Support local webhooks

Makefile

@@ -333,3 +333,20 @@ golint: get-ci-tools
 operator-lint: $(LOCALBIN) gowork
 	GOBIN=$(LOCALBIN) go install github.com/gibizer/operator-lint@2ffa25b7f1c13fb2bdae5444a3dd1b5bbad5
 	go vet -vettool=$(LOCALBIN)/operator-lint ./... ./api/...
+
+# Used for webhook testing
+# Please ensure the cinder-controller-manager deployment and
+# webhook definitions are removed from the csv before running
+# this. Also, cleanup the webhook configuration for local testing
+# before deplying with olm again.
+# $oc delete -n openstack validatingwebhookconfiguration/vcinder.kb.io
+# $oc delete -n openstack mutatingwebhookconfiguration/mcinder.kb.io
+SKIP_CERT ?=false
+.PHONY: run-with-webhook
+run-with-webhook: export CINDER_API_IMAGE_URL_DEFAULT=quay.io/tripleozedcentos9/openstack-cinder-api:current-tripleo
+run-with-webhook: export CINDER_BACKUP_IMAGE_URL_DEFAULT=quay.io/tripleozedcentos9/openstack-cinder-backup:current-tripleo
+run-with-webhook: export CINDER_SCHEDULER_IMAGE_URL_DEFAULT=quay.io/tripleozedcentos9/openstack-cinder-scheduler:current-tripleo
+run-with-webhook: export CINDER_VOLUME_IMAGE_URL_DEFAULT=quay.io/tripleozedcentos9/openstack-cinder-volume:current-tripleo
+run-with-webhook: manifests generate fmt vet ## Run a controller from your host.
+	/bin/bash hack/configure_local_webhook.sh
+	go run ./main.go

hack/configure_local_webhook.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+set -ex
+
+TMPDIR=${TMPDIR:-"/tmp/k8s-webhook-server/serving-certs"}
+SKIP_CERT=${SKIP_CERT:-false}
+CRC_IP=${CRC_IP:-$(/sbin/ip -o -4 addr list crc | awk '{print $4}' | cut -d/ -f1)}
+
+#Open 9443
+sudo firewall-cmd --zone=libvirt --add-port=9443/tcp
+sudo firewall-cmd --runtime-to-permanent
+
+# Generate the certs and the ca bundle
+if [ "$SKIP_CERT" = false ] ; then
+  mkdir -p ${TMPDIR}
+  rm -rf ${TMPDIR}/* || true
+
+  openssl req -newkey rsa:2048 -days 3650 -nodes -x509 \
+    -subj "/CN=${HOSTNAME}" \
+    -addext "subjectAltName = IP:${CRC_IP}" \
+    -keyout ${TMPDIR}/tls.key \
+    -out ${TMPDIR}/tls.crt
+
+  cat ${TMPDIR}/tls.crt ${TMPDIR}/tls.key | base64 -w 0 > ${TMPDIR}/bundle.pem
+
+fi
+
+CA_BUNDLE=`cat ${TMPDIR}/bundle.pem`
+
+# Patch the webhook(s)
+cat >> ${TMPDIR}/patch_webhook_configurations.yaml <<EOF_CAT
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: vcinder.kb.io
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: ${CA_BUNDLE}
+    url: https://${CRC_IP}:9443/validate-cinder-openstack-org-v1beta1-cinder
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: vcinder.kb.io
+  objectSelector: {}
+  rules:
+  - apiGroups:
+    - cinder.openstack.org
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cinders
+    scope: '*'
+  sideEffects: None
+  timeoutSeconds: 10
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: mcinder.kb.io
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: ${CA_BUNDLE}
+    url: https://${CRC_IP}:9443/mutate-cinder-openstack-org-v1beta1-cinder
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: mcinder.kb.io
+  objectSelector: {}
+  rules:
+  - apiGroups:
+    - cinder.openstack.org
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - cinders
+    scope: '*'
+  sideEffects: None
+  timeoutSeconds: 10
+EOF_CAT
+
+oc apply -n openstack -f ${TMPDIR}/patch_webhook_configurations.yaml