From 4a3e449c634ef8b314901685d4aa98a7fd5b6bcd Mon Sep 17 00:00:00 2001 From: Suraj Deshmukh Date: Mon, 29 May 2023 18:36:33 +0000 Subject: [PATCH] kata-webhook-docs: Fix outdated script names - Fix the instructions to add a different runtime class. - Update script name that has underscore instead of dash. Fixes: #5664 Signed-off-by: Suraj Deshmukh --- kata-webhook/README.md | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/kata-webhook/README.md b/kata-webhook/README.md index 41286530c..36019775a 100644 --- a/kata-webhook/README.md +++ b/kata-webhook/README.md @@ -1,6 +1,6 @@ # Kata Admission controller webhook -Implement a simple admission controller webhook to annotate pods with the +Implement a simple admission controller webhook to annotate pods with the Kata runtime class. ## How to build the admission controller @@ -17,7 +17,7 @@ controller. $ docker build -t quay.io/kata-containers/kata-webhook-example:latest -f Dockerfile . ``` -> **Note:** +> **Note** > Image needs to be published for the webhook needs to work. Alternately > on a single machine cluster change the `imagePullPolicy` to use the locally > built image. @@ -30,29 +30,30 @@ by default, except for workloads we know for sure will not work with Kata, use the [admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) and sample admission controller we created by running the commands below: -> **Note:** +> **Note** > By default, the `runtimeClass` name used in this webhook is `kata`. If your > cluster is configured with another `runtimeClass`, you'll need to change the > value of the `RUNTIME_CLASS` environment variable defined in the -> [webhook file](deploy/webhook.yaml). You can manually edit the file or use -> the `yq` tool. E.g: -> `~/go/bin/yq w -i webhook.yaml spec.template.spec.containers[0].env[0].value "kata-clh"` +> [webhook file](deploy/webhook.yaml). You can manually edit the file or run: +> +> `export RUNTIME_CLASS=<>` +> +> `kubectl create cm kata-webhook --from-literal runtime_class=$RUNTIME_CLASS` ```bash -$ ./create_certs.sh -$ kubectl apply -f deploy/ +./create-certs.sh +kubectl apply -f deploy/ ``` Afterwards you can run the `webhook-check.sh` script to check the webhook was deployed correctly and is working: ```bash -$ ./webhook-check.sh +./webhook-check.sh ``` The webhook mutates pods to use the Kata runtime class for all pods except -those with +those with -* `hostNetwork: true` +* `hostNetwork: true` * namespace: `rook-ceph` and `rook-ceph-system` -