feat(podman): Support podman

Signed-off-by: dark0dave <dark0dave@mykolab.com>

Author: dark0dave

.envrc.sample

@@ -0,0 +1,3 @@
+set -a
+
+KUBECONFIG=konfig

.gitignore

@@ -0,0 +1,11 @@
+image.tar
+ca.crt
+ca.key
+ca.srl
+server.crt
+server.csr
+server.key
+konfig
+
+# Secret files
+.envrc

.mise.toml

@@ -0,0 +1,4 @@
+[tools]
+go = "latest"
+kind = "latest"
+kubectl = "latest"

Dockerfile

@@ -1,6 +1,4 @@
-# syntax=docker/dockerfile:experimental
-# ---
-FROM golang:1.16 AS build
+FROM docker.io/golang:1.16 AS build
 
 ENV GOOS=linux
 ENV GOARCH=amd64
@@ -9,11 +7,8 @@ ENV CGO_ENABLED=0
 WORKDIR /work
 COPY . /work
 
-# Build admission-webhook
-RUN --mount=type=cache,target=/root/.cache/go-build,sharing=private \
-  go build -o bin/admission-webhook .
+RUN go build -o bin/admission-webhook .
 
-# ---
 FROM scratch AS run
 
 COPY --from=build /work/bin/admission-webhook /usr/local/bin/

Makefile

@@ -1,83 +1,83 @@
 .PHONY: test
 test:
-	@echo "\n🛠️  Running unit tests..."
+	@echo "🛠️  Running unit tests..."
 	go test ./...
 
 .PHONY: build
 build:
-	@echo "\n🔧  Building Go binaries..."
-	GOOS=darwin GOARCH=amd64 go build -o bin/admission-webhook-darwin-amd64 .
-	GOOS=linux GOARCH=amd64 go build -o bin/admission-webhook-linux-amd64 .
+	@echo "🔧  Building Go binaries..."
+	go build -o bin/admission-webhook-linux-amd64 .
 
-.PHONY: docker-build
-docker-build:
-	@echo "\n📦 Building simple-kubernetes-webhook Docker image..."
-	docker build -t simple-kubernetes-webhook:latest .
+.PHONY: podman-build
+podman-build:
+	@echo "📦 Building simple-kubernetes-webhook podman image..."
+	podman build -t simple-kubernetes-webhook:1.0 .
 
-# From this point `kind` is required
 .PHONY: cluster
 cluster:
-	@echo "\n🔧 Creating Kubernetes cluster..."
+	@echo "🔧 Creating Kubernetes cluster..."
 	kind create cluster --config dev/manifests/kind/kind.cluster.yaml
 
 .PHONY: delete-cluster
 delete-cluster:
-	@echo "\n♻️  Deleting Kubernetes cluster..."
+	@echo "♻️  Deleting Kubernetes cluster..."
 	kind delete cluster
 
 .PHONY: push
-push: docker-build
-	@echo "\n📦 Pushing admission-webhook image into Kind's Docker daemon..."
-	kind load docker-image simple-kubernetes-webhook:latest
+push: podman-build
+	@echo "📦 Pushing admission-webhook image into Kind's podman daemon..."
+	rm -f image.tardeplo
+	podman save simple-kubernetes-webhook:1.0 -o image.tar
+	kind load image-archive image.tar
 
 .PHONY: deploy-config
 deploy-config:
-	@echo "\n⚙️  Applying cluster config..."
+	@echo "⚙️  Applying cluster config..."
 	kubectl apply -f dev/manifests/cluster-config/
 
 .PHONY: delete-config
 delete-config:
-	@echo "\n♻️  Deleting Kubernetes cluster config..."
+	@echo "♻️  Deleting Kubernetes cluster config..."
 	kubectl delete -f dev/manifests/cluster-config/
 
 .PHONY: deploy
 deploy: push delete deploy-config
-	@echo "\n🚀 Deploying simple-kubernetes-webhook..."
+	@echo "🚀 Deploying simple-kubernetes-webhook..."
 	kubectl apply -f dev/manifests/webhook/
 
 .PHONY: delete
 delete:
-	@echo "\n♻️  Deleting simple-kubernetes-webhook deployment if existing..."
+	@echo "♻️  Deleting simple-kubernetes-webhook deployment if existing..."
 	kubectl delete -f dev/manifests/webhook/ || true
 
 .PHONY: pod
 pod:
-	@echo "\n🚀 Deploying test pod..."
+	@echo "🚀 Deploying test pod..."
 	kubectl apply -f dev/manifests/pods/lifespan-seven.pod.yaml
 
 .PHONY: delete-pod
 delete-pod:
-	@echo "\n♻️ Deleting test pod..."
+	@echo "♻️ Deleting test pod..."
 	kubectl delete -f dev/manifests/pods/lifespan-seven.pod.yaml
 
 .PHONY: bad-pod
 bad-pod:
-	@echo "\n🚀 Deploying \"bad\" pod..."
+	@echo "🚀 Deploying \"bad\" pod..."
 	kubectl apply -f dev/manifests/pods/bad-name.pod.yaml
 
 .PHONY: delete-bad-pod
 delete-bad-pod:
-	@echo "\n🚀 Deleting \"bad\" pod..."
+	@echo "🚀 Deleting \"bad\" pod..."
 	kubectl delete -f dev/manifests/pods/bad-name.pod.yaml
 
 .PHONY: taint
 taint:
-	@echo "\n🎨 Taining Kubernetes node.."
+	@echo "🎨 Taining Kubernetes node.."
 	kubectl taint nodes kind-control-plane "acme.com/lifespan-remaining"=4:NoSchedule
 
 .PHONY: logs
 logs:
-	@echo "\n🔍 Streaming simple-kubernetes-webhook logs..."
+	@echo "🔍 Streaming simple-kubernetes-webhook logs..."
 	kubectl logs -l app=simple-kubernetes-webhook -f
 
 .PHONY: delete-all

dev/gen-certs.sh

@@ -2,15 +2,15 @@
 
 openssl genrsa -out ca.key 2048
 
-openssl req -new -x509 -days 365 -key ca.key \
+openssl req -new -x509 -sha256 -days 365 -key ca.key \
   -subj "/C=AU/CN=simple-kubernetes-webhook"\
   -out ca.crt
 
 openssl req -newkey rsa:2048 -nodes -keyout server.key \
   -subj "/C=AU/CN=simple-kubernetes-webhook" \
   -out server.csr
 
-openssl x509 -req \
+openssl x509 -req -sha256 \
   -extfile <(printf "subjectAltName=DNS:simple-kubernetes-webhook.default.svc") \
   -days 365 \
   -in server.csr \

dev/manifests/cluster-config/mutating.config.yaml

@@ -20,24 +20,27 @@ webhooks:
         path: /mutate-pods
         port: 443
       caBundle: |
-        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMzakNDQWNZQ0NRRFlHcU05a0ZZUjJqQU5CZ2tx
-        aGtpRzl3MEJBUXNGQURBeE1Rc3dDUVlEVlFRR0V3SkIKVlRFaU1DQUdBMVVFQXd3WmMybHRjR3hsTFd0
-        MVltVnlibVYwWlhNdGQyVmlhRzl2YXpBZUZ3MHlNVEV3TVRRdwpPREEyTkRCYUZ3MHlNakV3TVRRd09E
-        QTJOREJhTURFeEN6QUpCZ05WQkFZVEFrRlZNU0l3SUFZRFZRUUREQmx6CmFXMXdiR1V0YTNWaVpYSnVa
-        WFJsY3kxM1pXSm9iMjlyTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEEKTUlJQkNnS0NBUUVB
-        M1piR3NzSk9GZ2JkTlBDMUJjZVdaeGN4RDVoRkc0M0YxTXRwTXdzeDUrTFlJejQ3M0pPTgo0RGh6Snlr
-        V3huTVZEOEd4UElYYzNWUGNsVHp0V3dvdjdyOVo4dUxDRWdFakwyRWJFbjBKVzVTK2s2NkYwK0ZaCjI1
-        Y1lQNWVqMjVOd1Iwb3ZpbU9VZUpFelcyQktCT3ZGTTlPcmlhN0tkYkdRTWxRSkVFK3JMNXQxYWZmamhu
-        SVEKdk80MFZwblBFMkQvdmZzaTlEdmVyaTZFOFc2OWJxMEJ4NXRkZUZBalN1Q0FOWldLNjhjOEhIQ3Er
-        U3FjQ2ZaeAp5YVRmd09xQmsvYWkrMGE3a0RpUXRELzBiY0xyNkRnS3ZkckxRSmZveUlidHE1SklMamtu
-        U2VhNFJPazRMYS9xCmN3KytpNFZpVWtOS3pUSTVUWWV0c0NKWDFhZFdBMXYvQ3dJREFRQUJNQTBHQ1Nx
-        R1NJYjNEUUVCQ3dVQUE0SUIKQVFEWXMrNDRuWFc0STZLeSs2VGlGVjZveTErc3lMN2pFNlVONE1oM1JD
-        eWY4Y1Q0MEVBM3VEcTlZYjVmK3BySQpMbXZpd2RLbm1CbzhHR24zN1N1YWNtYmdMOUlxVlJUZ0hlSGZw
-        dElsblMwRklDNFVlM1hKOVRxSkNqbDBGbjgyCm9jK05FSytITjNkcldyMjMrdnZObnVlRzI4djhNenpD
-        V2JjZk9pd0I1TGQxZ0RDbEhIc2RhSHpJZFVjdkk1dGUKbFdzM3U0aXFyYkJDdWFUOWV6OUk5RTdqdHdr
-        R0hwVVpFV2tiNVhLcEt4SlNXQVRyWm5sTGRtTWxDb2FqM2grawpvbkNSd3R6L2d1aFc3dVJaWlQ4NGtE
-        MS9SWGo5d3VySE4zZ1NsVDAyVkhFeHpFUUoxM21aVS82V2p3dE05NWVmCmt6NzZiY2VoR05MU0hPU2lE
-        U1V5b0tBUQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRekNDQWl1Z0F3SUJBZ0lVZnFPVnFlL2M2
+        QkNtTlh4UGlzUEVIclBnRGl3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd01URUxNQWtHQTFVRUJoTUNR
+        VlV4SWpBZ0JnTlZCQU1NR1hOcGJYQnNaUzFyZFdKbGNtNWxkR1Z6TFhkbApZbWh2YjJzd0hoY05N
+        alF4TURJME1qQTFNalF3V2hjTk1qVXhNREkwTWpBMU1qUXdXakF4TVFzd0NRWURWUVFHCkV3SkJW
+        VEVpTUNBR0ExVUVBd3daYzJsdGNHeGxMV3QxWW1WeWJtVjBaWE10ZDJWaWFHOXZhekNDQVNJd0RR
+        WUoKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDNiVUtmVFZxTkFLanQ0U0JkbGl4
+        QllqQnh5QjNGbgo0R3NTYjB6WmxlVjhMaG0xanJFMWgzZEdWeTBhaFJBNUVEWXJOc0FSejZoY3hR
+        QnZiSFdVdHBraTRuSk5mMlY4ClVXWEJuSTlWZm9QNDlJMTFBWTBaU3ZjRHlEbThBV0VwMStQbU9n
+        bVV1bXNhOENUU0h0UTVTWWlwNWJRajJRYVMKQlZJRFk4dXRIWDNzRGZRdHJ3RUhadzNsZkVjM3Zz
+        cjNDRjd1ZlA2V2NFT1d1NC95bUJjbWdUMFQySUFtTVMxQQpJVnZVT1hPNitTNzBOajBQZEkyZTRQ
+        cVlUcFI2cWk2MkR4bEdWbDdMcTh3ZklvMjNHRllIODVrallqQkRaK3FVCmh2NXpvaHJFbzlxSlJV
+        OU82VmVxdEZTMU96Zm5Yd0xiZjBnYjVMWi9DaDRXYmRXU2hEejJZa2tDQXdFQUFhTlQKTUZFd0hR
+        WURWUjBPQkJZRUZNenhleHJzRUZGVGtEZnlUWSszQUNBRVZPMDRNQjhHQTFVZEl3UVlNQmFBRk16
+        eApleHJzRUZGVGtEZnlUWSszQUNBRVZPMDRNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29a
+        SWh2Y05BUUVMCkJRQURnZ0VCQUFMcGJQRFdyRXdkK0VmKzlKek55MWdYSU9mNVF4b0xVYXJEZUlO
+        VkdZWU9NL1ZOTlEzVWZpZE0KLzlIQWFTdUk3NkdyN210RWpsRzJBTHY2UGtER1Via296VFQ5ZHFx
+        MllzR05TVlAvZDdXY2FUMDRMWU4rd2VMaApGVU4yQURqZU90VHhNSVBZREI2cnJTR2oxMmtHa2Ez
+        YmtnSUlHQ0xvTU0wRC83V2hlUXlVMSs4UWZmMy9qRVZNCjgzcDlOZEd0RFduRWVQYzZqM3hFeVN0
+        bWd1Uzg1a0NGRy91L1FMNmllNlRYUmh4WTcyNUFvWDgrdzg2NW1POC8KUkc3T2tuVWNaRmpQWWFE
+        a1JyWmlqa1hkcHRNcERwRS9RLzBCaU9YVS9JdktBeDdtRFQyN3B4Q2VpTG8xL3JkMgp0bUVidm5O
+        akdmQmNmaXZCT0tOSEdVTDhMeXNJS01VPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
     admissionReviewVersions: ["v1"]
     sideEffects: None
     timeoutSeconds: 2

dev/manifests/cluster-config/validating.config.yaml

@@ -20,24 +20,27 @@ webhooks:
         path: /validate-pods
         port: 443
       caBundle: |
-        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMzakNDQWNZQ0NRRFlHcU05a0ZZUjJqQU5CZ2tx
-        aGtpRzl3MEJBUXNGQURBeE1Rc3dDUVlEVlFRR0V3SkIKVlRFaU1DQUdBMVVFQXd3WmMybHRjR3hsTFd0
-        MVltVnlibVYwWlhNdGQyVmlhRzl2YXpBZUZ3MHlNVEV3TVRRdwpPREEyTkRCYUZ3MHlNakV3TVRRd09E
-        QTJOREJhTURFeEN6QUpCZ05WQkFZVEFrRlZNU0l3SUFZRFZRUUREQmx6CmFXMXdiR1V0YTNWaVpYSnVa
-        WFJsY3kxM1pXSm9iMjlyTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEEKTUlJQkNnS0NBUUVB
-        M1piR3NzSk9GZ2JkTlBDMUJjZVdaeGN4RDVoRkc0M0YxTXRwTXdzeDUrTFlJejQ3M0pPTgo0RGh6Snlr
-        V3huTVZEOEd4UElYYzNWUGNsVHp0V3dvdjdyOVo4dUxDRWdFakwyRWJFbjBKVzVTK2s2NkYwK0ZaCjI1
-        Y1lQNWVqMjVOd1Iwb3ZpbU9VZUpFelcyQktCT3ZGTTlPcmlhN0tkYkdRTWxRSkVFK3JMNXQxYWZmamhu
-        SVEKdk80MFZwblBFMkQvdmZzaTlEdmVyaTZFOFc2OWJxMEJ4NXRkZUZBalN1Q0FOWldLNjhjOEhIQ3Er
-        U3FjQ2ZaeAp5YVRmd09xQmsvYWkrMGE3a0RpUXRELzBiY0xyNkRnS3ZkckxRSmZveUlidHE1SklMamtu
-        U2VhNFJPazRMYS9xCmN3KytpNFZpVWtOS3pUSTVUWWV0c0NKWDFhZFdBMXYvQ3dJREFRQUJNQTBHQ1Nx
-        R1NJYjNEUUVCQ3dVQUE0SUIKQVFEWXMrNDRuWFc0STZLeSs2VGlGVjZveTErc3lMN2pFNlVONE1oM1JD
-        eWY4Y1Q0MEVBM3VEcTlZYjVmK3BySQpMbXZpd2RLbm1CbzhHR24zN1N1YWNtYmdMOUlxVlJUZ0hlSGZw
-        dElsblMwRklDNFVlM1hKOVRxSkNqbDBGbjgyCm9jK05FSytITjNkcldyMjMrdnZObnVlRzI4djhNenpD
-        V2JjZk9pd0I1TGQxZ0RDbEhIc2RhSHpJZFVjdkk1dGUKbFdzM3U0aXFyYkJDdWFUOWV6OUk5RTdqdHdr
-        R0hwVVpFV2tiNVhLcEt4SlNXQVRyWm5sTGRtTWxDb2FqM2grawpvbkNSd3R6L2d1aFc3dVJaWlQ4NGtE
-        MS9SWGo5d3VySE4zZ1NsVDAyVkhFeHpFUUoxM21aVS82V2p3dE05NWVmCmt6NzZiY2VoR05MU0hPU2lE
-        U1V5b0tBUQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURRekNDQWl1Z0F3SUJBZ0lVZnFPVnFlL2M2
+        QkNtTlh4UGlzUEVIclBnRGl3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd01URUxNQWtHQTFVRUJoTUNR
+        VlV4SWpBZ0JnTlZCQU1NR1hOcGJYQnNaUzFyZFdKbGNtNWxkR1Z6TFhkbApZbWh2YjJzd0hoY05N
+        alF4TURJME1qQTFNalF3V2hjTk1qVXhNREkwTWpBMU1qUXdXakF4TVFzd0NRWURWUVFHCkV3SkJW
+        VEVpTUNBR0ExVUVBd3daYzJsdGNHeGxMV3QxWW1WeWJtVjBaWE10ZDJWaWFHOXZhekNDQVNJd0RR
+        WUoKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDNiVUtmVFZxTkFLanQ0U0JkbGl4
+        QllqQnh5QjNGbgo0R3NTYjB6WmxlVjhMaG0xanJFMWgzZEdWeTBhaFJBNUVEWXJOc0FSejZoY3hR
+        QnZiSFdVdHBraTRuSk5mMlY4ClVXWEJuSTlWZm9QNDlJMTFBWTBaU3ZjRHlEbThBV0VwMStQbU9n
+        bVV1bXNhOENUU0h0UTVTWWlwNWJRajJRYVMKQlZJRFk4dXRIWDNzRGZRdHJ3RUhadzNsZkVjM3Zz
+        cjNDRjd1ZlA2V2NFT1d1NC95bUJjbWdUMFQySUFtTVMxQQpJVnZVT1hPNitTNzBOajBQZEkyZTRQ
+        cVlUcFI2cWk2MkR4bEdWbDdMcTh3ZklvMjNHRllIODVrallqQkRaK3FVCmh2NXpvaHJFbzlxSlJV
+        OU82VmVxdEZTMU96Zm5Yd0xiZjBnYjVMWi9DaDRXYmRXU2hEejJZa2tDQXdFQUFhTlQKTUZFd0hR
+        WURWUjBPQkJZRUZNenhleHJzRUZGVGtEZnlUWSszQUNBRVZPMDRNQjhHQTFVZEl3UVlNQmFBRk16
+        eApleHJzRUZGVGtEZnlUWSszQUNBRVZPMDRNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29a
+        SWh2Y05BUUVMCkJRQURnZ0VCQUFMcGJQRFdyRXdkK0VmKzlKek55MWdYSU9mNVF4b0xVYXJEZUlO
+        VkdZWU9NL1ZOTlEzVWZpZE0KLzlIQWFTdUk3NkdyN210RWpsRzJBTHY2UGtER1Via296VFQ5ZHFx
+        MllzR05TVlAvZDdXY2FUMDRMWU4rd2VMaApGVU4yQURqZU90VHhNSVBZREI2cnJTR2oxMmtHa2Ez
+        YmtnSUlHQ0xvTU0wRC83V2hlUXlVMSs4UWZmMy9qRVZNCjgzcDlOZEd0RFduRWVQYzZqM3hFeVN0
+        bWd1Uzg1a0NGRy91L1FMNmllNlRYUmh4WTcyNUFvWDgrdzg2NW1POC8KUkc3T2tuVWNaRmpQWWFE
+        a1JyWmlqa1hkcHRNcERwRS9RLzBCaU9YVS9JdktBeDdtRFQyN3B4Q2VpTG8xL3JkMgp0bUVidm5O
+        akdmQmNmaXZCT0tOSEdVTDhMeXNJS01VPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
     admissionReviewVersions: ["v1"]
     sideEffects: None
     timeoutSeconds: 2

dev/manifests/kind/kind.cluster.yaml

@@ -2,7 +2,7 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
   - role: control-plane
-    image: kindest/node:v1.21.1
+    image: kindest/node:v1.31.1
     extraPortMappings:
       - containerPort: 30100
         hostPort: 8443

dev/manifests/webhook/webhook.deploy.yaml

@@ -20,8 +20,8 @@ spec:
           operator: Exists
           effect: NoSchedule
       containers:
-        - image: simple-kubernetes-webhook:latest
-          imagePullPolicy: Never
+        - image: localhost/simple-kubernetes-webhook:1.0
+          imagePullPolicy: IfNotPresent
           name: simple-kubernetes-webhook
           env:
             - name: TLS