Allow configuration of an external webhook and its associated certs in the Porch API server

[Catalin-Stratulat-Ericsson]

This change is related to nephio-project/nephio#554 and previous PR nephio-project/porch#53

This PR implements an optional porch package which can be used to allow web-hooks to be externally defined in yaml files, have cert manager automatically create and update the certificates which these web-hooks will utilize.

This optional package Requires cert manager to be installed in the system and as such to not make porch dependent on cert manager has been made optional.

Note: The version used for the porch-server image is set to v3.0.0 which does not exist yet as it requires the code written in the previously mentioned porch PR to function and as such v2.0.0 would not work.

[Catalin-Stratulat-Ericsson]

Note: the only changes in this package compared to the default porch package are found in issuer-cert, validating-webhook and porch-server yaml files. all other files have stayed the same

[liamfallon]

To aid reviewers:

% diff -qr nephio/core/porch  nephio/optional/porch-cert-manager-webhook
Only in nephio/optional/porch-cert-manager-webhook: 2-2-issuer-cert.yaml
Only in nephio/optional/porch-cert-manager-webhook: 2-3-validating-webhook.yaml
Files nephio/core/porch/3-porch-server.yaml and nephio/optional/porch-cert-manager-webhook/3-porch-server.yaml differ
Files nephio/core/porch/9-porch-controller-packagevariants-clusterrole.yaml and nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariants-clusterrole.yaml differ
Files nephio/core/porch/9-porch-controller-packagevariantsets-clusterrole.yaml and nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariantsets-clusterrole.yaml differ

% diff -w nephio/core/porch/3-porch-server.yaml nephio/optional/porch-cert-manager-webhook/3-porch-server.yaml

40c40,41
<           emptyDir: {}
---
>           secret:
>             secretName: porch-system-server-tls
46c47
<           image: docker.io/nephio/porch-server:v2.0.0
---
>           image: docker.io/nephio/porch-server:v3.0.0
68a70,71
>             - name: USE_CERT_MAN_FOR_WEBHOOK
>               value: "true"

% diff -w nephio/core/porch/9-porch-controller-packagevariants-clusterrole.yaml nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariants-clusterrole.yaml

34,41d33
<   - config.porch.kpt.dev
<   resources:
<   - repositories
<   verbs:
<   - get
<   - list
<   - watch
< - apiGroups:

%  diff -w nephio/core/porch/9-porch-controller-packagevariantsets-clusterrole.yaml nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariantsets-clusterrole.yaml

51,58d50
< - apiGroups:
<   - config.porch.kpt.dev
<   resources:
<   - repositories
<   verbs:
<   - get
<   - list
<   - watch

[liamfallon]

/approve

[Catalin-Stratulat-Ericsson]

To aid reviewers:

% diff -qr nephio/core/porch  nephio/optional/porch-cert-manager-webhook
Only in nephio/optional/porch-cert-manager-webhook: 2-2-issuer-cert.yaml
Only in nephio/optional/porch-cert-manager-webhook: 2-3-validating-webhook.yaml
Files nephio/core/porch/3-porch-server.yaml and nephio/optional/porch-cert-manager-webhook/3-porch-server.yaml differ
Files nephio/core/porch/9-porch-controller-packagevariants-clusterrole.yaml and nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariants-clusterrole.yaml differ
Files nephio/core/porch/9-porch-controller-packagevariantsets-clusterrole.yaml and nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariantsets-clusterrole.yaml differ

% diff -w nephio/core/porch/3-porch-server.yaml nephio/optional/porch-cert-manager-webhook/3-porch-server.yaml

40c40,41
<           emptyDir: {}
---
>           secret:
>             secretName: porch-system-server-tls
46c47
<           image: docker.io/nephio/porch-server:v2.0.0
---
>           image: docker.io/nephio/porch-server:v3.0.0
68a70,71
>             - name: USE_CERT_MAN_FOR_WEBHOOK
>               value: "true"

% diff -w nephio/core/porch/9-porch-controller-packagevariants-clusterrole.yaml nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariants-clusterrole.yaml

34,41d33
<   - config.porch.kpt.dev
<   resources:
<   - repositories
<   verbs:
<   - get
<   - list
<   - watch
< - apiGroups:

%  diff -w nephio/core/porch/9-porch-controller-packagevariantsets-clusterrole.yaml nephio/optional/porch-cert-manager-webhook/9-porch-controller-packagevariantsets-clusterrole.yaml

51,58d50
< - apiGroups:
<   - config.porch.kpt.dev
<   resources:
<   - repositories
<   verbs:
<   - get
<   - list
<   - watch

thanks for the diff for clarity. there should be no changes made to the cluster-roles for pkg variants and pkg variant sets it must have been due to myself making this copy of the nephio/core/porch pkg to use as a baseline for the nephio/optional/porch-cert-manager-webhook pkg before PR#37 was pulled in. this has been addressed in latest update.

Here is the redone git diff after the changes

diff -w nephio/core/porch  nephio/optional/porch-cert-manager-webhook/
Only in nephio/optional/porch-cert-manager-webhook/: 2-2-issuer-cert.yaml
Only in nephio/optional/porch-cert-manager-webhook/: 2-3-validating-webhook.yaml
diff -w nephio/core/porch/3-porch-server.yaml nephio/optional/porch-cert-manager-webhook/3-porch-server.yaml
40c40,41
<           emptyDir: {}
---
>           secret:
>             secretName: porch-system-server-tls
46c47
<           image: docker.io/nephio/porch-server:v2.0.0
---
>           image: docker.io/nephio/porch-server:v3.0.0
68a70,71
>             - name: USE_CERT_MAN_FOR_WEBHOOK
>               value: "true"

[liamfallon]

Thanks @Catalin-Stratulat-Ericsson
/approve

[kushnaidu]

/approve

[liamfallon]

/approve
/lgtm

[nephio-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Catalin-Stratulat-Ericsson, kushnaidu, liamfallon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [liamfallon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment