mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-11-02 17:23:32 +00:00
Josh Siviour
8fa33f07ce
* test: pod identity webhook mutation, publisher and webhook config contracts * feat: pod identity webhook mutator, CA bundle publisher and webhook configuration * feat(eks): run the pod identity webhook on every control-plane server Add the eks-pod-identity-webhook binary and its OpenRC service. It listens on 127.0.0.1:8444 with a serving certificate signed by the k3s server CA, authenticates to the API server with a client certificate signed by the k3s client CA, and runs under its own least-privilege ClusterRole. Each server stages the RBAC and the MutatingWebhookConfiguration (caBundle is the server CA) into the k3s manifests directory, so server-join nodes get them too. Match upstream's container skip rule: skip only when the regional STS key is present, and add the token mount otherwise. * fix(eks): issue pod identity webhook certs for one year and renew in the running process Both the serving and client certificates were valid for ten years. Kubernetes cannot revoke a client certificate, so a copy taken off a control-plane disk would stay a valid identity for a decade. Issue both for one year with the existing 30-day renew window. The process loaded the serving certificate once. A daily check now exits with ErrCertRenewal when either certificate enters the renew window, so the supervisor restarts it and EnsureCerts reissues. Add tests for KubeClient against a TLS fake API server and for Run, which the package had none of. * test: e2e covers pod-identity webhook and unmodified LBC chart IRSAPod now uses a ServiceAccount annotation only and asserts the injected env and volumes plus an untouched unannotated pod. LBCChart installs the upstream chart 1.11.0 and reconciles an Ingress into an active ALB. * test: pass the tagging endpoint to the LBC chart and mark Shield/WAF flags Spinifex-only * fix: make the pod identity webhook init script executable in the eks-node image setup.sh chmods each shipped init script to 0755 explicitly, and the new service was missing from the list. rc-update then refused it, and eks-node-role, running under set -eu, aborted before starting k3s. Add a guard test that every init script in INSTALL_FILES is chmod'd. * fix: start the pod identity webhook last and keep its failures non-fatal eks-node-role runs under set -eu, so a fault enabling or starting the optional webhook aborted the control plane boot before k3s-first-boot, state-report and addon-sync. Enable and start it at the end of the server and server-join roles and log a warning on failure instead. The role test now asserts the webhook is the last call and that an enable or start failure still exits 0 and finishes the role. * fix: move the pod identity webhook off the token webhook readiness port eks-token-webhook already serves its plain HTTP readiness endpoint on 8444, which the API server target group health-checks. The pod identity webhook bound the same port, failed with address already in use and respawned forever, so no pod was ever injected. Listen on 127.0.0.1:8445 and add a test that the two ports differ. * docs: describe pod identity webhook for user workloads in the EKS guide * fix: split STUB_FAIL assignment from export in the role test