CARRY: Configure Kueue Pod webhooks so they do not interfere with inf…

…ra Pods (kubernetes-sigs#10)
ChristianZaccaria · Apr 17, 2024 · c5a1a41 · c5a1a41
1 parent 9a73f05
commit c5a1a41
Show file tree

Hide file tree

Showing 5 changed files with 85 additions and 0 deletions.
diff --git a/config/components/webhook/kustomization.yaml b/config/components/webhook/kustomization.yaml
@@ -4,3 +4,33 @@ resources:
 
 configurations:
 - kustomizeconfig.yaml
+
+patches:
+- patch: |-
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: MutatingWebhookConfiguration
+    metadata:
+      name: mutating-webhook-configuration
+    webhooks:
+    - name: mpod.kb.io
+      namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+            - kube-system
+            - kueue-system
+- patch: |-
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: ValidatingWebhookConfiguration
+    metadata:
+      name: validating-webhook-configuration
+    webhooks:
+    - name: vpod.kb.io
+      namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+          - kube-system
+          - kueue-system
diff --git a/config/components/webhook/manifests.yaml b/config/components/webhook/manifests.yaml
@@ -156,6 +156,25 @@ webhooks:
     resources:
     - mpijobs
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /mutate--v1-pod
+  failurePolicy: Fail
+  name: mpod.kb.io
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    resources:
+    - pods
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:
@@ -417,6 +436,26 @@ webhooks:
     resources:
     - mpijobs
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate--v1-pod
+  failurePolicy: Fail
+  name: vpod.kb.io
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - pods
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:

diff --git a/config/rhoai/kustomization.yaml b/config/rhoai/kustomization.yaml
@@ -44,3 +44,5 @@ patches:
 - path: manager_webhook_patch.yaml
 - path: manager_metrics_patch.yaml
 - path: auth_proxy_service_patch.yaml
+- path: mutating_webhook_patch.yaml
+- path: validating_webhook_patch.yaml
diff --git a/config/rhoai/mutating_webhook_patch.yaml b/config/rhoai/mutating_webhook_patch.yaml
@@ -0,0 +1,7 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: mutating-webhook-configuration
+webhooks:
+  - $patch: delete
+    name: mpod.kb.io
diff --git a/config/rhoai/validating_webhook_patch.yaml b/config/rhoai/validating_webhook_patch.yaml
@@ -0,0 +1,7 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: validating-webhook-configuration
+webhooks:
+  - $patch: delete
+    name: vpod.kb.io