Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: can disable webhook in helm #1101

Merged
merged 1 commit into from
Jan 13, 2025
Merged

Conversation

Rory-Z
Copy link
Member

@Rory-Z Rory-Z commented Jan 13, 2025

Summary by CodeRabbit

  • New Features

    • Added webhook configuration for EMQX Operator
    • Introduced dynamic certificate management for webhook service
    • Enhanced deployment workflow with more granular configuration options
  • Configuration Changes

    • Added webhook enablement flag in deployment settings
    • Implemented conditional webhook service and configuration resources

Copy link

coderabbitai bot commented Jan 13, 2025

Warning

Rate limit exceeded

@Rory-Z has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 14 minutes and 25 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 98ab166 and d7d7655.

📒 Files selected for processing (7)
  • .github/workflows/deploy.yaml (1 hunks)
  • deploy/charts/emqx-operator/templates/cert-manager.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager.yaml (3 hunks)
  • deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/values.yaml (1 hunks)

Walkthrough

The pull request introduces webhook functionality for the EMQX Operator by adding configuration options and resources across multiple Kubernetes deployment templates. The changes enable conditional creation of webhook-related components, including a service, mutating and validating webhook configurations, and certificate management. The workflow deployment configuration is also updated to support more granular control over webhook and installation scenarios.

Changes

File Change Summary
.github/workflows/deploy.yaml Added matrix configuration for enable_webhook and new include entries for helm installations with different EMQX configurations
deploy/charts/emqx-operator/templates/cert-manager.yaml Added conditional block for creating cert-manager Issuer and Certificate when webhook is enabled
deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml Introduced conditional Service resource for webhook with port mapping and selector configuration
deploy/charts/emqx-operator/templates/controller-manager.yaml Added webhook-related environment variable, container port, and volume mount
deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml Created conditional MutatingWebhookConfiguration for various EMQX resources
deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml Added conditional ValidatingWebhookConfiguration for EMQX operator resources
deploy/charts/emqx-operator/values.yaml Introduced webhook.enabled configuration set to true

Sequence Diagram

sequenceDiagram
    participant Cluster as Kubernetes Cluster
    participant Operator as EMQX Operator
    participant Webhook as Webhook Service

    alt Webhook Enabled
        Cluster->>Operator: Deploy with webhook.enabled=true
        Operator->>Webhook: Create Webhook Service
        Operator->>Cluster: Create Mutating/Validating Webhook Configurations
        Cluster->>Webhook: Register Webhook Endpoints
    else Webhook Disabled
        Cluster->>Operator: Deploy with webhook.enabled=false
        Operator->>Cluster: Skip Webhook Components
    end
Loading

Poem

🐰 Webhooks dance, a digital ballet,
Configurations bloom like spring's array,
EMQX Operator, now more refined,
With certificates and rules intertwined,
A rabbit's code, precise and bright! 🌟


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🔭 Outside diff range comments (1)
deploy/charts/emqx-operator/templates/crd.emqxenterprises.apps.emqx.io.yaml (1)

Line range hint 6-8: Make cert-manager annotation conditional

The cert-manager annotation should be conditional on .Values.webhook.enabled since it's only needed when webhooks are enabled.

Apply this diff:

  metadata:
    annotations:
+   {{- if .Values.webhook.enabled }}
      cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/{{ include "emqx-operator.fullname" . }}-serving-cert'
+   {{- end }}
      controller-gen.kubebuilder.io/version: v0.17.0
🧹 Nitpick comments (4)
deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml (1)

Line range hint 1-73: Consider adding timeoutSeconds and namespaceSelector.

The webhook configuration could benefit from:

  1. Explicit timeoutSeconds to prevent default timeout issues
  2. namespaceSelector when singleNamespace is false for better multi-tenant support

Example addition for each webhook:

   sideEffects: None
+  timeoutSeconds: 10
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: In
+        values:
+          - {{ .Release.Namespace }}
🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/values.yaml (1)

30-32: Consider documenting webhook feature and defaulting to false.

  1. Add documentation comments explaining the webhook feature, its requirements, and implications
  2. Consider defaulting webhook.enabled to false for safer installations

Example addition:

 webhook:
+  # -- Enable webhook server for validation and mutation of EMQX resources
+  # Requires cert-manager or manual TLS certificate configuration
+  # When enabled, validates and mutates EMQX CRDs during CREATE and UPDATE operations
-  enabled: true
+  enabled: false
.github/workflows/deploy.yaml (1)

41-47: Consider adding test cases with webhook enabled.

Current test matrix only includes cases with enable_webhook: false. Consider adding test cases with enable_webhook: true to ensure both scenarios work correctly.

         include:
           - install: helm
             enable_webhook: false
             emqx: [EMQX, emqx, "config/samples/emqx/v2beta1/emqx-slim.yaml"]
           - install: helm
             enable_webhook: false
             emqx: [EMQX, emqx, "config/samples/emqx/v2beta1/emqx-full.yaml"]
+          - install: helm
+            enable_webhook: true
+            emqx: [EMQX, emqx, "config/samples/emqx/v2beta1/emqx-slim.yaml"]
+          - install: helm
+            enable_webhook: true
+            emqx: [EMQX, emqx, "config/samples/emqx/v2beta1/emqx-full.yaml"]
deploy/charts/emqx-operator/templates/crd.emqxes.apps.emqx.io.yaml (1)

Line range hint 1-1: Consider adding validation for skipCRDs.

While the skipCRDs condition is a common pattern, consider adding validation in values.yaml to ensure it's a boolean.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 666a059 and 4ea9c0e.

📒 Files selected for processing (12)
  • .github/workflows/deploy.yaml (1 hunks)
  • deploy/charts/emqx-operator/templates/cert-manager.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager.yaml (3 hunks)
  • deploy/charts/emqx-operator/templates/crd.emqxbrokers.apps.emqx.io.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/crd.emqxenterprises.apps.emqx.io.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/crd.emqxes.apps.emqx.io.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/crd.emqxplugins.apps.emqx.io.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/crd.rebalances.apps.emqx.io.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/values.yaml (1 hunks)
👮 Files not reviewed due to content moderation or server errors (4)
  • deploy/charts/emqx-operator/templates/crd.emqxplugins.apps.emqx.io.yaml
  • deploy/charts/emqx-operator/templates/controller-manager.yaml
  • deploy/charts/emqx-operator/templates/crd.rebalances.apps.emqx.io.yaml
  • deploy/charts/emqx-operator/templates/crd.emqxbrokers.apps.emqx.io.yaml
🧰 Additional context used
🪛 yamllint (1.35.1)
deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/cert-manager.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

⏰ Context from checks skipped due to timeout of 90000ms (23)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, false)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, false)
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml, ...
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, false)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2beta1/emqx-slim.yaml, false)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, false)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml, false)
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml...
  • GitHub Check: upgrade (EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml)
  • GitHub Check: upgrade (EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml)
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml...
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml...
  • GitHub Check: upgrade (EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml)
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml...
  • GitHub Check: upgrade (EmqxBroker, emqx, config/samples/emqx/v1beta3/emqxbroker-slim.yaml)
🔇 Additional comments (7)
deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml (1)

Line range hint 1-15: LGTM! Service configuration follows best practices.

The webhook service configuration is well-structured with appropriate port mapping (443:9443) and selector labels.

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/cert-manager.yaml (2)

Line range hint 1-26: LGTM! Certificate management is well-structured.

The implementation correctly handles both webhook and cert-manager enabling conditions, with proper certificate configuration for the webhook service.

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)


Line range hint 17-21: Consider validating namespace in DNS names for multi-tenant clusters.

The DNS names in the certificate should be validated when singleNamespace is false to ensure proper operation in multi-tenant environments.

Run this script to check namespace handling:

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml (1)

Line range hint 1-94: Same improvements needed as mutating webhook configuration.

Please apply the same improvements suggested for the mutating webhook configuration regarding timeoutSeconds and namespaceSelector.

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/crd.emqxenterprises.apps.emqx.io.yaml (1)

Line range hint 12-23: LGTM: Webhook configuration looks good

The webhook configuration is properly structured with:

  • Conditional inclusion based on .Values.webhook.enabled
  • Correct webhook strategy and service configuration
  • Proper conversion review version support
deploy/charts/emqx-operator/templates/crd.emqxes.apps.emqx.io.yaml (2)

Line range hint 6-8: Proper security configuration with cert-manager integration.

The CRD correctly uses cert-manager annotations for CA injection, ensuring secure webhook communication.


Line range hint 12-23: Well-structured webhook configuration with proper security considerations.

The webhook configuration is properly structured with:

  • Conditional inclusion based on .Values.webhook.enabled
  • Clear service configuration
  • Proper versioning support

Let's verify the webhook service configuration:

✅ Verification successful

Webhook configuration is properly implemented and secure

The webhook configuration in the CRD is correctly aligned with:

  • Matching service name and namespace templating
  • Proper TLS configuration through cert-manager
  • Secure HTTPS endpoint (port 443)
  • Conditional enabling of all required components
🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify webhook service configuration
# Check if the webhook service template exists
fd -t f "controller-manager-webhook-service.yaml" deploy/charts/emqx-operator/templates/

# Check if cert-manager resources are properly configured
fd -t f "cert-manager.yaml" deploy/charts/emqx-operator/templates/

Length of output: 289


Script:

#!/bin/bash
# Check webhook service configuration
echo "=== Webhook Service Configuration ==="
cat deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml

echo -e "\n=== Cert Manager Configuration ==="
cat deploy/charts/emqx-operator/templates/cert-manager.yaml

Length of output: 1579

@Rory-Z Rory-Z force-pushed the chore/support-webhhok-disable branch 3 times, most recently from 4ac166b to 98ab166 Compare January 13, 2025 10:01
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (4)
deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml (1)

Line range hint 1-15: Consider adding a port name for better observability.

The service configuration looks good, following Kubernetes best practices. Consider adding a name to the port for better observability and potential future service mesh integration.

 spec:
   ports:
-  - port: 443
+  - name: webhook
+    port: 443
     targetPort: 9443
🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml (1)

Line range hint 1-73: Consider adding namespace selector for better control.

The mutating webhook configuration is well-structured, but consider adding a namespace selector to limit the webhook's scope and prevent potential cluster-wide impact.

Add namespace selector to each webhook:

   name: mutating.broker.emqx.io
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: NotIn
+        values: ["kube-system"]
   rules:
🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml (1)

Line range hint 1-94: Maintain consistency with mutating webhook configuration.

The validating webhook configuration follows the same pattern as the mutating webhook. Consider applying the same namespace selector recommendation here for consistency.

Apply the same namespace selector pattern to each webhook as suggested in the mutating webhook configuration.

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/controller-manager.yaml (1)

54-58: Consider adding webhook readiness probe.

The webhook port is correctly configured, but consider adding a readiness probe for the webhook endpoint to ensure it's properly initialized.

        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 9443
+          initialDelaySeconds: 5
+          periodSeconds: 10
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4ea9c0e and 98ab166.

📒 Files selected for processing (7)
  • .github/workflows/deploy.yaml (1 hunks)
  • deploy/charts/emqx-operator/templates/cert-manager.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/controller-manager.yaml (3 hunks)
  • deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml (2 hunks)
  • deploy/charts/emqx-operator/values.yaml (1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
  • deploy/charts/emqx-operator/values.yaml
  • .github/workflows/deploy.yaml
🧰 Additional context used
🪛 yamllint (1.35.1)
deploy/charts/emqx-operator/templates/cert-manager.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-mutating-configuration.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

⏰ Context from checks skipped due to timeout of 90000ms (31)
  • GitHub Check: deployment (false, helm, true, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml)
  • GitHub Check: deployment (false, helm, true, EMQX, emqx, config/samples/emqx/v2beta1/emqx-slim.yaml)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, true, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, false, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-slim.yaml, true, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2beta1/emqx-slim.yaml, false, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, true, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, false, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml, true, true)
  • GitHub Check: deployment (helm, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml, false, true)
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml, ...
  • GitHub Check: upgrade (EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml)
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml, ...
  • GitHub Check: upgrade (EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml)
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml, ...
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml, ...
  • GitHub Check: upgrade (EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml)
  • GitHub Check: upgrade (EmqxBroker, emqx, config/samples/emqx/v1beta3/emqxbroker-slim.yaml)
  • GitHub Check: deployment (helm, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml, ...
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2beta1/emqx-full.yaml, false, true)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2beta1/emqx-slim.yaml, false, true)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-full.yaml, false, true)
  • GitHub Check: deployment (static, EMQX, emqx, config/samples/emqx/v2alpha1/emqx-slim.yaml, false, true)
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-full.yaml...
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta4/emqxenterprise-slim.yaml...
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-full.yaml...
  • GitHub Check: deployment (static, EmqxEnterprise, emqx-ee, config/samples/emqx/v1beta3/emqxenterprise-slim.yaml...
  • GitHub Check: unit-test
🔇 Additional comments (3)
deploy/charts/emqx-operator/templates/cert-manager.yaml (1)

Line range hint 1-26: LGTM! Secure certificate configuration for webhook.

The certificate configuration is well-structured with appropriate DNS names and self-signed issuer. The double conditional ensures proper dependency management.

Let's verify the cert-manager CRD availability in the cluster:

✅ Verification successful

Certificate configuration is properly integrated with webhook components

The certificate configuration is verified to be correct and properly integrated:

  • Service name in certificate's DNS names matches the actual webhook service
  • Cert-manager CA injection is properly configured in webhook configurations
  • All components are consistently templated and conditionally enabled
🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check if cert-manager CRDs are available
kubectl get crd certificates.cert-manager.io issuers.cert-manager.io

Length of output: 168


Script:

#!/bin/bash
# Check webhook service and related configurations
echo "=== Checking webhook service template ==="
fd "service.yaml" deploy/charts/emqx-operator/templates/

echo -e "\n=== Checking values.yaml for cert-manager config ==="
cat deploy/charts/emqx-operator/values.yaml

echo -e "\n=== Searching for webhook configurations ==="
rg -l "webhook" deploy/charts/emqx-operator/

Length of output: 3334


Script:

#!/bin/bash
echo "=== Checking webhook service configuration ==="
cat deploy/charts/emqx-operator/templates/controller-manager-webhook-service.yaml

echo -e "\n=== Checking webhook configurations ==="
cat deploy/charts/emqx-operator/templates/webhook-validating-configuration.yaml

Length of output: 2954

🧰 Tools
🪛 yamllint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

deploy/charts/emqx-operator/templates/controller-manager.yaml (2)

30-32: LGTM! Environment variable properly configured.

The ENABLE_WEBHOOKS environment variable is correctly added and quoted.


76-81: LGTM! Secure certificate mounting configuration.

The certificate volume and mount configuration follow security best practices with appropriate read-only access and file permissions.

Also applies to: 86-92

@Rory-Z Rory-Z force-pushed the chore/support-webhhok-disable branch from 98ab166 to 66c4757 Compare January 13, 2025 10:09
@Rory-Z Rory-Z force-pushed the chore/support-webhhok-disable branch from 66c4757 to d7d7655 Compare January 13, 2025 10:16
Copy link

codecov bot commented Jan 13, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 76.24%. Comparing base (d16fa3c) to head (d7d7655).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1101      +/-   ##
==========================================
+ Coverage   76.16%   76.24%   +0.08%     
==========================================
  Files          69       69              
  Lines        6246     6246              
==========================================
+ Hits         4757     4762       +5     
+ Misses       1249     1246       -3     
+ Partials      240      238       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Rory-Z Rory-Z merged commit 8a5aac5 into main Jan 13, 2025
47 checks passed
@Rory-Z Rory-Z deleted the chore/support-webhhok-disable branch January 13, 2025 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant