append webhook authz mode only to avoid duplication with defaults

api-server sets Node and RBAC as default authz modes in its command args. And does not allow the mode specified more than once.
vexxhost · Aug 5, 2024 · 09d69dc · 09d69dc
1 parent 57f5254
commit 09d69dc
Show file tree

Hide file tree

Showing 4 changed files with 82 additions and 79 deletions.
diff --git a/magnum_cluster_api/resources.py b/magnum_cluster_api/resources.py
@@ -2010,20 +2010,23 @@ def get_object(self) -> objects.ClusterClass:
                                                 "content": textwrap.dedent(
                                                     """\
                                                     resources:
-                                                    - kube-apiserver.yaml
+                                                      - kube-apiserver.yaml
                                                     patches:
-                                                    - patch: |-
-                                                      - op: add
-                                                        path: /spec/containers/0/command/-
-                                                        value: --authentication-token-webhook-config-file=/etc/kubernetes/webhooks/webhookconfig.yaml # noqa: E501
-                                                      - op: add
-                                                        path: /spec/containers/0/command/-
-                                                        value: --authorization-webhook-config-file=/etc/kubernetes/webhooks/webhookconfig.yaml # noqa: E501
-                                                      - op: add
-                                                        path: /spec/containers/0/command/-
-                                                        value: --authorization-mode=Node,RBAC,Webhook
-                                                      target:
-                                                        kind: Pod
+                                                      - target:
+                                                          group: ""
+                                                          version: v1
+                                                          kind: Pod
+                                                          name: kube-apiserver
+                                                        patch: |-
+                                                          - op: add
+                                                            path: /spec/containers/0/command/-
+                                                            value: --authentication-token-webhook-config-file=/etc/kubernetes/webhooks/webhookconfig.yaml # noqa: E501
+                                                          - op: add
+                                                            path: /spec/containers/0/command/-
+                                                            value: --authorization-webhook-config-file=/etc/kubernetes/webhooks/webhookconfig.yaml # noqa: E501 
+                                                          - op: add
+                                                            path: /spec/containers/0/command/-
+                                                            value: --authorization-mode=Webhook
                                                     """
                                                 ),
                                             },

diff --git a/zuul.d/jobs-flatcar.yaml b/zuul.d/jobs-flatcar.yaml
@@ -15,66 +15,66 @@
       image_os_distro: flatcar
 
 - job:
-    name: magnum-cluster-api-image-build-flatcar-v1.27.14
+    name: magnum-cluster-api-image-build-flatcar-v1.27.15
     parent: magnum-cluster-api-image-build-flatcar
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.14
+    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.15
     parent: magnum-cluster-api-sonobuoy-flatcar
     dependencies:
-      - name: magnum-cluster-api-image-build-flatcar-v1.27.14
+      - name: magnum-cluster-api-image-build-flatcar-v1.27.15
         soft: true
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-image-build-flatcar-v1.28.10
+    name: magnum-cluster-api-image-build-flatcar-v1.28.11
     parent: magnum-cluster-api-image-build-flatcar
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-sonobuoy-flatcar-v1.28.10
+    name: magnum-cluster-api-sonobuoy-flatcar-v1.28.11
     parent: magnum-cluster-api-sonobuoy-flatcar
     dependencies:
-      - name: magnum-cluster-api-image-build-flatcar-v1.28.10
+      - name: magnum-cluster-api-image-build-flatcar-v1.28.11
         soft: true
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-image-build-flatcar-v1.29.5
+    name: magnum-cluster-api-image-build-flatcar-v1.29.6
     parent: magnum-cluster-api-image-build-flatcar
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-flatcar-v1.29.5
+    name: magnum-cluster-api-sonobuoy-flatcar-v1.29.6
     parent: magnum-cluster-api-sonobuoy-flatcar
     dependencies:
-      - name: magnum-cluster-api-image-build-flatcar-v1.29.5
+      - name: magnum-cluster-api-image-build-flatcar-v1.29.6
         soft: true
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.14-calico
-    parent: magnum-cluster-api-sonobuoy-flatcar-v1.27.14
+    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.15-calico
+    parent: magnum-cluster-api-sonobuoy-flatcar-v1.27.15
     vars:
       network_driver: calico
 
 - job:
-    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.14-cilium
-    parent: magnum-cluster-api-sonobuoy-flatcar-v1.27.14
+    name: magnum-cluster-api-sonobuoy-flatcar-v1.27.15-cilium
+    parent: magnum-cluster-api-sonobuoy-flatcar-v1.27.15
     vars:
       network_driver: cilium
 
 - project-template:
     name: magnum-cluster-api-flatcar
     check:
       jobs:
-        - magnum-cluster-api-image-build-flatcar-v1.27.14
-        - magnum-cluster-api-sonobuoy-flatcar-v1.27.14-calico
-        - magnum-cluster-api-sonobuoy-flatcar-v1.27.14-cilium
+        - magnum-cluster-api-image-build-flatcar-v1.27.15
+        - magnum-cluster-api-sonobuoy-flatcar-v1.27.15-calico
+        - magnum-cluster-api-sonobuoy-flatcar-v1.27.15-cilium
diff --git a/zuul.d/jobs-rockylinux-8.yaml b/zuul.d/jobs-rockylinux-8.yaml
@@ -15,67 +15,67 @@
       image_os_distro: ubuntu
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-8-v1.27.14
+    name: magnum-cluster-api-image-build-rockylinux-8-v1.27.15
     parent: magnum-cluster-api-image-build-rockylinux-8
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15
     parent: magnum-cluster-api-sonobuoy-rockylinux-8
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-8-v1.27.14
+      - name: magnum-cluster-api-image-build-rockylinux-8-v1.27.15
         soft: true
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-8-v1.28.10
+    name: magnum-cluster-api-image-build-rockylinux-8-v1.28.11
     parent: magnum-cluster-api-image-build-rockylinux-8
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.28.10
+    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.28.11
     parent: magnum-cluster-api-sonobuoy-rockylinux-8
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-8-v1.28.10
+      - name: magnum-cluster-api-image-build-rockylinux-8-v1.28.11
         soft: true
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-8-v1.29.5
+    name: magnum-cluster-api-image-build-rockylinux-8-v1.29.6
     parent: magnum-cluster-api-image-build-rockylinux-8
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.29.5
+    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.29.6
     parent: magnum-cluster-api-sonobuoy-rockylinux-8
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-8-v1.29.5
+      - name: magnum-cluster-api-image-build-rockylinux-8-v1.29.6
         soft: true
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14-calico
-    parent: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15-calico
+    parent: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15
     vars:
       network_driver: calico
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14-cilium
-    parent: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15-cilium
+    parent: magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15
     vars:
       network_driver: cilium
 
 - project-template:
     name: magnum-cluster-api-rockylinux-8
     check:
       jobs:
-        - magnum-cluster-api-image-build-rockylinux-8-v1.27.14
-        - magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14-calico
-        - magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.14-cilium
+        - magnum-cluster-api-image-build-rockylinux-8-v1.27.15
+        - magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15-calico
+        - magnum-cluster-api-sonobuoy-rockylinux-8-v1.27.15-cilium
 
diff --git a/zuul.d/jobs-rockylinux-9.yaml b/zuul.d/jobs-rockylinux-9.yaml
@@ -15,67 +15,67 @@
       image_os_distro: ubuntu
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-9-v1.27.14
+    name: magnum-cluster-api-image-build-rockylinux-9-v1.27.15
     parent: magnum-cluster-api-image-build-rockylinux-9
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15
     parent: magnum-cluster-api-sonobuoy-rockylinux-9
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-9-v1.27.14
+      - name: magnum-cluster-api-image-build-rockylinux-9-v1.27.15
         soft: true
     vars:
-      kube_tag: v1.27.14
+      kube_tag: v1.27.15
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-9-v1.28.10
+    name: magnum-cluster-api-image-build-rockylinux-9-v1.28.11
     parent: magnum-cluster-api-image-build-rockylinux-9
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.28.10
+    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.28.11
     parent: magnum-cluster-api-sonobuoy-rockylinux-9
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-9-v1.28.10
+      - name: magnum-cluster-api-image-build-rockylinux-9-v1.28.11
         soft: true
     vars:
-      kube_tag: v1.28.10
+      kube_tag: v1.28.11
 
 - job:
-    name: magnum-cluster-api-image-build-rockylinux-9-v1.29.5
+    name: magnum-cluster-api-image-build-rockylinux-9-v1.29.6
     parent: magnum-cluster-api-image-build-rockylinux-9
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.29.5
+    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.29.6
     parent: magnum-cluster-api-sonobuoy-rockylinux-9
     dependencies:
-      - name: magnum-cluster-api-image-build-rockylinux-9-v1.29.5
+      - name: magnum-cluster-api-image-build-rockylinux-9-v1.29.6
         soft: true
     vars:
-      kube_tag: v1.29.5
+      kube_tag: v1.29.6
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14-calico
-    parent: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15-calico
+    parent: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15
     vars:
       network_driver: calico
 
 - job:
-    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14-cilium
-    parent: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14
+    name: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15-cilium
+    parent: magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15
     vars:
       network_driver: cilium
 
 - project-template:
     name: magnum-cluster-api-rockylinux-9
     check:
       jobs:
-        - magnum-cluster-api-image-build-rockylinux-9-v1.27.14
-        - magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14-calico
-        - magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.14-cilium
+        - magnum-cluster-api-image-build-rockylinux-9-v1.27.15
+        - magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15-calico
+        - magnum-cluster-api-sonobuoy-rockylinux-9-v1.27.15-cilium