Update

Author: ilyario

helm/dataflow-operator/templates/clusterrole.yaml

@@ -6,6 +6,18 @@ metadata:
   labels:
     {{- include "dataflow-operator.labels" . | nindent 4 }}
 rules:
+# Leader election: оператор использует Lease для выбора лидера (coordination.k8s.io)
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - patch
+  - watch
 # EventRecorder: создание событий для DataFlow (kubectl describe dataflow, UI событий)
 - apiGroups:
   - ""

internal/webhookenv/webhookenv.go

@@ -0,0 +1,27 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhookenv
+
+import (
+	"os"
+	"strings"
+)
+
+// GetWebhookCertDir returns WEBHOOK_CERT_DIR when webhook is enabled (certs mounted). Empty means webhook disabled.
+func GetWebhookCertDir() string {
+	return strings.TrimSpace(os.Getenv("WEBHOOK_CERT_DIR"))
+}

internal/webhookenv/webhookenv_test.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhookenv
+
+import (
+	"os"
+	"testing"
+)
+
+const envKey = "WEBHOOK_CERT_DIR"
+
+func TestGetWebhookCertDir(t *testing.T) {
+	restore := os.Getenv(envKey)
+	defer func() {
+		if restore == "" {
+			os.Unsetenv(envKey)
+		} else {
+			_ = os.Setenv(envKey, restore)
+		}
+	}()
+
+	t.Run("unset", func(t *testing.T) {
+		os.Unsetenv(envKey)
+		if got := GetWebhookCertDir(); got != "" {
+			t.Errorf("GetWebhookCertDir() = %q, want empty", got)
+		}
+	})
+
+	t.Run("set", func(t *testing.T) {
+		want := "/tmp/k8s-webhook-server/serving-certs"
+		_ = os.Setenv(envKey, want)
+		if got := GetWebhookCertDir(); got != want {
+			t.Errorf("GetWebhookCertDir() = %q, want %q", got, want)
+		}
+	})
+
+	t.Run("trimmed", func(t *testing.T) {
+		_ = os.Setenv(envKey, "  /path/to/certs  ")
+		if got := GetWebhookCertDir(); got != "/path/to/certs" {
+			t.Errorf("GetWebhookCertDir() = %q, want /path/to/certs", got)
+		}
+	})
+}

main.go

@@ -41,6 +41,7 @@ import (
 	dataflowv1 "github.com/dataflow-operator/dataflow/api/v1"
 	"github.com/dataflow-operator/dataflow/internal/controller"
 	_ "github.com/dataflow-operator/dataflow/internal/metrics" // Импортируем для регистрации метрик
+	"github.com/dataflow-operator/dataflow/internal/webhookenv"
 	//+kubebuilder:scaffold:imports
 )
 
@@ -131,20 +132,21 @@ func main() {
 		ctrl.SetLogger(zaprctrl.New(zapOpts...))
 	}
 
-	webhookOpts := webhook.Options{Port: 9443}
-	if certDir := os.Getenv("WEBHOOK_CERT_DIR"); certDir != "" {
-		webhookOpts.CertDir = certDir
-	}
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+	// Webhook server включается только при заданном WEBHOOK_CERT_DIR (в e2e и при отключённом webhook в Helm сертификаты не монтируются).
+	certDir := webhookenv.GetWebhookCertDir()
+	mgrOpts := ctrl.Options{
 		Scheme: scheme,
 		Metrics: metricsserver.Options{
 			BindAddress: metricsAddr,
 		},
-		WebhookServer:          webhook.NewServer(webhookOpts),
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         true, // Always HA-ready: only one active controller across replicas
 		LeaderElectionID:       "dataflow-operator.dataflow.io",
-	})
+	}
+	if certDir != "" {
+		mgrOpts.WebhookServer = webhook.NewServer(webhook.Options{Port: 9443, CertDir: certDir})
+	}
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), mgrOpts)
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)
@@ -154,8 +156,12 @@ func main() {
 		setupLog.Error(err, "unable to create controller", "controller", "DataFlow")
 		os.Exit(1)
 	}
-	validator := admission.WithCustomValidator(mgr.GetScheme(), &dataflowv1.DataFlow{}, &dataflowv1.DataFlow{})
-	mgr.GetWebhookServer().Register("/validate-dataflow-dataflow-io-v1-dataflow", validator)
+	if certDir != "" {
+		validator := admission.WithCustomValidator(mgr.GetScheme(), &dataflowv1.DataFlow{}, &dataflowv1.DataFlow{})
+		mgr.GetWebhookServer().Register("/validate-dataflow-dataflow-io-v1-dataflow", validator)
+	} else {
+		setupLog.Info("webhook disabled (WEBHOOK_CERT_DIR not set), skipping validator registration")
+	}
 	//+kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {