Upstream artifact for kata admission controller

Get upstream artifacts of kata admission controller from
https://github.com/kata-containers/tests/tree/master/kata-webhook
Commit: 5ad2cec

Signed-off-by: Saikrishna Edupuganti <saikrishna.edupuganti@intel.com>

clr-k8s-examples/admit-kata/create-certs.sh

@@ -0,0 +1,28 @@
+#! /bin/bash
+# Copyright (c) 2019 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+
+WEBHOOK_NS=${1:-"default"}
+WEBHOOK_NAME=${2:-"pod-annotate"}
+WEBHOOK_SVC="${WEBHOOK_NAME}-webhook"
+
+# Create certs for our webhook
+openssl genrsa -out webhookCA.key 2048
+openssl req -new -key ./webhookCA.key -subj "/CN=${WEBHOOK_SVC}.${WEBHOOK_NS}.svc" -out ./webhookCA.csr 
+openssl x509 -req -days 365 -in webhookCA.csr -signkey webhookCA.key -out webhook.crt
+
+# Create certs secrets for k8s
+kubectl create secret generic \
+    ${WEBHOOK_SVC}-certs \
+    --from-file=key.pem=./webhookCA.key \
+    --from-file=cert.pem=./webhook.crt \
+    --dry-run -o yaml > ./deploy/webhook-certs.yaml
+
+# Set the CABundle on the webhook registration
+CA_BUNDLE=$(cat ./webhook.crt | base64 -w0)
+sed "s/CA_BUNDLE/${CA_BUNDLE}/" ./deploy/webhook-registration.yaml.tpl > ./deploy/webhook-registration.yaml
+
+# Clean
+rm ./webhookCA* && rm ./webhook.crt

clr-k8s-examples/admit-kata/deploy/webhook-registration.yaml.tpl

@@ -0,0 +1,24 @@
+# Copyright (c) 2019 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: pod-annotate-webhook
+  labels:
+    app: pod-annotate-webhook
+    kind: mutator
+webhooks:
+  - name: pod-annotate-webhook.kata.xyz
+    clientConfig:
+      service:
+        name: pod-annotate-webhook
+        namespace: default
+        path: "/mutate"
+      caBundle: CA_BUNDLE
+    rules:
+      - operations: [ "CREATE" ]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods"]

clr-k8s-examples/admit-kata/deploy/webhook.yaml

@@ -1,3 +1,7 @@
+# Copyright (c) 2019 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
@@ -18,6 +22,7 @@ spec:
           args:
             - -tls-cert-file=/etc/webhook/certs/cert.pem
             - -tls-key-file=/etc/webhook/certs/key.pem
+            - -exclude-namespaces=rook-ceph-system,rook-ceph
           volumeMounts:
             - name: webhook-certs
               mountPath: /etc/webhook/certs

clr-k8s-examples/admit-kata/webhook-certs.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-data:
-  cert.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMwakNDQWJvQ0NRQ1IrV2diYXlJeHJ6QU5CZ2txaGtpRzl3MEJBUXNGQURBck1Ta3dKd1lEVlFRRERDQncKYjJRdFlXNXViM1JoZEdVdGQyVmlhRzl2YXk1a1pXWmhkV3gwTG5OMll6QWVGdzB4T0RBM01EZ3hOVFEzTXpGYQpGdzB4T1RBM01EZ3hOVFEzTXpGYU1Dc3hLVEFuQmdOVkJBTU1JSEJ2WkMxaGJtNXZkR0YwWlMxM1pXSm9iMjlyCkxtUmxabUYxYkhRdWMzWmpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdoVVUKUEpudnZjZzRJSG54d2tKMkZiQldzc1ZvQjh1anhLcHh2Vm92dEREV0tOVU5jaHozbUF0cUJvaXAwVUlqclptUgowZ3RvcWFJOFJpeHFjUDlvVXlwMVNSTVQrYTdVeTY4b0s3d1F2Mnl5QjZ4MjExU2lja2hHaW8xTUpQN0xCRXpGClJWOUlvbXJjZkp2bi91STRWTWVmcmNZcGp2WHBOOHRUdTdWQWcvUkw4NldjSXg4VEVlbU5KNkErUWdWN0VCS00KWVBRMDAzRno1R2RHWi85c2hRNUZDSEJ1QVh3aVFzTHp6UCtOUkVGaG1zMmdHVk9xVXlBUEdRZFlZVUZWVHdLSwpsaW9FNW1yV1NFMExmekNLczYxR3BnSnBZY2k3RFV1ZFB6UzhIclRTaTVZdTdNNjZQMFE4cGhmaTdjb3JiRXB0CityL0NlNUdpNFdWVUt3d1JmUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ0lZdHQrUTl1bzNKblEKdzBMRExjbUIwb0xyM1VFaFBOaVk4emNKZHd1eTRSbEg0NXRjYllJcmVhZHZieUlRbjBxUEQzd1ZvTk00R01wRwpXREtrY1VsYnhVMURSbmdyY2FrcytkM2prT2NueEtIRGNIemJ6bkh2SStaTkFpMU8yeERibWN3VlhQTGJxb2FnCmNCalJtV3QzVGFIN2FsS2ZtbkpYbit2NDZEV3IvQm1GZ0pvcld3TjdYM1V5LzFxcitrVVZxc3lGTHBqelRLZXoKVnYweklJZ1hGTmJXbzQ4cFRNenkxTWRjb0RObDVJRlZrczVnQUkzR05nQlJWdFlOYUN1bUpKNGxKM21tUGtTUAp4OW93ZE9qLzVJTFdzdWVkV1UzT2c2UE96TmdPSjRYVXlLS3ZWSG9BdU11MEtvaVk0QUF6VHFXSjNsR1M5L2VwCm1qQW9BTFdSCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  key.pem: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBd2hVVVBKbnZ2Y2c0SUhueHdrSjJGYkJXc3NWb0I4dWp4S3B4dlZvdnRERFdLTlVOCmNoejNtQXRxQm9pcDBVSWpyWm1SMGd0b3FhSThSaXhxY1A5b1V5cDFTUk1UK2E3VXk2OG9LN3dRdjJ5eUI2eDIKMTFTaWNraEdpbzFNSlA3TEJFekZSVjlJb21yY2ZKdm4vdUk0Vk1lZnJjWXBqdlhwTjh0VHU3VkFnL1JMODZXYwpJeDhURWVtTko2QStRZ1Y3RUJLTVlQUTAwM0Z6NUdkR1ovOXNoUTVGQ0hCdUFYd2lRc0x6elArTlJFRmhtczJnCkdWT3FVeUFQR1FkWVlVRlZUd0tLbGlvRTVtcldTRTBMZnpDS3M2MUdwZ0pwWWNpN0RVdWRQelM4SHJUU2k1WXUKN002NlAwUThwaGZpN2NvcmJFcHQrci9DZTVHaTRXVlVLd3dSZlFJREFRQUJBb0lCQUNsY3NxNWpwQ3RQRTE4ZwpmZnlIaTREOXpzeFVzK0lOYlQ2SmtLbnBJWWVHYk8zUTBnZkMwcVdOc1MvcFNqKzFsOEwwbXBZb0prc1lyejNKClUzbjNoTFZNdENnNXI2VWp0R2dnVVRCWTZUelNubkp5Ti9XV0xQU3NJSlNBbm55MzdHNWpLaHVwdmVJWFlod1EKWWZYNUlrWTNNUG1vNU14NTdoVWMrU0JrOVhYcGFIOGZTbTVFeFl1Zkd5WVpsWWh1L1BDdSt2ZWlYRXZHbFRheQpYZmZUUmkvQjFOTlhha3JLTzY1RjBPMks3U1ljNkx3Q3krRVU4UDA0ZXR2NEoxOFdXVHJqZ01Tenh3OUNZb1BLClNsT0xLVE1xeXptQmtETGV1NURNUGh3U1dia0Y5ejArQS94bTNjcVp1cC9yczIxYWxCa29TTTZUNGx0WmR4NUkKc21pR3NPVUNnWUVBNTE1Vy9veXNLYjJpSVZWOFFhb09LWjFsQWlJaDh2d3NsMUFRbzF3QW00VStrRnFqSVlIUgp1UDBmQjFlZW5jSHFkdm1DOEZrNnhhTGZxL2RxNGtHaHF6MDVHdjFoUDVyRXlTVXFxYmFYTGEvVUgzN2doVkJjCmsyclVtTmJYV2l2NWtJVzh4T1hOSklUenIzUUo1Y0VQMjNrVE96UWNwN3AwWHlzU05YU3RSOWNDZ1lFQTFyNk4KRWdWajNlY3hFR2tvVFB2aXc3d2E0Ti83UXFCaytWNTZPQytNamIvNHJiWDBNeEtlQjlPRDc1OXlPYlF4YjhxRgpweFZCdGVSTUN2OWtEcDJmTHBWTlB0YVBvQit3RUNQVm1aa2k5cFpITVUwMGw0QU9uVWM2SVZmZzd0cWllTzYyCnFJb20vWnVINXBlU2t2QjJVbktZTnNZdlA2VnNMaVRITStEUmRzc0NnWUVBamwxb1hqMGsrcElySHlQQXo0N2EKSkJVclFBTE1yUDBxV3ZqekkvSEtsZWVKTmIzdnZ3Qm9rZEYrdEQvZjQrYWNaUlRtMHdtMHRrT2dLZXFXSkI2SwpZaG5MOTZXTm4xdVdWc2E5MTZ2NG5pNGc4amhaNHU0dDZLL0ZuVDRsU09EaU1XRjVaQmFiQWl1azNvTWlTL05kCjFJaE5veEpQeDQxZGFlblF6SCs4MkFVQ2dZRUF2NjRDdWEwNkFSNlYrdklDV1FVVTJtWVREOXFkcWxFRkVGbTIKZW1SbTd6Z0Z2dmlFNnZtWk9aOGhTMGhsYXdCZWlFeWJsQkl6UHlweWZmYU0xMGIyaVZ3WFFSbS94Y3ZER2dVQwpha0g0cFdacVVhVjZaaWlWNHVsckI4d3JLTWphOFZzU2k4b1ZGNVkyYml1cFY2TnYyaFFUcmdDa3VBanVVUm5lCi9YMlZPcFVDZ1lCY2M5R1c5SlhLT242aGNML3lub1NiL3pQYTNrM3lFMlZVNWZiamZpK0JQVWxKRzg5T1JDSU0KSGo1c2lVN2pEeGk2VmM5eGo3dDNNVXh4cXlKYTBWaVd5bGZ6WkVzSVNUQmpub04xbSszM3VqbTV6RSs3NGxQUwpPUm4yNWhrTlIvejY0QWZiZjd6Si9jaEVZSndoQS9zK0NjcVptQ0VWaEc4RjgranRyLzhUQVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: pod-annotate-webhook-certs

clr-k8s-examples/admit-kata/webhook-registration.yaml

@@ -1,20 +0,0 @@
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: MutatingWebhookConfiguration
-metadata:
-  name: pod-annotate-webhook
-  labels:
-    app: pod-annotate-webhook
-    kind: mutator
-webhooks:
-  - name: pod-annotate-webhook.pod.xyz
-    clientConfig:
-      service:
-        name: pod-annotate-webhook
-        namespace: default
-        path: "/mutate"
-      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMwakNDQWJvQ0NRQ1IrV2diYXlJeHJ6QU5CZ2txaGtpRzl3MEJBUXNGQURBck1Ta3dKd1lEVlFRRERDQncKYjJRdFlXNXViM1JoZEdVdGQyVmlhRzl2YXk1a1pXWmhkV3gwTG5OMll6QWVGdzB4T0RBM01EZ3hOVFEzTXpGYQpGdzB4T1RBM01EZ3hOVFEzTXpGYU1Dc3hLVEFuQmdOVkJBTU1JSEJ2WkMxaGJtNXZkR0YwWlMxM1pXSm9iMjlyCkxtUmxabUYxYkhRdWMzWmpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdoVVUKUEpudnZjZzRJSG54d2tKMkZiQldzc1ZvQjh1anhLcHh2Vm92dEREV0tOVU5jaHozbUF0cUJvaXAwVUlqclptUgowZ3RvcWFJOFJpeHFjUDlvVXlwMVNSTVQrYTdVeTY4b0s3d1F2Mnl5QjZ4MjExU2lja2hHaW8xTUpQN0xCRXpGClJWOUlvbXJjZkp2bi91STRWTWVmcmNZcGp2WHBOOHRUdTdWQWcvUkw4NldjSXg4VEVlbU5KNkErUWdWN0VCS00KWVBRMDAzRno1R2RHWi85c2hRNUZDSEJ1QVh3aVFzTHp6UCtOUkVGaG1zMmdHVk9xVXlBUEdRZFlZVUZWVHdLSwpsaW9FNW1yV1NFMExmekNLczYxR3BnSnBZY2k3RFV1ZFB6UzhIclRTaTVZdTdNNjZQMFE4cGhmaTdjb3JiRXB0CityL0NlNUdpNFdWVUt3d1JmUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ0lZdHQrUTl1bzNKblEKdzBMRExjbUIwb0xyM1VFaFBOaVk4emNKZHd1eTRSbEg0NXRjYllJcmVhZHZieUlRbjBxUEQzd1ZvTk00R01wRwpXREtrY1VsYnhVMURSbmdyY2FrcytkM2prT2NueEtIRGNIemJ6bkh2SStaTkFpMU8yeERibWN3VlhQTGJxb2FnCmNCalJtV3QzVGFIN2FsS2ZtbkpYbit2NDZEV3IvQm1GZ0pvcld3TjdYM1V5LzFxcitrVVZxc3lGTHBqelRLZXoKVnYweklJZ1hGTmJXbzQ4cFRNenkxTWRjb0RObDVJRlZrczVnQUkzR05nQlJWdFlOYUN1bUpKNGxKM21tUGtTUAp4OW93ZE9qLzVJTFdzdWVkV1UzT2c2UE96TmdPSjRYVXlLS3ZWSG9BdU11MEtvaVk0QUF6VHFXSjNsR1M5L2VwCm1qQW9BTFdSCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-    rules:
-      - operations: [ "CREATE" ]
-        apiGroups: [""]
-        apiVersions: ["v1"]
-        resources: ["pods"]