Skip to content

Commit 807d1a2

Browse files
diversariodiversario
authored
Provide more customization options for the service mutator webhook (#3653)
* Provide more customization options for the service mutator webhook * undo unintended change * undo version changes * use MWH boolean switch, rename MWH config map * typo * update readme
1 parent 102b616 commit 807d1a2

File tree

4 files changed

+57
-6
lines changed

4 files changed

+57
-6
lines changed

‎helm/aws-load-balancer-controller/README.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ AWS Load Balancer controller manages the following AWS resources
2222
As a security best practice, we recommend isolating the controller deployment pods to specific node groups which run critical components. The helm chart provides parameters ```nodeSelector```, ```tolerations``` and ```affinity``` to configure node isolation. For more information, please refer to the guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/multitenancy/#isolating-tenant-workloads-to-specific-nodes).
2323

2424
## Prerequisites
25-
- Supported Kubernetes Versions
25+
- Supported Kubernetes Versions
2626
- Chart version v1.5.0+ requires Kubernetes 1.22+
2727
- Chart version v1.4.0+ requires Kubernetes 1.19+
2828
- Chart version v1.2.0 - v1.3.3 supports Kubernetes 1.16-1.21
@@ -266,7 +266,10 @@ The default values set by the application itself can be confirmed [here](https:/
266266
| `clusterSecretsPermissions.allowAllSecrets` | If `true`, controller has access to all secrets in the cluster. | `false` |
267267
| `controllerConfig.featureGates` | set of `key: value` pairs that describe AWS load balance controller features | `{}` |
268268
| `ingressClassConfig.default` | If `true`, the ingressclass will be the default class of the cluster. | `false` |
269-
| `enableServiceMutatorWebhook` | If `false`, disable the Service Mutator webhook which makes all new services of type LoadBalancer reconciled by the lb controller | `true` |
269+
| `enableServiceMutatorWebhook` | If `false`, disable the Service Mutator webhook which makes all new services of type LoadBalancer reconciled by the lb controller | `true` |
270+
| `serviceMutatorWebhookConfig.failurePolicy` | Failure policy for the Service Mutator webhook | `Fail` |
271+
| `serviceMutatorWebhookConfig.objectSelector` | Object selector(s) to limit which objects will be mutated by the Service Mutator webhook | `[]` |
272+
| `serviceMutatorWebhookConfig.operations` | List of operations that will trigger the the Service Mutator webhook | `[ CREATE ]` |
270273
| `autoscaling` | If `autoscaling.enabled=true`, enable the HPA on the controller mainly to survive load induced failure by the calls to the `aws-load-balancer-webhook-service`. Please keep in mind that the controller pods have `priorityClassName: system-cluster-critical`, enabling HPA may lead to the eviction of other low-priority pods in the node | `false` |
271274
| `serviceTargetENISGTags` | set of `key=value` pairs of AWS tags in addition to cluster name for finding the target ENI security group to which to add inbound rules from NLBs | None |
272275
| `loadBalancerClass` | Sets the AWS load balancer type to be used when the Kubernetes service requests an external load balancer | `service.k8s.aws/nlb` |

‎helm/aws-load-balancer-controller/templates/webhook.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ webhooks:
6565
name: {{ template "aws-load-balancer-controller.webhookService" . }}
6666
namespace: {{ $.Release.Namespace }}
6767
path: /mutate-v1-service
68-
failurePolicy: Fail
68+
failurePolicy: {{ .Values.serviceMutatorWebhookConfig.failurePolicy }}
6969
name: mservice.elbv2.k8s.aws
7070
admissionReviewVersions:
7171
- v1beta1
@@ -75,13 +75,21 @@ webhooks:
7575
operator: NotIn
7676
values:
7777
- {{ include "aws-load-balancer-controller.name" . }}
78+
{{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions }}
79+
{{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions | nindent 4 }}
80+
{{- end }}
81+
82+
{{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels }}
83+
matchLabels:
84+
{{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels | nindent 6 }}
85+
{{- end }}
7886
rules:
7987
- apiGroups:
8088
- ""
8189
apiVersions:
8290
- v1
8391
operations:
84-
- CREATE
92+
{{- toYaml .Values.serviceMutatorWebhookConfig.operations | nindent 4 }}
8593
resources:
8694
- services
8795
sideEffects: None

‎helm/aws-load-balancer-controller/test.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,3 +330,25 @@ clusterSecretsPermissions:
330330
# ingressClassConfig contains configurations specific to the ingress class
331331
ingressClassConfig:
332332
default: false
333+
334+
# enableServiceMutatorWebhook allows you enable the webhook which makes this controller the default for all new services of type LoadBalancer
335+
# should deprecate this in favor of serviceMutatorWebhook.enabled
336+
enableServiceMutatorWebhook: true
337+
338+
# serviceMutatorWebhook contains configurations specific to the service mutator webhook
339+
serviceMutatorWebhookConfig:
340+
# whether or not to fail the service creation if the webhook fails
341+
failurePolicy: Fail
342+
# limit webhook to only mutate services matching the objectSelector
343+
objectSelector:
344+
matchExpressions: []
345+
# - key: <key>
346+
# operator: <operator>
347+
# values:
348+
# - <value>
349+
matchLabels: {}
350+
# key: value
351+
# which operations trigger the webhook
352+
operations:
353+
- CREATE
354+
# - UPDATE

‎helm/aws-load-balancer-controller/values.yaml

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ webhookTLS:
209209
cert:
210210
key:
211211

212-
# array of namespace selectors for the webhook
212+
# array of namespace selectors for the pod mutator webhook
213213
webhookNamespaceSelectors:
214214
# - key: elbv2.k8s.aws/pod-readiness-gate-inject
215215
# operator: In
@@ -350,7 +350,7 @@ controllerConfig:
350350
# NLBHealthCheckAdvancedConfig: true
351351
# ALBSingleSubnet: false
352352

353-
certDiscovery:
353+
certDiscovery:
354354
allowedCertificateAuthorityARNs: "" # empty means all CAs are in scope
355355

356356
# objectSelector for webhook
@@ -389,6 +389,24 @@ ingressClassConfig:
389389
# enableServiceMutatorWebhook allows you enable the webhook which makes this controller the default for all new services of type LoadBalancer
390390
enableServiceMutatorWebhook: true
391391

392+
# serviceMutatorWebhook contains configurations specific to the service mutator webhook
393+
serviceMutatorWebhookConfig:
394+
# whether or not to fail the service creation if the webhook fails
395+
failurePolicy: Fail
396+
# limit webhook to only mutate services matching the objectSelector
397+
objectSelector:
398+
matchExpressions: []
399+
# - key: <key>
400+
# operator: <operator>
401+
# values:
402+
# - <value>
403+
matchLabels: {}
404+
# key: value
405+
# which operations trigger the webhook
406+
operations:
407+
- CREATE
408+
# - UPDATE
409+
392410
# serviceTargetENISGTags specifies AWS tags, in addition to the cluster tags, for finding the target ENI SG to which to add inbound rules from NLBs.
393411
serviceTargetENISGTags:
394412

0 commit comments

Comments
 (0)