refresh with upstream, remove unneeded RBAC stuff

Author: waldner

.github/workflows/docker.yaml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.21
+          go-version: 1.22
 
       - name: Set up secret file
         env:
@@ -41,7 +41,7 @@ jobs:
         run: sed "s/%%HE_USERNAME%%/${HE_USERNAME}/; s/%%HE_PASSWORD%%/${HE_PASSWORD}/" testdata/he/secret.yaml.example > testdata/he/secret.yaml
 
       - name: Run tests
-        run: TEST_ZONE_NAME=${{ secrets.HE_ZONE }}. make test
+        run: USE_SECRETS=true TEST_ZONE_NAME=${{ secrets.HE_ZONE }}. make test
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.tool-versions

@@ -0,0 +1 @@
+golang 1.22.0

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21-alpine AS build_deps
+FROM golang:1.22-alpine3.19 AS build_deps
 
 RUN apk add --no-cache git
 
@@ -15,7 +15,7 @@ COPY . .
 
 RUN CGO_ENABLED=0 go build -o webhook -ldflags '-w -extldflags "-static"' .
 
-FROM alpine:3.15
+FROM alpine:3.18
 
 RUN apk add --no-cache ca-certificates
 

LICENSE

@@ -1,51 +1,45 @@
-OS ?= $(shell go env GOOS)
-ARCH ?= $(shell go env GOARCH)
+GO ?= $(shell which go)
+OS ?= $(shell $(GO) env GOOS)
+ARCH ?= $(shell $(GO) env GOARCH)
 
-# not used
-IMAGE_NAME := "waldner/cert-manager-webhook-he"
-IMAGE_TAG := "0.0.1"
+IMAGE_NAME := "webhook"
+IMAGE_TAG := "latest"
 
 OUT := $(shell pwd)/_out
 
-KUBE_VERSION=1.24.1
+KUBEBUILDER_VERSION=1.28.0
 
-USE_SECRETS ?= false
-HE_USERNAME ?= ""
-HE_PASSWORD ?= ""
-HE_APIKEY ?= "" 
+HELM_FILES := $(shell find deploy/cert-manager-webhook-he)
 
-$(shell mkdir -p "$(OUT)")
-export TEST_ASSET_ETCD=_test/kubebuilder/bin/etcd
-export TEST_ASSET_KUBE_APISERVER=_test/kubebuilder/bin/kube-apiserver
-export TEST_ASSET_KUBECTL=_test/kubebuilder/bin/kubectl
+test: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl
+	TEST_ASSET_ETCD=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd \
+	TEST_ASSET_KUBE_APISERVER=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver \
+	TEST_ASSET_KUBECTL=_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl \
+	$(GO) test -v .
 
-test: _test/kubebuilder
-	USE_SECRETS=true go test -v .
+_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH).tar.gz: | _test
+	curl -fsSL https://go.kubebuilder.io/test-tools/$(KUBEBUILDER_VERSION)/$(OS)/$(ARCH) -o $@
 
-_test/kubebuilder:
-	curl -fsSL https://go.kubebuilder.io/test-tools/$(KUBE_VERSION)/$(OS)/$(ARCH) -o kubebuilder-tools.tar.gz
-	mkdir -p _test/kubebuilder
-	tar -xvf kubebuilder-tools.tar.gz
-	mv kubebuilder/bin _test/kubebuilder/
-	rm kubebuilder-tools.tar.gz
-	rm -R kubebuilder
+_test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/etcd _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kube-apiserver _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)/kubectl: _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH).tar.gz | _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH)
+	tar xfO $< kubebuilder/bin/$(notdir $@) > $@ && chmod +x $@
 
-clean: clean-kubebuilder
-
-clean-kubebuilder:
-	rm -Rf _test/kubebuilder
+.PHONY: clean
+clean:
+	rm -r _test $(OUT)
 
+.PHONY: build
 build:
 	docker build -t "$(IMAGE_NAME):$(IMAGE_TAG)" .
 
 .PHONY: rendered-manifest.yaml
-rendered-manifest.yaml:
+rendered-manifest.yaml: $(OUT)/rendered-manifest.yaml
+
+$(OUT)/rendered-manifest.yaml: $(HELM_FILES) | $(OUT)
 	helm template \
-      --set image.repository=$(IMAGE_NAME) \
-      --set image.tag=$(IMAGE_TAG) \
-	  --set auth.useSecrets=$(USE_SECRETS) \
-	  --set auth.heUsername=$(HE_USERNAME) \
- 	  --set auth.hePassword=$(HE_PASSWORD) \
-  	  --set auth.heApiKey=$(HE_APIKEY) \
-      deploy/cert-manager-webhook-he > "$(OUT)/rendered-manifest.yaml"
+	    --name cert-manager-webhook-he \
+            --set image.repository=$(IMAGE_NAME) \
+            --set image.tag=$(IMAGE_TAG) \
+            deploy/cert-manager-webhook-he > $@
 
+_test $(OUT) _test/kubebuilder-$(KUBEBUILDER_VERSION)-$(OS)-$(ARCH):
+	mkdir -p $@

Makefile

@@ -0,0 +1,16 @@
+approvers:
+- munnerz
+- joshvanl
+- wallrj
+- jakexks
+- maelvls
+- irbekrm
+- inteon
+reviewers:
+- munnerz
+- joshvanl
+- wallrj
+- jakexks
+- maelvls
+- irbekrm
+- inteon

OWNERS

@@ -233,14 +233,14 @@ under `testdata/he`.
 Once the files are in place, run the test suite with:
 
 ```bash
-TEST_ZONE_NAME=yourdomain.com. make test
+USE_SECRETS=true TEST_ZONE_NAME=yourdomain.com. make test
 ```
 
 You can also set `VERBOSE=1` (or to any other nonempty value) to see debug messages
 (note that this increases verbosity for all components):
 
 ```bash
-VERBOSE=1 TEST_ZONE_NAME=yourdomain.com. make test
+VERBOSE=1 USE_SECRETS=1 TEST_ZONE_NAME=yourdomain.com. make test
 ```
 
 Have a look at `main_test.go` in case you want to customize the test suite.

README.md

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: Cert-manager webhook for HE DNS
 name: cert-manager-webhook-he
-version: 0.0.4
+version: 0.0.5

deploy/cert-manager-webhook-he/Chart.yaml

@@ -12,7 +12,7 @@ certManager:
   serviceAccountName: cert-manager
 image:
   repository: ghcr.io/waldner/cert-manager-webhook-he
-  tag: 0.0.5
+  tag: 0.0.6
   pullPolicy: IfNotPresent
 nameOverride: ""
 fullnameOverride: ""