mirror of
https://github.com/1Password/onepassword-operator.git
synced 2025-10-22 23:48:05 +00:00
85 lines
2.9 KiB
Markdown
85 lines
2.9 KiB
Markdown
## Deploy
|
|
|
|
1. Create namespace `op-secret-injector` in which the 1Password secret injector webhook is deployed:
|
|
|
|
```
|
|
# kubectl create ns op-secret-injector
|
|
```
|
|
|
|
2. Create a signed cert/key pair and store it in a Kubernetes `secret` that will be consumed by 1Password secret injector deployment:
|
|
|
|
```
|
|
# ./deploy/webhook-create-signed-cert.sh \
|
|
--service op-secret-injector-webhook-svc \
|
|
--secret op-secret-injector-webhook-certs \
|
|
--namespace op-secret-injector
|
|
```
|
|
|
|
3. Patch the `MutatingWebhookConfiguration` by set `caBundle` with correct value from Kubernetes cluster:
|
|
|
|
```
|
|
# cat deploy/mutatingwebhook.yaml | \
|
|
deploy/webhook-patch-ca-bundle.sh > \
|
|
deploy/mutatingwebhook-ca-bundle.yaml
|
|
```
|
|
|
|
4. Deploy resources:
|
|
|
|
```
|
|
# kubectl create -f deploy/deployment.yaml
|
|
# kubectl create -f deploy/service.yaml
|
|
# kubectl create -f deploy/mutatingwebhook-ca-bundle.yaml
|
|
```
|
|
|
|
## Verify
|
|
|
|
1. The sidecar inject webhook should be in running state:
|
|
|
|
```
|
|
# kubectl -n sidecar-injector get pod
|
|
NAME READY STATUS RESTARTS AGE
|
|
sidecar-injector-webhook-deployment-7c8bc5f4c9-28c84 1/1 Running 0 30s
|
|
# kubectl -n sidecar-injector get deploy
|
|
NAME READY UP-TO-DATE AVAILABLE AGE
|
|
sidecar-injector-webhook-deployment 1/1 1 1 67s
|
|
```
|
|
|
|
2. Create new namespace `injection` and label it with `sidecar-injector=enabled`:
|
|
|
|
```
|
|
# kubectl create ns injection
|
|
# kubectl label namespace injection sidecar-injection=enabled
|
|
# kubectl get namespace -L sidecar-injection
|
|
NAME STATUS AGE SIDECAR-INJECTION
|
|
default Active 26m
|
|
injection Active 13s enabled
|
|
kube-public Active 26m
|
|
kube-system Active 26m
|
|
sidecar-injector Active 17m
|
|
```
|
|
|
|
3. Deploy an app in Kubernetes cluster, take `alpine` app as an example
|
|
|
|
```
|
|
# kubectl run alpine --image=alpine --restart=Never -n injection --overrides='{"apiVersion":"v1","metadata":{"annotations":{"sidecar-injector-webhook.morven.me/inject":"yes"}}}' --command -- sleep infinity
|
|
```
|
|
|
|
4. Verify sidecar container is injected:
|
|
|
|
```
|
|
# kubectl get pod
|
|
NAME READY STATUS RESTARTS AGE
|
|
alpine 2/2 Running 0 1m
|
|
# kubectl -n injection get pod alpine -o jsonpath="{.spec.containers[*].name}"
|
|
alpine sidecar-nginx
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
Sometimes you may find that pod is injected with sidecar container as expected, check the following items:
|
|
|
|
1. The sidecar-injector webhook is in running state and no error logs.
|
|
2. The namespace in which application pod is deployed has the correct labels as configured in `mutatingwebhookconfiguration`.
|
|
3. Check the `caBundle` is patched to `mutatingwebhookconfiguration` object by checking if `caBundle` fields is empty.
|
|
4. Check if the application pod has annotation `sidecar-injector-webhook.morven.me/inject":"yes"`.
|