Skip to content

Commit 94a1e1d

Browse files
samuel-form3samuel-form3
committed
feat: Split State server with Webhook
In some deployment models, we might need to deploy the webhook in the host network. E.g. EKS with tunneling networking where the Control Plane cannot communicate with pods through the pod network. To facilitate this behavior we'd want to deploy only the webhook in the host network and keep the state grpc server running on the Pod network. This changeset aims to separate those two components into two different deployables, the state and webhook deployments. We're changing the chart to accomodate these changes. Signed-off-by: Samuel Torres <[email protected]>
1 parent a48c1a1 commit 94a1e1d

26 files changed

+864
-421
lines changed

‎.github/workflows/release.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ jobs:
2626
env:
2727
REGISTRY: ghcr.io
2828
IMAGE_NAME: ${{ github.repository }}
29+
WEBHOOK_IMAGE_NAME: ${{ github.repository }}-webhook
2930
steps:
3031
- name: Checkout Code
3132
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -51,20 +52,40 @@ jobs:
5152
id: build-push
5253
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 #v6.10.0
5354
with:
55+
file: "{context}/Dockerfile"
5456
provenance: true
5557
sbom: true
5658
push: true
5759
platforms: linux/amd64,linux/arm64
5860
labels: ${{ steps.meta.outputs.labels }}
5961
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.version }}
6062
outputs: "type=registry,push=true"
63+
- name: Build and push webhook
64+
id: build-push
65+
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 #v6.10.0
66+
with:
67+
file: "{context}/Dockerfile.webhook"
68+
provenance: true
69+
sbom: true
70+
push: true
71+
platforms: linux/amd64,linux/arm64
72+
labels: ${{ steps.meta.outputs.labels }}
73+
tags: ${{ env.REGISTRY }}/${{ env.WEBHOOK_IMAGE_NAME }}:${{ github.event.inputs.version }}
74+
outputs: "type=registry,push=true"
6175
- name: Attest
6276
uses: actions/attest-build-provenance@c4fbc648846ca6f503a13a2281a5e7b98aa57202 # v2.0.1
6377
id: attest
6478
with:
6579
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
6680
subject-digest: ${{ steps.build-push.outputs.digest }}
6781
push-to-registry: true
82+
- name: Attest Webhook
83+
uses: actions/attest-build-provenance@c4fbc648846ca6f503a13a2281a5e7b98aa57202 # v2.0.1
84+
id: attest
85+
with:
86+
subject-name: ${{ env.REGISTRY }}/${{ env.WEBHOOK_IMAGE_NAME }}
87+
subject-digest: ${{ steps.build-push.outputs.digest }}
88+
push-to-registry: true
6889

6990
publish-chart:
7091
needs: publish

‎Dockerfile

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23.3-alpine3.20 AS builder
1+
FROM golang:1.23 AS builder
22

33
ARG TARGETOS
44
ARG TARGETARCH
@@ -11,11 +11,11 @@ COPY vendor/ vendor/
1111
RUN go mod verify
1212

1313
COPY api/ api/
14-
COPY cmd/controller cmd/controller
14+
COPY cmd/state cmd/state
1515
COPY internal/ internal/
1616
COPY pkg/ pkg/
1717

18-
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o x-pdb cmd/controller/main.go
18+
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o x-pdb cmd/state/main.go
1919

2020
FROM gcr.io/distroless/static:nonroot
2121
WORKDIR /

‎Dockerfile.webhook

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM golang:1.23 AS builder
2+
3+
ARG TARGETOS
4+
ARG TARGETARCH
5+
6+
WORKDIR /workspace
7+
8+
COPY go.mod go.mod
9+
COPY go.sum go.sum
10+
COPY vendor/ vendor/
11+
RUN go mod verify
12+
13+
COPY api/ api/
14+
COPY cmd/webhook cmd/webhook
15+
COPY internal/ internal/
16+
COPY pkg/ pkg/
17+
18+
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o x-pdb cmd/webhook/main.go
19+
20+
FROM gcr.io/distroless/static:nonroot
21+
WORKDIR /
22+
COPY --from=builder /workspace/x-pdb .
23+
USER 65532:65532
24+
ENTRYPOINT ["/x-pdb"]

‎Makefile

+13-3
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@
44

55
# Image names
66
IMG ?= ghcr.io/form3tech-oss/x-pdb:latest
7+
WEBHOOK_IMG ?= ghcr.io/form3tech-oss/x-pdb-webhook:latest
78
TEST_APP_IMG ?= x-pdb-test:latest
89
TEST_DISRUPTION_PROBE_IMG ?= x-pdb-test-disruption-probe:latest
910

1011
# Docker file paths
1112
DOCKERFILE_PATH ?= Dockerfile
13+
WEBHOOK_DOCKERFILE_PATH ?= Dockerfile.webhook
1214
TEST_APP_DOCKERFILE_PATH ?= Dockerfile.testapp
1315
TEST_DISRUPTION_PROBE_DOCKERFILE_PATH ?= Dockerfile.testdisruptionprobe
1416

@@ -107,7 +109,7 @@ test-disruption-probe-load-image: ## Loads Test disruption probe docker image in
107109
kind load docker-image $(TEST_DISRUPTION_PROBE_IMG) --name $(KIND_CLUSTER_NAME)
108110

109111
.PHONY: deploy-e2e
110-
deploy-e2e: test-app-docker-build test-disruption-probe-docker-build docker-build ## Deploys x-pdb and loads test images into all the testing KinD clusters.
112+
deploy-e2e: test-app-docker-build test-disruption-probe-docker-build webhook-docker-build docker-build ## Deploys x-pdb and loads test images into all the testing KinD clusters.
111113
@echo "building and deploying x-pdb and e2e test apps"
112114
for number in 1 2 3; do \
113115
$(MAKE) install CLUSTER=$$number; \
@@ -148,6 +150,10 @@ run: manifests generate fmt vet ## Run a controller from your host.
148150
docker-build: ## Build docker image with the manager.
149151
$(CONTAINER_TOOL) build -f $(DOCKERFILE_PATH) -t $(IMG) .
150152

153+
.PHONY: webhook-docker-build
154+
webhook-docker-build: ## Generates Test disruption probe docker image.
155+
$(MAKE) docker-build IMG=$(WEBHOOK_IMG) DOCKERFILE_PATH=$(WEBHOOK_DOCKERFILE_PATH)
156+
151157
.PHONY: docker-push
152158
docker-push: ## Push docker image with the manager.
153159
$(CONTAINER_TOOL) push ${IMG}
@@ -186,7 +192,7 @@ destroy-multi-cluster: ## Destroys all the testing KinD clusters.
186192
kind get clusters | grep x-pdb | xargs -I {} kind delete cluster -n {}
187193

188194
.PHONY: deploy
189-
deploy: docker-build ## Deploys x-pdb on all testing KinD clusters.
195+
deploy: docker-build webhook-docker-build ## Deploys x-pdb on all testing KinD clusters.
190196
@echo "building and deploying x-pdb"
191197
for number in 1 2 3; do \
192198
$(MAKE) install CLUSTER=$$number; \
@@ -212,12 +218,16 @@ install-cert-manager: ## Installs cert-manager and a cluster issuer in a KinD cl
212218
kind-load: ## Loads an image into a KinD cluster.
213219
kind load docker-image ${IMG} --name $(KIND_CLUSTER_NAME)
214220

221+
.PHONY: kind-load-webhook
222+
kind-load-webhook: ## Loads Test App docker image into a KinD cluster.
223+
kind load docker-image $(WEBHOOK_IMG) --name $(KIND_CLUSTER_NAME)
224+
215225
.PHONY: gen-certs
216226
gen-certs: ## Generates all the TLS certificates for x-pdb
217227
./hack/gen-certs.sh
218228

219229
.PHONY: install
220-
install: kind-load ## Installs x-pdb into a cluster
230+
install: kind-load kind-load-webhook ## Installs x-pdb into a cluster
221231
./hack/install-xpdb.sh $(CONTEXT) $(CLUSTER)
222232

223233
##@ Proto

‎charts/x-pdb/templates/_helpers.tpl

+30-7
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,12 @@ Create chart name and version as used by the chart label.
4343
{{- end }}
4444

4545
{{/*
46-
Common labels
46+
State labels
4747
*/}}
48-
{{- define "x-pdb.labels" -}}
48+
{{- define "x-pdb.stateLabels" -}}
4949
helm.sh/chart: {{ include "x-pdb.chart" . }}
50-
{{ include "x-pdb.selectorLabels" . -}}
51-
{{ with .Values.extraLabels }}
50+
{{ include "x-pdb.stateSelectorLabels" . -}}
51+
{{ with .Values.state.extraLabels }}
5252
{{- toYaml . }}
5353
{{- end }}
5454
{{- if .Chart.AppVersion }}
@@ -58,10 +58,33 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
5858
{{- end }}
5959

6060
{{/*
61-
Selector labels
61+
State Selector labels
6262
*/}}
63-
{{- define "x-pdb.selectorLabels" -}}
64-
app.kubernetes.io/name: {{ include "x-pdb.name" . }}
63+
{{- define "x-pdb.stateSelectorLabels" -}}
64+
app.kubernetes.io/name: {{ include "x-pdb.name" . }}-state
65+
app.kubernetes.io/instance: {{ .Release.Name }}
66+
{{- end }}
67+
68+
{{/*
69+
Webhook labels
70+
*/}}
71+
{{- define "x-pdb.webhookLabels" -}}
72+
helm.sh/chart: {{ include "x-pdb.chart" . }}
73+
{{ include "x-pdb.webhookSelectorLabels" . -}}
74+
{{ with .Values.webhook.extraLabels }}
75+
{{- toYaml . }}
76+
{{- end }}
77+
{{- if .Chart.AppVersion }}
78+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
79+
{{- end }}
80+
app.kubernetes.io/managed-by: {{ .Release.Service }}
81+
{{- end }}
82+
83+
{{/*
84+
Webhook Selector labels
85+
*/}}
86+
{{- define "x-pdb.webhookSelectorLabels" -}}
87+
app.kubernetes.io/name: {{ include "x-pdb.name" . }}-webhook
6588
app.kubernetes.io/instance: {{ .Release.Name }}
6689
{{- end }}
6790

‎charts/x-pdb/templates/certificates.yaml

+17-17
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,55 @@
1-
{{- if .Values.webhook.tls.certManager.enabled }}
1+
{{- if .Values.certificates.webhook.certManager.enabled }}
22
---
33
apiVersion: cert-manager.io/v1
44
kind: Certificate
55
metadata:
66
name: {{ include "x-pdb.fullname" . }}-webhook-cert
77
namespace: {{ include "x-pdb.namespace" . }}
88
labels:
9-
{{- include "x-pdb.labels" . | nindent 4 }}
9+
{{- include "x-pdb.webhookLabels" . | nindent 4 }}
1010
spec:
11-
{{- if .Values.webhook.tls.certManager.injectFromSecret }}
11+
{{- if .Values.certificates.webhook.certManager.injectFromSecret }}
1212
secretTemplate:
1313
annotations:
1414
cert-manager.io/allow-direct-injection: "true"
1515
{{- end }}
1616
dnsNames:
17-
- {{ include "x-pdb.fullname" . }}.{{ .Release.Namespace }}.svc
18-
- {{ include "x-pdb.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
17+
- {{ include "x-pdb.fullname" . }}-webhook.{{ .Release.Namespace }}.svc
18+
- {{ include "x-pdb.fullname" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local
1919
issuerRef:
20-
{{- toYaml .Values.webhook.tls.certManager.issuerRef | nindent 4 }}
20+
{{- toYaml .Values.certificates.webhook.certManager.issuerRef | nindent 4 }}
2121
secretName: {{ include "x-pdb.fullname" . }}-webhook-cert
22-
renewBefore: {{ .Values.webhook.tls.certManager.renewBefore }}
23-
duration: {{ .Values.webhook.tls.certManager.duration }}
22+
renewBefore: {{ .Values.certificates.webhook.certManager.renewBefore }}
23+
duration: {{ .Values.certificates.webhook.certManager.duration }}
2424
privateKey:
2525
algorithm: RSA
2626
encoding: PKCS1
2727
size: 2048
2828
{{- end }}
2929

30-
{{- if .Values.controller.tls.certManager.enabled }}
30+
{{- if .Values.certificates.state.certManager.enabled }}
3131
---
3232
apiVersion: cert-manager.io/v1
3333
kind: Certificate
3434
metadata:
35-
name: {{ include "x-pdb.fullname" . }}-controller-cert
35+
name: {{ include "x-pdb.fullname" . }}-state-cert
3636
namespace: {{ include "x-pdb.namespace" . }}
3737
labels:
38-
{{- include "x-pdb.labels" . | nindent 4 }}
38+
{{- include "x-pdb.stateLabels" . | nindent 4 }}
3939
spec:
4040
dnsNames:
41-
{{- toYaml .Values.controller.tls.certManager.dnsNames | nindent 4 }}
41+
{{- toYaml .Values.certificates.state.certManager.dnsNames | nindent 4 }}
4242
ipAddresses:
43-
{{- toYaml .Values.controller.tls.certManager.ipAddresses | nindent 4 }}
43+
{{- toYaml .Values.certificates.state.certManager.ipAddresses | nindent 4 }}
4444
issuerRef:
45-
{{- toYaml .Values.webhook.tls.certManager.issuerRef | nindent 4 }}
46-
secretName: {{ include "x-pdb.fullname" . }}-controller-cert
45+
{{- toYaml .Values.certificates.state.certManager.issuerRef | nindent 4 }}
46+
secretName: {{ include "x-pdb.fullname" . }}-state-cert
4747
privateKey:
4848
algorithm: RSA
4949
encoding: PKCS1
5050
size: 2048
51-
renewBefore: {{ .Values.webhook.tls.certManager.renewBefore }}
52-
duration: {{ .Values.webhook.tls.certManager.duration }}
51+
renewBefore: {{ .Values.certificates.state.certManager.renewBefore }}
52+
duration: {{ .Values.certificates.state.certManager.duration }}
5353
usages:
5454
- digital signature
5555
- key encipherment

0 commit comments

Comments
 (0)