Skip to content

Commit 4475e38

Browse files
TafhimTafhim
committed
Revert "OSD-16469 - Add ingress controller webhook"
This reverts commit 28127b3.
1 parent 364e653 commit 4475e38

File tree

6 files changed

+11
-688
lines changed

6 files changed

+11
-688
lines changed

‎build/selectorsyncset.yaml‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -207,38 +207,6 @@ objects:
207207
scope: Cluster
208208
sideEffects: None
209209
timeoutSeconds: 2
210-
- apiVersion: admissionregistration.k8s.io/v1
211-
kind: ValidatingWebhookConfiguration
212-
metadata:
213-
annotations:
214-
service.beta.openshift.io/inject-cabundle: "true"
215-
creationTimestamp: null
216-
name: sre-ingresscontroller-validation
217-
webhooks:
218-
- admissionReviewVersions:
219-
- v1
220-
clientConfig:
221-
service:
222-
name: validation-webhook
223-
namespace: openshift-validation-webhook
224-
path: /ingresscontroller-validation
225-
failurePolicy: Ignore
226-
matchPolicy: Equivalent
227-
name: ingresscontroller-validation.managed.openshift.io
228-
rules:
229-
- apiGroups:
230-
- operator.openshift.io
231-
apiVersions:
232-
- '*'
233-
operations:
234-
- CREATE
235-
- UPDATE
236-
resources:
237-
- ingresscontroller
238-
- ingresscontrollers
239-
scope: Namespaced
240-
sideEffects: None
241-
timeoutSeconds: 1
242210
- apiVersion: admissionregistration.k8s.io/v1
243211
kind: ValidatingWebhookConfiguration
244212
metadata:

‎docs/webhooks-short.json‎

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@
77
"webhookName": "hiveownership-validation",
88
"documentString": "Managed OpenShift customers may not edit certain managed resources. A managed resource has a \"hive.openshift.io/managed\": \"true\" label."
99
},
10-
{
11-
"webhookName": "imagecontentpolicies-validation",
12-
"documentString": "Managed OpenShift customers may not create ImageContentSourcePolicy, ImageDigestMirrorSet, or ImageTagMirrorSet resources that configure mirrors for the entirety of quay.io, registry.redhat.io, nor registry.access.redhat.com. If needed, specific repositories can have mirrors configured, such as quay.io/example."
13-
},
14-
{
15-
"webhookName": "ingresscontroller-validation",
16-
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on infra or master nodes."
17-
},
1810
{
1911
"webhookName": "namespace-validation",
2012
"documentString": "Managed OpenShift Customers may not modify namespaces specified in the [openshift-monitoring/addons-namespaces openshift-monitoring/managed-namespaces openshift-monitoring/ocp-namespaces] ConfigMaps because customer workloads should be placed in customer-created namespaces. Customers may not create namespaces identified by this regular expression (^com$|^io$|^in$) because it could interfere with critical DNS resolution. Additionally, customers may not set or change the values of these Namespace labels [managed.openshift.io/storage-pv-quota-exempt managed.openshift.io/service-lb-quota-exempt]."
@@ -23,21 +15,13 @@
2315
"webhookName": "pod-validation",
2416
"documentString": "Managed OpenShift Customers may use tolerations on Pods that could cause those Pods to be scheduled on infra or master nodes."
2517
},
26-
{
27-
"webhookName": "prometheusrule-validation",
28-
"documentString": "Managed OpenShift Customers may not create PrometheusRule in namespaces managed by Red Hat."
29-
},
3018
{
3119
"webhookName": "regular-user-validation",
32-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [network.openshift.io admissionregistration.k8s.io cloudingress.managed.openshift.io config.openshift.io cloudcredential.openshift.io addons.managed.openshift.io upgrade.managed.openshift.io autoscaling.openshift.io machineconfiguration.openshift.io operator.openshift.io machine.openshift.io splunkforwarder.managed.openshift.io managed.openshift.io ocmagent.managed.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
33-
},
34-
{
35-
"webhookName": "regular-user-validation-osd",
36-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [], nor may Managed OpenShift customers alter the Node objects."
20+
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [autoscaling.openshift.io config.openshift.io operator.openshift.io network.openshift.io machine.openshift.io admissionregistration.k8s.io splunkforwarder.managed.openshift.io upgrade.managed.openshift.io ocmagent.managed.openshift.io cloudcredential.openshift.io addons.managed.openshift.io cloudingress.managed.openshift.io managed.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Node or SubjectPermission objects."
3721
},
3822
{
3923
"webhookName": "scc-validation",
40-
"documentString": "Managed OpenShift Customers may not modify the following default SCCs: [anyuid hostaccess hostmount-anyuid hostnetwork hostnetwork-v2 node-exporter nonroot nonroot-v2 privileged restricted restricted-v2]"
24+
"documentString": "Managed OpenShift Customers may not modify the following default SCCs: [anyuid hostaccess hostmount-anyuid hostnetwork node-exporter nonroot privileged restricted]"
4125
},
4226
{
4327
"webhookName": "techpreviewnoupgrade-validation",

‎docs/webhooks.json‎

Lines changed: 9 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -48,68 +48,6 @@
4848
},
4949
"documentString": "Managed OpenShift customers may not edit certain managed resources. A managed resource has a \"hive.openshift.io/managed\": \"true\" label."
5050
},
51-
{
52-
"webhookName": "imagecontentpolicies-validation",
53-
"rules": [
54-
{
55-
"operations": [
56-
"CREATE",
57-
"UPDATE"
58-
],
59-
"apiGroups": [
60-
"config.openshift.io"
61-
],
62-
"apiVersions": [
63-
"*"
64-
],
65-
"resources": [
66-
"imagedigestmirrorsets",
67-
"imagetagmirrorsets"
68-
],
69-
"scope": "Cluster"
70-
},
71-
{
72-
"operations": [
73-
"CREATE",
74-
"UPDATE"
75-
],
76-
"apiGroups": [
77-
"operator.openshift.io"
78-
],
79-
"apiVersions": [
80-
"*"
81-
],
82-
"resources": [
83-
"imagecontentsourcepolicies"
84-
],
85-
"scope": "Cluster"
86-
}
87-
],
88-
"documentString": "Managed OpenShift customers may not create ImageContentSourcePolicy, ImageDigestMirrorSet, or ImageTagMirrorSet resources that configure mirrors for the entirety of quay.io, registry.redhat.io, nor registry.access.redhat.com. If needed, specific repositories can have mirrors configured, such as quay.io/example."
89-
},
90-
{
91-
"webhookName": "ingresscontroller-validation",
92-
"rules": [
93-
{
94-
"operations": [
95-
"CREATE",
96-
"UPDATE"
97-
],
98-
"apiGroups": [
99-
"operator.openshift.io/v1"
100-
],
101-
"apiVersions": [
102-
"*"
103-
],
104-
"resources": [
105-
"ingresscontroller",
106-
"ingresscontrollers"
107-
],
108-
"scope": "Namespaced"
109-
}
110-
],
111-
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on infra or master nodes."
112-
},
11351
{
11452
"webhookName": "namespace-validation",
11553
"rules": [
@@ -154,29 +92,6 @@
15492
],
15593
"documentString": "Managed OpenShift Customers may use tolerations on Pods that could cause those Pods to be scheduled on infra or master nodes."
15694
},
157-
{
158-
"webhookName": "prometheusrule-validation",
159-
"rules": [
160-
{
161-
"operations": [
162-
"CREATE",
163-
"UPDATE",
164-
"DELETE"
165-
],
166-
"apiGroups": [
167-
"monitoring.coreos.com"
168-
],
169-
"apiVersions": [
170-
"*"
171-
],
172-
"resources": [
173-
"prometheusrules"
174-
],
175-
"scope": "Namespaced"
176-
}
177-
],
178-
"documentString": "Managed OpenShift Customers may not create PrometheusRule in namespaces managed by Red Hat."
179-
},
18095
{
18196
"webhookName": "regular-user-validation",
18297
"rules": [
@@ -233,25 +148,7 @@
233148
"clusterversions",
234149
"clusterversions/status",
235150
"schedulers",
236-
"apiservers",
237-
"proxies"
238-
],
239-
"scope": "*"
240-
},
241-
{
242-
"operations": [
243-
"CREATE",
244-
"UPDATE",
245-
"DELETE"
246-
],
247-
"apiGroups": [
248-
""
249-
],
250-
"apiVersions": [
251-
"*"
252-
],
253-
"resources": [
254-
"configmaps"
151+
"apiservers"
255152
],
256153
"scope": "*"
257154
},
@@ -260,14 +157,14 @@
260157
"*"
261158
],
262159
"apiGroups": [
263-
"machineconfiguration.openshift.io"
160+
"operator.openshift.io"
264161
],
265162
"apiVersions": [
266163
"*"
267164
],
268165
"resources": [
269-
"machineconfigs",
270-
"machineconfigpools"
166+
"kubeapiservers",
167+
"openshiftapiservers"
271168
],
272169
"scope": "*"
273170
},
@@ -276,14 +173,14 @@
276173
"*"
277174
],
278175
"apiGroups": [
279-
"operator.openshift.io"
176+
""
280177
],
281178
"apiVersions": [
282179
"*"
283180
],
284181
"resources": [
285-
"kubeapiservers",
286-
"openshiftapiservers"
182+
"nodes",
183+
"nodes/*"
287184
],
288185
"scope": "*"
289186
},
@@ -320,29 +217,7 @@
320217
"scope": "*"
321218
}
322219
],
323-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [admissionregistration.k8s.io config.openshift.io operator.openshift.io network.openshift.io cloudcredential.openshift.io machine.openshift.io managed.openshift.io machineconfiguration.openshift.io autoscaling.openshift.io addons.managed.openshift.io ocmagent.managed.openshift.io splunkforwarder.managed.openshift.io upgrade.managed.openshift.io cloudingress.managed.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
324-
},
325-
{
326-
"webhookName": "regular-user-validation-osd",
327-
"rules": [
328-
{
329-
"operations": [
330-
"*"
331-
],
332-
"apiGroups": [
333-
""
334-
],
335-
"apiVersions": [
336-
"*"
337-
],
338-
"resources": [
339-
"nodes",
340-
"nodes/*"
341-
],
342-
"scope": "*"
343-
}
344-
],
345-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [], nor may Managed OpenShift customers alter the Node objects."
220+
"documentString": "Managed OpenShift customers may not manage any objects in the following APIgroups [network.openshift.io cloudcredential.openshift.io managed.openshift.io ocmagent.managed.openshift.io upgrade.managed.openshift.io config.openshift.io operator.openshift.io machine.openshift.io admissionregistration.k8s.io addons.managed.openshift.io cloudingress.managed.openshift.io splunkforwarder.managed.openshift.io autoscaling.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Node or SubjectPermission objects."
346221
},
347222
{
348223
"webhookName": "scc-validation",
@@ -364,7 +239,7 @@
364239
"scope": "Cluster"
365240
}
366241
],
367-
"documentString": "Managed OpenShift Customers may not modify the following default SCCs: [anyuid hostaccess hostmount-anyuid hostnetwork hostnetwork-v2 node-exporter nonroot nonroot-v2 privileged restricted restricted-v2]"
242+
"documentString": "Managed OpenShift Customers may not modify the following default SCCs: [anyuid hostaccess hostmount-anyuid hostnetwork node-exporter nonroot privileged restricted]"
368243
},
369244
{
370245
"webhookName": "techpreviewnoupgrade-validation",

‎pkg/webhooks/add_ingresscontroller.go‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

0 commit comments

Comments
 (0)