Skip to content

🐛 Fix webhook cert duplicate volume mount path bug #2002

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 2, 2025
Merged

🐛 Fix webhook cert duplicate volume mount path bug #2002

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c4fb011
Remove api-service certificate volume from operator deployment
Jun 2, 2025
ca311f1
Add tls.crt and tls.key constants
Jun 2, 2025
91dc9a1
Ensure volumes with volume mounts referencing protected cert paths ge…
Jun 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 32 additions & 38 deletions internal/operator-controller/rukpak/render/registryv1/generators/generators.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,15 +26,14 @@ import (
"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util"
)

var certVolumeMounts = map[string]corev1.VolumeMount{
"apiservice-cert": {
Name: "apiservice-cert",
MountPath: "/apiserver.local.config/certificates",
},
"webhook-cert": {
Name: "webhook-cert",
MountPath: "/tmp/k8s-webhook-server/serving-certs",
},
const (
tlsCrtPath = "tls.crt"
tlsKeyPath = "tls.key"
)

// volume mount name -> mount path
var certVolumeMounts = map[string]string{
"webhook-cert": "/tmp/k8s-webhook-server/serving-certs",
}

// BundleCSVDeploymentGenerator generates all deployments defined in rv1's cluster service version (CSV). The generated
Expand Down Expand Up @@ -480,43 +479,35 @@ func getWebhookServicePort(wh v1alpha1.WebhookDescription) corev1.ServicePort {
}

func addCertVolumesToDeployment(dep *appsv1.Deployment, certSecretInfo render.CertSecretInfo) {
volumeMountsToReplace := sets.New(slices.Collect(maps.Keys(certVolumeMounts))...)
certVolumeMountPaths := sets.New(slices.Collect(maps.Values(certVolumeMounts))...)
for _, c := range dep.Spec.Template.Spec.Containers {
for _, containerVolumeMount := range c.VolumeMounts {
if certVolumeMountPaths.Has(containerVolumeMount.MountPath) {
volumeMountsToReplace.Insert(containerVolumeMount.Name)
}
}
}

// update pod volumes
dep.Spec.Template.Spec.Volumes = slices.Concat(
slices.DeleteFunc(dep.Spec.Template.Spec.Volumes, func(v corev1.Volume) bool {
_, ok := certVolumeMounts[v.Name]
return ok
return volumeMountsToReplace.Has(v.Name)
}),
[]corev1.Volume{
{
Name: "apiservice-cert",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: certSecretInfo.SecretName,
Items: []corev1.KeyToPath{
{
Key: certSecretInfo.CertificateKey,
Path: "apiserver.crt",
},
{
Key: certSecretInfo.PrivateKeyKey,
Path: "apiserver.key",
},
},
},
},
}, {
Name: "webhook-cert",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: certSecretInfo.SecretName,
Items: []corev1.KeyToPath{
{
Key: certSecretInfo.CertificateKey,
Path: "tls.crt",
Path: tlsCrtPath,
},
{
Key: certSecretInfo.PrivateKeyKey,
Path: "tls.key",
Path: tlsKeyPath,
},
},
},
Expand All @@ -529,15 +520,18 @@ func addCertVolumesToDeployment(dep *appsv1.Deployment, certSecretInfo render.Ce
for i := range dep.Spec.Template.Spec.Containers {
dep.Spec.Template.Spec.Containers[i].VolumeMounts = slices.Concat(
slices.DeleteFunc(dep.Spec.Template.Spec.Containers[i].VolumeMounts, func(v corev1.VolumeMount) bool {
_, ok := certVolumeMounts[v.Name]
return ok
return volumeMountsToReplace.Has(v.Name)
}),
slices.SortedFunc(
maps.Values(certVolumeMounts),
func(a corev1.VolumeMount, b corev1.VolumeMount) int {
return cmp.Compare(a.Name, b.Name)
},
),
func() []corev1.VolumeMount {
volumeMounts := make([]corev1.VolumeMount, 0, len(certVolumeMounts))
for _, name := range slices.Sorted(maps.Keys(certVolumeMounts)) {
volumeMounts = append(volumeMounts, corev1.VolumeMount{
Name: name,
MountPath: certVolumeMounts[name],
})
}
return volumeMounts
}(),
)
}
}
45 changes: 14 additions & 31 deletions internal/operator-controller/rukpak/render/registryv1/generators/generators_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
},
}

bundle := &bundle.RegistryV1{
b := &bundle.RegistryV1{
CSV: MakeCSV(
WithWebhookDefinitions(
v1alpha1.WebhookDescription{
Expand All @@ -189,31 +189,39 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
Spec: corev1.PodSpec{
Volumes: []corev1.Volume{
{
Name: "apiservice-cert",
Name: "some-other-mount",
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
// this volume should be replaced by the webhook-cert volume
// because it has a volume mount targeting the protected path
// /tmp/k8s-webhook-server/serving-certs
{
Name: "some-other-mount",
Name: "some-webhook-cert-mount",
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
// expect webhook-cert volume to be injected
},
Containers: []corev1.Container{
{
Name: "container-1",
VolumeMounts: []corev1.VolumeMount{
// expect apiservice-cert volume to be injected
// the mount path for this volume mount will be replaced with
// /tmp/k8s-webhook-server/serving-certs
{
Name: "webhook-cert",
MountPath: "/webhook-cert-path",
}, {
Name: "some-other-mount",
MountPath: "/some/other/mount/path",
},
// this volume mount will be removed
{
Name: "some-webhook-cert-mount",
MountPath: "/tmp/k8s-webhook-server/serving-certs",
},
},
},
{
Expand All @@ -229,7 +237,7 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
),
}

objs, err := generators.BundleCSVDeploymentGenerator(bundle, render.Options{
objs, err := generators.BundleCSVDeploymentGenerator(b, render.Options{
InstallNamespace: "install-namespace",
CertificateProvider: fakeProvider,
})
Expand All @@ -247,23 +255,6 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
},
},
{
Name: "apiservice-cert",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: "some-secret",
Items: []corev1.KeyToPath{
{
Key: "some-cert-key",
Path: "apiserver.crt",
},
{
Key: "some-private-key-key",
Path: "apiserver.key",
},
},
},
},
}, {
Name: "webhook-cert",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
Expand All @@ -290,10 +281,6 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
Name: "some-other-mount",
MountPath: "/some/other/mount/path",
},
{
Name: "apiservice-cert",
MountPath: "/apiserver.local.config/certificates",
},
{
Name: "webhook-cert",
MountPath: "/tmp/k8s-webhook-server/serving-certs",
Expand All @@ -303,10 +290,6 @@ func Test_BundleCSVDeploymentGenerator_WithCertWithCertProvider_Succeeds(t *test
{
Name: "container-2",
VolumeMounts: []corev1.VolumeMount{
{
Name: "apiservice-cert",
MountPath: "/apiserver.local.config/certificates",
},
{
Name: "webhook-cert",
MountPath: "/tmp/k8s-webhook-server/serving-certs",
Expand Down
Loading