.yaml
 skaffold run --namespace webhook-demo
 # kubectl apply -f deployment.yaml
 sleep 2
+kubectl apply -f monokle.policy.crd.yaml
+sleep 2
 kubectl apply -f webhook.yaml
 
 # skaffold dev

deployment/webhook.yaml.template

@@ -16,4 +16,27 @@ webhooks:
       - operations: [ "CREATE" ]
         apiGroups: [""]
         apiVersions: ["v1"]
-        resources: ["pods"]
+        resources: ["pods"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: crds-monokle-list
+rules:
+- apiGroups: ["monokle.com"]
+  resources: ["monoklepolicies"]
+  verbs: ["list", "watch", "get"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: crds-monokle-list
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: webhook-demo
+roleRef:
+  kind: ClusterRole
+  name: crds-monokle-list
+  apiGroup: rbac.authorization.k8s.io