BREAKING CHANGE: Complete refactor to use controller-runtime

.run/go build kubernetes-sidecar-injector.run.xml

@@ -2,7 +2,7 @@
   <configuration default="false" name="go build kubernetes-sidecar-injector" type="GoApplicationRunConfiguration" factoryName="Go Application">
     <module name="kubernetes-sidecar-injector" />
     <working_directory value="$PROJECT_DIR$" />
-    <parameters value="--port=8080 --local=true" />
+    <parameters value="--port=8080 --local=true --debug=true --certDir=./sample/certs" />
     <kind value="PACKAGE" />
     <package value="github.com/expediagroup/kubernetes-sidecar-injector" />
     <directory value="$PROJECT_DIR$" />

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21 as build
+FROM golang:1.22 as build
 RUN go install golang.org/x/lint/golint@latest
 WORKDIR /build
 COPY . ./

Makefile

@@ -2,7 +2,7 @@ SHELL := /bin/bash
 CONTAINER_NAME=expediagroup/kubernetes-sidecar-injector
 IMAGE_TAG?=$(shell git rev-parse HEAD)
 KIND_REPO?="kindest/node"
-KUBE_VERSION = v1.21.12
+KUBE_VERSION = v1.25.16
 KIND_CLUSTER?=cluster1
 
 SRC=$(shell find . -type f -name '*.go' -not -path "./vendor/*")

charts/kubernetes-sidecar-injector/templates/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "common.labels" . | indent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "common.labels" . | indent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "common.labels" . | indent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "serviceaccount.name" . }}
+      containers:
+        - name: kubernetes-sidecar-injector
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - --port={{ .Values.container.port }}
+            - --metricsPort={{ .Values.container.metricsPort }}
+            - --certDir=/opt/kubernetes-sidecar-injector/certs/
+            - --injectPrefix={{ trimSuffix "/" .Values.selectors.injectPrefix }}
+            - --injectName={{ .Values.selectors.injectName }}
+            - --sidecarDataKey={{ .Values.sidecars.dataKey }}
+          volumeMounts:
+            - name: {{ .Release.Name }}-certs
+              mountPath: /opt/kubernetes-sidecar-injector/certs
+              readOnly: true
+          ports:
+            - name: https
+              containerPort: {{ .Values.container.port }}
+              protocol: TCP
+            {{- if ne .Values.container.port .Values.container.metricsPort }}
+            - name: metrics
+              containerPort: {{ .Values.container.metricsPort }}
+              protocol: TCP
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 5
+            timeoutSeconds: 4
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 5
+            timeoutSeconds: 4
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      imagePullSecrets:
+        {{- toYaml .Values.image.pullSecrets | nindent 8 }}
+      volumes:
+        - name: {{ .Release.Name }}-certs
+          secret:
+            secretName: {{ include "certs.secret.name" . }}

charts/kubernetes-sidecar-injector/templates/mutatingwebhook.yaml

@@ -12,8 +12,8 @@ metadata:
   labels:
     {{- include "common.labels" . | indent 4 }}
 data:
-  cert.pem: {{ b64enc $cert.Cert }}
-  key.pem: {{ b64enc $cert.Key }}
+  tls.crt: {{ b64enc $cert.Cert }}
+  tls.key: {{ b64enc $cert.Key }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
@@ -27,7 +27,7 @@ webhooks:
       service:
         name: {{ .Release.Name }}
         namespace: {{ .Release.Namespace }}
-        path: "/mutate"
+        path: "/mutate-v1-pod"
       caBundle: {{ b64enc $ca.Cert }}
     failurePolicy: Fail
     sideEffects: None
@@ -69,86 +69,4 @@ webhooks:
         - key: {{ .Values.selectors.injectPrefix }}/{{ .Values.selectors.disableInjectLabel }}
           operator: NotIn
           values:
-            - "true"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "common.labels" . | indent 4 }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "common.labels" . | indent 6 }}
-  template:
-    metadata:
-      annotations:
-        generated-cert: {{ sha256sum $cert.Cert }}
-        {{- with .Values.podAnnotations }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-      labels:
-        {{- include "common.labels" . | indent 8 }}
-        {{- with .Values.podLabels }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-    spec:
-      serviceAccountName: {{ include "serviceaccount.name" . }}
-      containers:
-        - name: kubernetes-sidecar-injector
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          args:
-            - --port={{ .Values.container.port }}
-            - --metricsPort={{ .Values.container.metricsPort }}
-            - --certFile=/opt/kubernetes-sidecar-injector/certs/cert.pem
-            - --keyFile=/opt/kubernetes-sidecar-injector/certs/key.pem
-            - --injectPrefix={{ trimSuffix "/" .Values.selectors.injectPrefix }}
-            - --injectName={{ .Values.selectors.injectName }}
-            - --sidecarDataKey={{ .Values.sidecars.dataKey }}
-          volumeMounts:
-            - name: {{ .Release.Name }}-certs
-              mountPath: /opt/kubernetes-sidecar-injector/certs
-              readOnly: true
-          ports:
-            - name: https
-              containerPort: {{ .Values.container.port }}
-              protocol: TCP
-            {{- if ne .Values.container.port .Values.container.metricsPort }}
-            - name: metrics
-              containerPort: {{ .Values.container.metricsPort }}
-              protocol: TCP
-            {{- end }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: https
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            failureThreshold: 5
-            timeoutSeconds: 4
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: https
-              scheme: HTTPS
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            failureThreshold: 5
-            timeoutSeconds: 4
-      {{- with .Values.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      imagePullSecrets:
-        {{- toYaml .Values.image.pullSecrets | nindent 8 }}
-      volumes:
-        - name: {{ .Release.Name }}-certs
-          secret:
-            secretName: {{ include "certs.secret.name" . }}
+            - "true"

cmd/root.go

@@ -1,16 +1,16 @@
 package cmd
 
 import (
+	"github.com/expediagroup/kubernetes-sidecar-injector/pkg"
 	"os"
 
-	"github.com/expediagroup/kubernetes-sidecar-injector/pkg/httpd"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
 
 var (
-	httpdConf httpd.SimpleServer
-	debug     bool
+	server pkg.SimpleServer
+	debug  bool
 )
 
 var rootCmd = &cobra.Command{
@@ -20,8 +20,8 @@ var rootCmd = &cobra.Command{
 		if debug {
 			log.SetLevel(log.DebugLevel)
 		}
-		log.Infof("SimpleServer starting to listen in port %v", httpdConf.Port)
-		return httpdConf.Start()
+		log.Infof("SimpleServer starting to listen in port %v", server.Port)
+		return server.Start()
 	},
 }
 
@@ -34,13 +34,16 @@ func Execute() {
 }
 
 func init() {
-	rootCmd.Flags().IntVar(&httpdConf.Port, "port", 443, "server port.")
-	rootCmd.Flags().IntVar(&httpdConf.MetricsPort, "metricsPort", 9090, "metrics server port.")
-	rootCmd.Flags().StringVar(&httpdConf.CertFile, "certFile", "/etc/mutator/certs/cert.pem", "File containing tls certificate")
-	rootCmd.Flags().StringVar(&httpdConf.KeyFile, "keyFile", "/etc/mutator/certs/key.pem", "File containing tls private key")
-	rootCmd.Flags().BoolVar(&httpdConf.Local, "local", false, "Local run mode")
-	rootCmd.Flags().StringVar(&(&httpdConf.Patcher).InjectPrefix, "injectPrefix", "sidecar-injector.expedia.com", "Injector Prefix")
-	rootCmd.Flags().StringVar(&(&httpdConf.Patcher).InjectName, "injectName", "inject", "Injector Name")
-	rootCmd.Flags().StringVar(&(&httpdConf.Patcher).SidecarDataKey, "sidecarDataKey", "sidecars.yaml", "ConfigMap Sidecar Data Key")
+	rootCmd.Flags().IntVar(&server.Port, "port", 443, "server port.")
+	rootCmd.Flags().IntVar(&server.MetricsPort, "metricsPort", 9090, "metrics server port.")
+	rootCmd.Flags().StringVar(&server.CertDir, "certDir", "/etc/mutator/certs/", "The directory that contains the server key and certificate")
+	rootCmd.Flags().StringVar(&server.CertName, "certName", "tls.crt", "The server certificate name")
+	rootCmd.Flags().StringVar(&server.KeyName, "keyName", "tls.key", "The server key name")
+	rootCmd.Flags().BoolVar(&server.Local, "local", false, "Local run mode")
+	rootCmd.Flags().StringVar(&(&server.SidecarInjector).InjectPrefix, "injectPrefix", "sidecar-injector.expedia.com", "Injector Prefix")
+	rootCmd.Flags().StringVar(&(&server.SidecarInjector).InjectName, "injectName", "inject", "Injector Name")
+	rootCmd.Flags().StringVar(&(&server.SidecarInjector).SidecarDataKey, "sidecarDataKey", "sidecars.yaml", "ConfigMap Sidecar Data Key")
+	rootCmd.Flags().BoolVar(&(&server.SidecarInjector).AllowAnnotationOverrides, "allowAnnotationOverrides", false, "Allow Annotation Overrides")
+	rootCmd.Flags().BoolVar(&(&server.SidecarInjector).AllowLabelOverrides, "allowLabelOverrides", false, "Allow Label Overrides")
 	rootCmd.Flags().BoolVar(&debug, "debug", false, "enable debug logs")
 }

go.mod

@@ -1,58 +1,69 @@
 module github.com/expediagroup/kubernetes-sidecar-injector
 
 // Make sure you change the Dockerfile
-go 1.21
+go 1.22
 
 require (
 	github.com/ghodss/yaml v1.0.0
-	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.19.1
 	github.com/samber/lo v1.11.0
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.4.0
 	github.com/stretchr/testify v1.7.0
 	k8s.io/api v0.23.5
 	k8s.io/apimachinery v0.23.5
 	k8s.io/client-go v0.23.5
+	sigs.k8s.io/controller-runtime v0.11.0
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/go-logr/logr v1.2.0 // indirect
+	github.com/go-logr/zapr v1.2.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/uuid v1.1.2 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
-	github.com/imdario/mergo v0.3.5 // indirect
+	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
 	github.com/prometheus/common v0.48.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	go.uber.org/atomic v1.7.0 // indirect
+	go.uber.org/multierr v1.6.0 // indirect
+	go.uber.org/zap v1.19.1 // indirect
 	golang.org/x/exp v0.0.0-20220303212507-bbda1eaf7a17 // indirect
 	golang.org/x/net v0.20.0 // indirect
 	golang.org/x/oauth2 v0.16.0 // indirect
 	golang.org/x/sys v0.17.0 // indirect
 	golang.org/x/term v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
+	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	k8s.io/apiextensions-apiserver v0.23.0 // indirect
+	k8s.io/component-base v0.23.0 // indirect
 	k8s.io/klog/v2 v2.30.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
 	k8s.io/utils v0.0.0-20211116205334-6203023598ed // indirect
 	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )