Add Validation and Mutating Webhook support

Makefile

@@ -437,3 +437,18 @@ PHONY: crd-schema-check
 crd-schema-check: manifests
 	INSTALL_DIR=$(LOCALBIN) CRD_SCHEMA_CHECKER_VERSION=$(CRD_SCHEMA_CHECKER_VERSION) hack/build-crd-schema-checker.sh
 	INSTALL_DIR=$(LOCALBIN) BASE_REF="$${PULL_BASE_SHA:-$(BRANCH)}" hack/crd-schema-checker.sh
+
+# Used for webhook testing
+# The configure_local_webhook.sh script below will remove any OLM webhooks
+# for the operator and also scale its deployment replicas down to 0 so that
+# the operator can run locally.
+# We will attempt to catch SIGINT/SIGTERM and clean up the local webhooks,
+# but it may be necessary to manually run ./hack/clean_local_webhook.sh
+# before deploying with OLM again for other untrappable signals.
+SKIP_CERT ?=false
+.PHONY: run-with-webhook
+run-with-webhook: export METRICS_PORT?=33080
+run-with-webhook: export HEALTH_PORT?=33081
+run-with-webhook: manifests generate fmt vet ## Run a controller from your host.
+	/bin/bash hack/clean_local_webhook.sh
+	/bin/bash hack/run_with_local_webhook.sh

PROJECT

@@ -20,6 +20,10 @@ resources:
   kind: WatcherAPI
   path: github.com/openstack-k8s-operators/watcher-operator/api/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -29,6 +33,10 @@ resources:
   kind: Watcher
   path: github.com/openstack-k8s-operators/watcher-operator/api/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -38,6 +46,10 @@ resources:
   kind: WatcherDecisionEngine
   path: github.com/openstack-k8s-operators/watcher-operator/api/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
@@ -47,4 +59,8 @@ resources:
   kind: WatcherApplier
   path: github.com/openstack-k8s-operators/watcher-operator/api/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 version: "3"

api/v1beta1/common_webhook.go

@@ -0,0 +1,25 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import ctrl "sigs.k8s.io/controller-runtime"
+
+func (r *Watcher) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}

api/v1beta1/watcher_webhook.go

@@ -0,0 +1,62 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+// log is for logging in this package.
+var watcherlog = logf.Log.WithName("watcher-resource")
+
+//+kubebuilder:webhook:path=/mutate-watcher-openstack-org-v1beta1-watcher,mutating=true,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watchers,verbs=create;update,versions=v1beta1,name=mwatcher.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &Watcher{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *Watcher) Default() {
+	watcherlog.Info("default", "name", r.Name)
+
+}
+
+//+kubebuilder:webhook:path=/validate-watcher-openstack-org-v1beta1-watcher,mutating=false,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watchers,verbs=create;update,versions=v1beta1,name=vwatcher.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &Watcher{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *Watcher) ValidateCreate() (admission.Warnings, error) {
+	watcherlog.Info("validate create", "name", r.Name)
+
+	return nil, nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *Watcher) ValidateUpdate(runtime.Object) (admission.Warnings, error) {
+	watcherlog.Info("validate update", "name", r.Name)
+
+	return nil, nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *Watcher) ValidateDelete() (admission.Warnings, error) {
+	watcherlog.Info("validate delete", "name", r.Name)
+
+	return nil, nil
+}

api/v1beta1/watcherapi_webhook.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+// log is for logging in this package.
+var watcherapilog = logf.Log.WithName("watcherapi-resource")
+
+func (r *WatcherAPI) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+
+//+kubebuilder:webhook:path=/mutate-watcher-openstack-org-v1beta1-watcherapi,mutating=true,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherapis,verbs=create;update,versions=v1beta1,name=mwatcherapi.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &WatcherAPI{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *WatcherAPI) Default() {
+	watcherapilog.Info("default", "name", r.Name)
+
+	// TODO(user): fill in your defaulting logic.
+}
+
+// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-watcher-openstack-org-v1beta1-watcherapi,mutating=false,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherapis,verbs=create;update,versions=v1beta1,name=vwatcherapi.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &WatcherAPI{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherAPI) ValidateCreate() (admission.Warnings, error) {
+	watcherapilog.Info("validate create", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object creation.
+	return nil, nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherAPI) ValidateUpdate(runtime.Object) (admission.Warnings, error) {
+	watcherapilog.Info("validate update", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object update.
+	return nil, nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherAPI) ValidateDelete() (admission.Warnings, error) {
+	watcherapilog.Info("validate delete", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object deletion.
+	return nil, nil
+}

api/v1beta1/watcherapplier_webhook.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+// log is for logging in this package.
+var watcherapplierlog = logf.Log.WithName("watcherapplier-resource")
+
+func (r *WatcherApplier) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+
+//+kubebuilder:webhook:path=/mutate-watcher-openstack-org-v1beta1-watcherapplier,mutating=true,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherappliers,verbs=create;update,versions=v1beta1,name=mwatcherapplier.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &WatcherApplier{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *WatcherApplier) Default() {
+	watcherapplierlog.Info("default", "name", r.Name)
+
+	// TODO(user): fill in your defaulting logic.
+}
+
+// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-watcher-openstack-org-v1beta1-watcherapplier,mutating=false,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherappliers,verbs=create;update,versions=v1beta1,name=vwatcherapplier.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &WatcherApplier{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherApplier) ValidateCreate() (admission.Warnings, error) {
+	watcherapplierlog.Info("validate create", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object creation.
+	return nil, nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherApplier) ValidateUpdate(runtime.Object) (admission.Warnings, error) {
+	watcherapplierlog.Info("validate update", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object update.
+	return nil, nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherApplier) ValidateDelete() (admission.Warnings, error) {
+	watcherapplierlog.Info("validate delete", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object deletion.
+	return nil, nil
+}

api/v1beta1/watcherdecisionengine_webhook.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+// log is for logging in this package.
+var watcherdecisionenginelog = logf.Log.WithName("watcherdecisionengine-resource")
+
+func (r *WatcherDecisionEngine) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewWebhookManagedBy(mgr).
+		For(r).
+		Complete()
+}
+
+// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+
+//+kubebuilder:webhook:path=/mutate-watcher-openstack-org-v1beta1-watcherdecisionengine,mutating=true,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherdecisionengines,verbs=create;update,versions=v1beta1,name=mwatcherdecisionengine.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Defaulter = &WatcherDecisionEngine{}
+
+// Default implements webhook.Defaulter so a webhook will be registered for the type
+func (r *WatcherDecisionEngine) Default() {
+	watcherdecisionenginelog.Info("default", "name", r.Name)
+
+	// TODO(user): fill in your defaulting logic.
+}
+
+// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
+//+kubebuilder:webhook:path=/validate-watcher-openstack-org-v1beta1-watcherdecisionengine,mutating=false,failurePolicy=fail,sideEffects=None,groups=watcher.openstack.org,resources=watcherdecisionengines,verbs=create;update,versions=v1beta1,name=vwatcherdecisionengine.kb.io,admissionReviewVersions=v1
+
+var _ webhook.Validator = &WatcherDecisionEngine{}
+
+// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherDecisionEngine) ValidateCreate() (admission.Warnings, error) {
+	watcherdecisionenginelog.Info("validate create", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object creation.
+	return nil, nil
+}
+
+// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherDecisionEngine) ValidateUpdate(runtime.Object) (admission.Warnings, error) {
+	watcherdecisionenginelog.Info("validate update", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object update.
+	return nil, nil
+}
+
+// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
+func (r *WatcherDecisionEngine) ValidateDelete() (admission.Warnings, error) {
+	watcherdecisionenginelog.Info("validate delete", "name", r.Name)
+
+	// TODO(user): fill in your validation logic upon object deletion.
+	return nil, nil
+}