refactor: run webhook in background

apis/rollout/v1alpha1/rollout_types.go

@@ -64,7 +64,7 @@ type RolloutSpec struct {
 
 	// TrafficTopologies defines the networking traffic relationships between
 	// workloads, backend services, and routes.
-	TrafficTopologyRefs []string `json:"trafficTopologyRefs"`
+	TrafficTopologyRefs []string `json:"trafficTopologyRefs,omitempty"`
 }
 
 type RolloutTriggerPolicy string
@@ -195,18 +195,20 @@ type RolloutBatchStepState string
 const (
 	// BatchStepStatePending means the step is pending.
 	BatchStepStatePending RolloutBatchStepState = "Pending"
+	// BatchStepStatePreCanaryStepHook means the step is in pre canary hook
+	BatchStepStatePreCanaryStepHook RolloutBatchStepState = RolloutBatchStepState(PreCanaryStepHook)
 	// BatchStepStatePreBatchStepHook means the step is in pre batch hook
-	BatchStepStatePreBatchStepHook RolloutBatchStepState = RolloutBatchStepState(HookTypePreBatchStep)
+	BatchStepStatePreBatchStepHook RolloutBatchStepState = RolloutBatchStepState(PreBatchStepHook)
 	// BatchStepStateRunning means the step is running.
 	BatchStepStateRunning RolloutBatchStepState = "Running"
+	// BatchStepStatePostCanaryStepHook means the step is in post canary hook
+	BatchStepStatePostCanaryStepHook RolloutBatchStepState = RolloutBatchStepState(PostCanaryStepHook)
 	// BatchStepStatePostBatchStepHook means the step is in post batch hook
-	BatchStepStatePostBatchStepHook RolloutBatchStepState = RolloutBatchStepState(HookTypePostBatchStep)
+	BatchStepStatePostBatchStepHook RolloutBatchStepState = RolloutBatchStepState(PostBatchStepHook)
 	// BatchStepStateSucceeded means the step is completed.
 	BatchStepStateSucceeded RolloutBatchStepState = "Succeeded"
 	// BatchStepStatePaused means the step is paused.
 	BatchStepStatePaused RolloutBatchStepState = "Paused"
 	// BatchStepStateCanceled means the step is canceled.
 	BatchStepStateCanceled RolloutBatchStepState = "Canceled"
-	// BatchStepStateError means the step is error.
-	BatchStepStateError RolloutBatchStepState = "Error"
 )

apis/rollout/v1alpha1/rollout_webhook_types.go

@@ -45,6 +45,11 @@ type RolloutWebhook struct {
 	Provider *string `json:"provider,omitempty"`
 }
 
+// Error implements error.
+func (*RolloutWebhook) Error() string {
+	panic("unimplemented")
+}
+
 // FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled.
 type FailurePolicyType string
 
@@ -86,7 +91,7 @@ type WebhookClientConfig struct {
 	URL string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
 
 	// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
-	// If unspecified, system trust roots on the apiserver are used.
+	// If unspecified, system trust roots' CA on the node.
 	// +optional
 	CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
 
@@ -118,9 +123,6 @@ type RolloutWebhookReviewSpec struct {
 	// Rollout Name
 	RolloutName string `json:"rolloutName,omitempty"`
 
-	// Rollout Namespace
-	RolloutNamespace string `json:"rolloutNamespace,omitempty"`
-
 	// Rollout ID
 	RolloutID string `json:"rolloutID,omitempty"`
 
@@ -162,16 +164,16 @@ type RolloutWebhookReviewBatch struct {
 type HookType string
 
 const (
-	HookTypePreBatchStep  HookType = "PreBatchStepHook"
-	HookTypePostBatchStep HookType = "PostBatchStepHook"
+	PreCanaryStepHook  HookType = "PreCanaryStepHook"
+	PostCanaryStepHook HookType = "PostCanaryStepHook"
+	PreBatchStepHook   HookType = "PreBatchStepHook"
+	PostBatchStepHook  HookType = "PostBatchStepHook"
 )
 
 type RolloutWebhookReviewStatus struct {
 	CodeReasonMessage `json:",inline"`
 }
 
-type WebhookReviewCode string
-
 const (
 	WebhookReviewCodeOK         string = "OK"
 	WebhookReviewCodeError      string = "Error"

apis/rollout/v1alpha1/rolloutrun_types.go

@@ -57,7 +57,7 @@ type RolloutRunSpec struct {
 	Canary *RolloutRunCanaryStrategy `json:"canary,omitempty"`
 
 	// Batch Strategy
-	Batch RolloutRunBatchStrategy `json:"batch,omitempty"`
+	Batch *RolloutRunBatchStrategy `json:"batch,omitempty"`
 }
 
 type RolloutRunBatchStrategy struct {
@@ -183,10 +183,18 @@ type BatchWebhookStatus struct {
 	CodeReasonMessage `json:",inline"`
 	// Failure count
 	FailureCount int32 `json:"failureCount,omitempty"`
-	// Failure count when an error occurred
-	FailureCountAtError int32 `json:"failureCountAtError,omitempty"`
+	// Current webhook worker state
+	State WebhookState `json:"state,omitempty"`
 }
 
+type WebhookState string
+
+const (
+	WebhookRunning   = "Running"
+	WebhookOnHold    = "OnHold"
+	WebhookCompleted = "Completed"
+)
+
 func (r *RolloutRun) IsCompleted() bool {
 	if r == nil {
 		return false

apis/rollout/well_known_annotations.go

@@ -16,12 +16,14 @@ package rollout
 
 const (
 	// LabelRolloutManualCommand is set in Rollout for users to manipulate rolloutRun
-	AnnoManualCommandKey    = "rollout.kusionstack.io/manual-command"
-	AnnoManualCommandResume = "resume"
-	AnnoManualCommandRetry  = "retry"
-	AnnoManualCommandSkip   = "skip"
-	AnnoManualCommandPause  = "pause"
-	AnnoManualCommandCancel = "cancel"
+	AnnoManualCommandKey = "rollout.kusionstack.io/manual-command"
+	// Deprecated: use continue
+	AnnoManualCommandResume   = "resume"
+	AnnoManualCommandContinue = "continue"
+	AnnoManualCommandRetry    = "retry"
+	AnnoManualCommandSkip     = "skip"
+	AnnoManualCommandPause    = "pause"
+	AnnoManualCommandCancel   = "cancel"
 
 	AnnoRolloutTrigger = "rollout.kusionstack.io/trigger"
 

config/crd/bases/rollout.kusionstack.io_rolloutruns.yaml

@@ -455,7 +455,7 @@ spec:
                       description: ClientConfig defines how to communicate with the hook. Required
                       properties:
                         caBundle:
-                          description: '`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook''s server certificate. If unspecified, system trust roots on the apiserver are used.'
+                          description: '`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook''s server certificate. If unspecified, system trust roots'' CA on the node.'
                           format: byte
                           type: string
                         periodSeconds:
@@ -589,10 +589,6 @@ spec:
                                 description: Failure count
                                 format: int32
                                 type: integer
-                              failureCountAtError:
-                                description: Failure count when an error occurred
-                                format: int32
-                                type: integer
                               hookType:
                                 description: Webhook Type
                                 type: string
@@ -605,6 +601,9 @@ spec:
                               reason:
                                 description: A human-readable short word
                                 type: string
+                              state:
+                                description: Current webhook worker state
+                                type: string
                             type: object
                           type: array
                       type: object
@@ -691,10 +690,6 @@ spec:
                           description: Failure count
                           format: int32
                           type: integer
-                        failureCountAtError:
-                          description: Failure count when an error occurred
-                          format: int32
-                          type: integer
                         hookType:
                           description: Webhook Type
                           type: string
@@ -707,6 +702,9 @@ spec:
                         reason:
                           description: A human-readable short word
                           type: string
+                        state:
+                          description: Current webhook worker state
+                          type: string
                       type: object
                     type: array
                 type: object

config/crd/bases/rollout.kusionstack.io_rollouts.yaml

@@ -110,8 +110,6 @@ spec:
                 - kind
                 - match
                 type: object
-            required:
-            - trafficTopologyRefs
             type: object
           status:
             description: RolloutStatus defines the observed state of Rollout

config/crd/bases/rollout.kusionstack.io_rolloutstrategies.yaml

@@ -511,7 +511,7 @@ spec:
                   description: ClientConfig defines how to communicate with the hook. Required
                   properties:
                     caBundle:
-                      description: '`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook''s server certificate. If unspecified, system trust roots on the apiserver are used.'
+                      description: '`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook''s server certificate. If unspecified, system trust roots'' CA on the node.'
                       format: byte
                       type: string
                     periodSeconds:

go.mod

@@ -22,15 +22,17 @@ require (
 	k8s.io/component-base v0.28.4
 	k8s.io/klog/v2 v2.100.1
 	k8s.io/kubernetes v1.22.2
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
 	kusionstack.io/kube-api v0.0.27
 	kusionstack.io/kube-utils v0.1.8
 	sigs.k8s.io/controller-runtime v0.16.3
 )
 
 require (
+	github.com/elliotchance/pie/v2 v2.8.0 // indirect
 	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	gotest.tools/v3 v3.4.0 // indirect
 )
 

go.sum

@@ -150,6 +150,8 @@ github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/elliotchance/pie/v2 v2.8.0 h1://QS43W8sEha8XV/fjngO5iMudN3XARJV5cpBayAcVY=
+github.com/elliotchance/pie/v2 v2.8.0/go.mod h1:18t0dgGFH006g4eVdDtWfgFZPQEgl10IoEO8YWEq3Og=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
@@ -609,6 +611,7 @@ golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
 golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1008,6 +1011,8 @@ k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 kusionstack.io/kube-api v0.0.27 h1:7umLyoMmOdse0A8nXGccNpOdYu7B5sNPLoPxc/hmBIY=
 kusionstack.io/kube-api v0.0.27/go.mod h1:QIQrH+MK9xuV+mXCAkk6DN8z6b8oyf4XN0VRccmHH/k=
 kusionstack.io/kube-utils v0.1.8 h1:l8DXs5ODzT81SCxrWHui8d8g9GnqgX93j7EvTRn1R5I=

pkg/controllers/rollout/rollout_controller.go

@@ -629,7 +629,7 @@ func (r *RolloutReconciler) applyOneTimeStrategy(obj *rolloutv1alpha1.Rollout, r
 		// update strategy in annotation
 		run.Annotations[ontimestrategy.AnnoOneTimeStrategy] = strategyStr
 		// update batch in spec
-		run.Spec.Batch = batch
+		run.Spec.Batch = &batch
 		return nil
 	})
 

pkg/controllers/rollout/utils.go

@@ -84,7 +84,7 @@ func constructRolloutRun(instance *rolloutv1alpha1.Rollout, strategy *rolloutv1a
 				APIVersion: instance.Spec.WorkloadRef.APIVersion,
 				Kind:       instance.Spec.WorkloadRef.Kind,
 			},
-			Batch: rolloutv1alpha1.RolloutRunBatchStrategy{
+			Batch: &rolloutv1alpha1.RolloutRunBatchStrategy{
 				Toleration: strategy.Batch.Toleration,
 				Batches:    constructRolloutRunBatches(strategy.Batch, workloadWrappers),
 			},

pkg/controllers/rolloutrun/executor/alias.go

@@ -6,7 +6,7 @@ const (
 	BatchStateInitial       = rolloutv1alpha1.BatchStepStatePending
 	BatchStatePaused        = rolloutv1alpha1.BatchStepStatePaused
 	BatchStatePreBatchHook  = rolloutv1alpha1.BatchStepStatePreBatchStepHook
-	BatchStateUpgrading     = rolloutv1alpha1.BatchStepStateRunning
+	BatchStateRunning       = rolloutv1alpha1.BatchStepStateRunning
 	BatchStatePostBatchHook = rolloutv1alpha1.BatchStepStatePostBatchStepHook
 	BatchStateSucceeded     = rolloutv1alpha1.BatchStepStateSucceeded
 )