v0.1.2

google · Jul 6, 2021 · e4a96ed · e4a96ed
1 parent 34b4e04
commit e4a96ed
Show file tree

Hide file tree

Showing 12 changed files with 203 additions and 230 deletions.
diff --git a/manifests/Kptfile b/manifests/Kptfile
@@ -1,32 +1,16 @@
-# Copyright 2021 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 apiVersion: kpt.dev/v1
 kind: Kptfile
 metadata:
   name: digester
   annotations:
-    config.kubernetes.io/local-config: 'true'
+    config.kubernetes.io/local-config: "true"
 info:
-  description: >-
-    The digester mutating admission webhook resolves tags to digests for
-    container and initContainer images in Kubernetes Pod and Pod template specs.
+  description: The digester mutating admission webhook resolves tags to digests for container and initContainer images in Kubernetes Pod and Pod template specs.
+pipeline:
+  mutators:
+    - image: gcr.io/kpt-fn/apply-setters:v0.1@sha256:d2a0219b24a47ebb4bf568d3ccf5bb0e7be2f3f94b28b0c3b1bed011a51d7c35
+      configPath: setters.yaml
 inventory:
-  inventoryID: 6f6bbbb2-4879-45c6-a89c-2c0928f0f8a8
   namespace: digester-system
   name: digester-inventory
-pipeline:
-  mutators:
-  - configPath: setters.yaml
-    image: gcr.io/kpt-fn/apply-setters:v0.1@sha256:d2a0219b24a47ebb4bf568d3ccf5bb0e7be2f3f94b28b0c3b1bed011a51d7c35
+  inventoryID: 6f6bbbb2-4879-45c6-a89c-2c0928f0f8a8
diff --git a/manifests/cluster-role-binding.yaml b/manifests/cluster-role-binding.yaml
@@ -11,7 +11,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -23,6 +22,6 @@ roleRef:
   kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
 subjects:
-- name: digester-admin
-  namespace: digester-system
-  kind: ServiceAccount
+  - name: digester-admin
+    namespace: digester-system
+    kind: ServiceAccount
diff --git a/manifests/cluster-role.yaml b/manifests/cluster-role.yaml
@@ -11,50 +11,49 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: digester-manager-role
   labels:
     digester/system: 'yes'
 rules:
-- resources:
-  - secrets # access to imagePullSecrets
-  - serviceaccounts # access to imagepullSecrets
-  apiGroups:
-  - ''
-  verbs:
-  - get
-  - list
-  - watch
-- resources:
-  - customresourcedefinitions
-  apiGroups:
-  - apiextensions.k8s.io
-  verbs:
-  - get
-  - list
-  - watch
-- resources:
-  - mutatingwebhookconfigurations
-  apiGroups:
-  - admissionregistration.k8s.io
-  verbs:
-  - get
-  - list
-  - watch
-- resources:
-  - mutatingwebhookconfigurations
-  apiGroups:
-  - admissionregistration.k8s.io
-  resourceNames:
-  - digester-mutating-webhook-configuration
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - resources:
+      - secrets # access to imagePullSecrets
+      - serviceaccounts # access to imagepullSecrets
+    apiGroups:
+      - ''
+    verbs:
+      - get
+      - list
+      - watch
+  - resources:
+      - customresourcedefinitions
+    apiGroups:
+      - apiextensions.k8s.io
+    verbs:
+      - get
+      - list
+      - watch
+  - resources:
+      - mutatingwebhookconfigurations
+    apiGroups:
+      - admissionregistration.k8s.io
+    verbs:
+      - get
+      - list
+      - watch
+  - resources:
+      - mutatingwebhookconfigurations
+    apiGroups:
+      - admissionregistration.k8s.io
+    resourceNames:
+      - digester-mutating-webhook-configuration
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
diff --git a/manifests/deployment.yaml b/manifests/deployment.yaml
@@ -11,7 +11,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -42,67 +41,67 @@ spec:
       nodeSelector:
         kubernetes.io/os: linux
       containers:
-      - name: manager
-        image: ko://github.com/google/k8s-digester # kpt-set: ${image}
-        args:
-        - webhook
-        - --cert-dir=/certs # kpt-set: --cert-dir=${cert-dir}
-        - --disable-cert-rotation=false # kpt-set: --disable-cert-rotation=${disable-cert-rotation}
-        - --dry-run=false # kpt-set: --dry-run=${dry-run}
-        - --health-addr=:9090 # kpt-set: --health-addr=:${health-port}
-        - --metrics-addr=:8888 # kpt-set: --metrics-addr=:${metrics-port}
-        - --offline=false # kpt-set: --offline=${offline}
-        - --port=8443 # kpt-set: --port=${port}
-        ports:
-        - name: webhook-server
-          protocol: TCP
-          containerPort: 8443 # kpt-set: ${port}
-        - name: metrics
-          protocol: TCP
-          containerPort: 8888 # kpt-set: ${metrics-port}
-        - name: healthz
-          protocol: TCP
-          containerPort: 9090 # kpt-set: ${health-port}
-        env:
-        - name: DEBUG
-          value: 'false' # kpt-set: ${debug}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.namespace
-        resources:
-          requests:
-            cpu: 100m # kpt-set: ${request-cpu}
-            ephemeral-storage: 256Mi # kpt-set: ${request-ephemeral-storage}
-            memory: 256Mi # kpt-set: ${request-memory}
-        volumeMounts:
-        - name: cert
-          readOnly: true
-          mountPath: /certs # kpt-set: ${cert-dir}
-        livenessProbe:
-          httpGet:
-            port: healthz
-            path: /healthz
-        readinessProbe:
-          httpGet:
-            port: healthz
-            path: /readyz
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - all
-          readOnlyRootFilesystem: true
-          runAsGroup: 65532
-          runAsNonRoot: true
-          runAsUser: 65532
+        - name: manager
+          image: gcr.io/cloud-solutions-images/k8s-digester@sha256:8ae9e02357b8efd3f1a9688ca190c7eed58c97417f8e76883083f2a563df78d6 # kpt-set: ${image}
+          args:
+            - webhook
+            - --cert-dir=/certs # kpt-set: --cert-dir=${cert-dir}
+            - --disable-cert-rotation=false # kpt-set: --disable-cert-rotation=${disable-cert-rotation}
+            - --dry-run=false # kpt-set: --dry-run=${dry-run}
+            - --health-addr=:9090 # kpt-set: --health-addr=:${health-port}
+            - --metrics-addr=:8888 # kpt-set: --metrics-addr=:${metrics-port}
+            - --offline=false # kpt-set: --offline=${offline}
+            - --port=8443 # kpt-set: --port=${port}
+          ports:
+            - name: webhook-server
+              protocol: TCP
+              containerPort: 8443 # kpt-set: ${port}
+            - name: metrics
+              protocol: TCP
+              containerPort: 8888 # kpt-set: ${metrics-port}
+            - name: healthz
+              protocol: TCP
+              containerPort: 9090 # kpt-set: ${health-port}
+          env:
+            - name: DEBUG
+              value: 'false' # kpt-set: ${debug}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+          resources:
+            requests:
+              cpu: 100m # kpt-set: ${request-cpu}
+              ephemeral-storage: 256Mi # kpt-set: ${request-ephemeral-storage}
+              memory: 256Mi # kpt-set: ${request-memory}
+          volumeMounts:
+            - name: cert
+              readOnly: true
+              mountPath: /certs # kpt-set: ${cert-dir}
+          livenessProbe:
+            httpGet:
+              port: healthz
+              path: /healthz
+          readinessProbe:
+            httpGet:
+              port: healthz
+              path: /readyz
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - all
+            readOnlyRootFilesystem: true
+            runAsGroup: 65532
+            runAsNonRoot: true
+            runAsUser: 65532
       volumes:
-      - name: cert
-        secret:
-          defaultMode: 420
-          secretName: digester-webhook-server-cert
+        - name: cert
+          secret:
+            defaultMode: 420
+            secretName: digester-webhook-server-cert
diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml
@@ -13,21 +13,20 @@
 # limitations under the License.
 
 # Skaffold uses this file when deploying.
-
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 metadata:
   name: digester-kustomize
   annotations:
     config.kubernetes.io/local-config: 'true'
 resources:
-- cluster-role-binding.yaml
-- cluster-role.yaml
-- deployment.yaml
-- mutating-webhook-configuration.yaml
-- namespace.yaml
-- role-binding.yaml
-- role.yaml
-- secret.yaml
-- service-account.yaml
-- service.yaml
+  - cluster-role-binding.yaml
+  - cluster-role.yaml
+  - deployment.yaml
+  - mutating-webhook-configuration.yaml
+  - namespace.yaml
+  - role-binding.yaml
+  - role.yaml
+  - secret.yaml
+  - service-account.yaml
+  - service.yaml