-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #32 from iastewar/watch-namespaces
Added goroutine to watch namespaces and add secrets
- Loading branch information
Showing
4 changed files
with
638 additions
and
93 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,21 @@ | ||
| # gcp-auth-webhook | ||
| A mutating webhook that will patch any pods in your kubernetes cluster with GCP credentials (whose location is currently hardcoded to /var/lib/minikube/google_application_credentials.json) | ||
|
|
||
| Use the image gcr.io/k8s-minikube/gcp-auth-webhook as the image for a Deployment in your Kubernetes manifest and add that to a MutatingWebhookConfiguration. | ||
| A server that includes: | ||
| * A mutating webhook that will patch any newly created pods in your Kubernetes cluster with GCP credentials (whose location is currently hardcoded to /var/lib/minikube/google_application_credentials.json). | ||
| * A mutating webhook that will patch any newly created service accounts in your Kubernetes cluster with an image pull secret. | ||
| * A thread that monitors namespaces to make sure all namespaces include a image pull secret to be able to pull from GCR and AR. | ||
|
|
||
| ## Deployment | ||
| Use the image `gcr.io/k8s-minikube/gcp-auth-webhook` as the image for a Deployment in your Kubernetes manifest and add that to a MutatingWebhookConfiguration. See [minikube](https://github.com/kubernetes/minikube/blob/master/deploy/addons/gcp-auth/gcp-auth-webhook.yaml.tmpl) for details. | ||
|
|
||
| ## Running Locally | ||
| The easiest way to run the server locally is: | ||
| * Remove `FROM scratch` in the Dockerfile and replace it with the following to ensure https requests work properly locally: | ||
| ``` | ||
| FROM alpine | ||
| RUN apk --no-cache add ca-certificates | ||
| ``` | ||
| * Modify [minikube's](https://github.com/kubernetes/minikube/blob/master/deploy/addons/gcp-auth/gcp-auth-webhook.yaml.tmpl) gcp-auth Deployment image to be `local/gcp-auth-webhook:$(VERSION)` (replace `$(VERSION)` with your version) | ||
| * Build and run minikube | ||
| * Run `eval $(path_to_minikube/minikube docker-env)` and then `make local-image` to make the image available from within minikube | ||
| * Run `path_to_minikube/minikube addons enable gcp-auth` to enable the addon, which creates a pod in the `gcp-auth` namespace with the gcp-auth-webhook server |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.