From 4282d73c7418958dff06d5b527ab2550e07184f9 Mon Sep 17 00:00:00 2001 From: Jan Novak Date: Sat, 8 Aug 2026 13:45:33 +0200 Subject: [PATCH] Strip remaining webhook-only scaffold and network-policy manifests Follows the approved lean-down plan (docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md). Removes from the application's deployed footprint: - config/network-policy/ and its commented enable line -- the user does not need network policies at the moment. - The webhook-only halves of config/default/kustomization.yaml: the commented ../webhook and ../certmanager resource lines, the manager_webhook_patch.yaml reference, the serving-cert -> Validating/Mutating WebhookConfiguration cainjection replacement blocks, and the crdkustomizecainjection* scaffold markers -- anchors only for `kubebuilder create webhook`, which is a permanent non-goal. - The two commented [WEBHOOK] blocks in config/crd/kustomization.yaml plus the now-empty patches: key; kept the one-line crdkustomizeresource marker since `kubebuilder create api` could legitimately run again. - config/crd/kustomizeconfig.yaml, whose only consumer was the removed configurations: block. Explicitly kept per user direction: all of config/prometheus/, the paired metrics-TLS-via-cert-manager plumbing (cert_metrics_manager_patch + the metrics-certs/ServiceMonitor replacement halves), all RBAC manifests including the admin/editor/viewer helper roles, and all developer tooling. Also records in the execution log why the webhook machinery existed at all: kubebuilder init emits it unconditionally, verified against the v4.15.0 binary that no init flag can suppress it -- scaffold-then-prune is the only supported path, and the pruning pass should have happened at Step 0. Verified: kustomize build clean on config/default and config/crd, go build/vet clean with and without -tags=e2e, make test green with coverage identical to pre-cleanup. Co-Authored-By: Claude --- config/crd/kustomization.yaml | 10 -- config/crd/kustomizeconfig.yaml | 12 -- config/default/kustomization.yaml | 137 +----------------- .../network-policy/allow-metrics-traffic.yaml | 27 ---- config/network-policy/kustomization.yaml | 2 - .../2026-08-07-1747-proxy-operator.md | 83 +++++++++++ 6 files changed, 86 insertions(+), 185 deletions(-) delete mode 100644 config/crd/kustomizeconfig.yaml delete mode 100644 config/network-policy/allow-metrics-traffic.yaml delete mode 100644 config/network-policy/kustomization.yaml diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml index 93ab88c..7ab3951 100644 --- a/config/crd/kustomization.yaml +++ b/config/crd/kustomization.yaml @@ -4,13 +4,3 @@ resources: - bases/crawl.example.com_proxies.yaml # +kubebuilder:scaffold:crdkustomizeresource - -patches: -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. -# patches here are for enabling the conversion webhook for each CRD -# +kubebuilder:scaffold:crdkustomizewebhookpatch - -# [WEBHOOK] To enable webhook, uncomment the following section -# the following config is for teaching kustomize how to do kustomization for CRDs. -#configurations: -#- kustomizeconfig.yaml diff --git a/config/crd/kustomizeconfig.yaml b/config/crd/kustomizeconfig.yaml deleted file mode 100644 index 61361ff..0000000 --- a/config/crd/kustomizeconfig.yaml +++ /dev/null @@ -1,12 +0,0 @@ -# This file is for teaching kustomize how to substitute name and namespace reference in CRD -nameReference: -- kind: Service - version: v1 - fieldSpecs: - - kind: CustomResourceDefinition - version: v1 - group: apiextensions.k8s.io - path: spec/conversion/webhook/clientConfig/service/name - -varReference: -- path: metadata/annotations diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index b61ec64..373f742 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -18,20 +18,10 @@ resources: - ../crd - ../rbac - ../manager -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in -# crd/kustomization.yaml -#- ../webhook -# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. -#- ../certmanager # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. #- ../prometheus # [METRICS] Expose the controller manager metrics service. - metrics_service.yaml -# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy. -# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. -# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will -# be able to communicate with the Webhook Server. -#- ../network-policy # Uncomment the patches line if you enable Metrics patches: @@ -48,14 +38,9 @@ patches: # target: # kind: Deployment -# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in -# crd/kustomization.yaml -#- path: manager_webhook_patch.yaml -# target: -# kind: Deployment - -# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. -# Uncomment the following replacements to add the cert-manager CA injection annotations +# [METRICS-WITH-CERTS] Uncomment the following replacements together with the patch +# above to wire the metrics Service name/namespace into the cert-manager Certificate +# and the Prometheus ServiceMonitor TLS config. #replacements: # - source: # Uncomment the following block to enable certificates for metrics # kind: Service @@ -116,119 +101,3 @@ patches: # delimiter: '.' # index: 1 # create: true - -# - source: # Uncomment the following block if you have any webhook -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.name # Name of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 0 -# create: true -# - source: -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.namespace # Namespace of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 1 -# create: true - -# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation) -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # This name should match the one in certificate.yaml -# fieldPath: .metadata.namespace # Namespace of the certificate CR -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - source: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPath: .metadata.name -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true - -# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting ) -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPath: .metadata.namespace # Namespace of the certificate CR -# targets: -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - source: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPath: .metadata.name -# targets: -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true - -# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion) -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPath: .metadata.namespace # Namespace of the certificate CR -# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. -# +kubebuilder:scaffold:crdkustomizecainjectionns -# - source: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert -# fieldPath: .metadata.name -# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. -# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/config/network-policy/allow-metrics-traffic.yaml b/config/network-policy/allow-metrics-traffic.yaml deleted file mode 100644 index 17c0bde..0000000 --- a/config/network-policy/allow-metrics-traffic.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# This NetworkPolicy allows ingress traffic -# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those -# namespaces are able to gather data from the metrics endpoint. -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - app.kubernetes.io/name: egress-proxies-operator - app.kubernetes.io/managed-by: kustomize - name: allow-metrics-traffic - namespace: system -spec: - podSelector: - matchLabels: - control-plane: controller-manager - app.kubernetes.io/name: egress-proxies-operator - policyTypes: - - Ingress - ingress: - # This allows ingress traffic from any namespace with the label metrics: enabled - - from: - - namespaceSelector: - matchLabels: - metrics: enabled # Only from namespaces with this label - ports: - - port: 8443 - protocol: TCP diff --git a/config/network-policy/kustomization.yaml b/config/network-policy/kustomization.yaml deleted file mode 100644 index ec0fb5e..0000000 --- a/config/network-policy/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- allow-metrics-traffic.yaml diff --git a/docs/plans-executions/2026-08-07-1747-proxy-operator.md b/docs/plans-executions/2026-08-07-1747-proxy-operator.md index 868be21..72d1294 100644 --- a/docs/plans-executions/2026-08-07-1747-proxy-operator.md +++ b/docs/plans-executions/2026-08-07-1747-proxy-operator.md @@ -477,3 +477,86 @@ go build -tags=e2e ./... && go vet -tags=e2e ./... Both clean. `make test` green across the whole repo, unchanged from before the cleanup. + +## Cleanup — lean-down audit of Steps 0–3 + +Planned and approved separately in +[docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md](../plans/2026-08-08-1335-lean-scaffold-cleanup.md). +Prompted by the user asking (a) why webhook machinery existed at all when the +spec's §12 says "do NOT build: admission webhooks, cert-manager wiring", and +(b) for a full audit of completed work so the project starts as lean as +possible. + +**Why the webhook machinery existed — for the record.** `kubebuilder init` +emits it unconditionally: the active webhook-server wiring in `cmd/main.go`, +cert-manager install in the e2e utils, and commented kustomize anchor blocks +all arrive with `init`, not with `create webhook` (never run here). At Step 0 +the scaffold was deliberately committed untouched as a reviewable baseline +(only `.github/` stripped), and spec §3's "config/ (scaffold-generated, kept +working)" was read as license to keep the rest. The process gap: §12's +non-goals deserved a pruning pass immediately *after* the baseline commit, +especially for the parts that actually did something. The user caught it, not +the build process. + +**Could `init` have skipped it?** No — verified against the v4.15.0 binary, +not from memory: + +```bash +kubebuilder init --help +# flags: --domain --repo --owner --license(-file) --multigroup --namespaced +# --fetch-deps --skip-go-version-check --project-version --plugins +# nothing subtracts features; optional plugins (helm, grafana, deploy-image, +# autoupdate) are all additive — there is no "minimal" plugin +``` + +Scaffold-then-prune is the only supported path to a lean baseline. Worth +knowing at the *next* project bootstrap: plan the pruning pass as part of +scaffolding, not as a later discovery. (`--namespaced` was the one +arguably-applicable flag, but it conflicts with the kubernetes-pod provider's +cluster-wide `ListByTag` for orphan GC — cluster-scoped was correct.) + +**Audit result for the Go code: clean.** Nothing beyond spec that isn't a +justified, already-logged deviation (`Instance.UID`/`CreatedAt`, +`MaxLeases *int32`, `HealthCheck default={}`, registry-as-parameter, +kubernetes provider per user decision). Trivial extras (`shortName=px`, +`MaxProperties=32`) stay. + +**Scope lines drawn by the user during plan review** — recorded because they +shape what "lean" means for this repo going forward: + +- Developer tooling is exempt: `.golangci.yml`, `.custom-gcl.yml`, + `.devcontainer/`, `AGENTS.md`, Makefile `lint`/`docker-buildx`/ + `build-installer` targets all stay ("tooling around the project is cool, i + just want the application code produced to start as lean as possible"). +- Monitoring manifests stay: all of `config/prometheus/`, plus the paired + metrics-TLS-via-cert-manager plumbing + (`config/default/cert_metrics_manager_patch.yaml` and the metrics-certs/ + ServiceMonitor halves of the commented replacements block) — removing half + of a pair would leave dangling comment references. +- All RBAC manifests stay, including the `proxy_admin/editor/viewer` helper + ClusterRoles whose own headers say "not used by the project itself". +- Network policies go: "we do not need any network policies at the moment". + +**Removed:** + +- `config/network-policy/` (kustomization.yaml, allow-metrics-traffic.yaml) + plus its commented `#- ../network-policy` line in the default kustomization. +- Webhook-only remnants in `config/default/kustomization.yaml`: the commented + `#- ../webhook` / `#- ../certmanager` resource lines, the + `manager_webhook_patch.yaml` patch reference, and the webhook halves of the + replacements block (serving-cert → Validating/Mutating WebhookConfiguration + cainjection, conversion webhook, and the + `+kubebuilder:scaffold:crdkustomizecainjection*` markers — anchors only for + `kubebuilder create webhook`, permanently a non-goal). +- The two commented `[WEBHOOK]` blocks in `config/crd/kustomization.yaml` + (conversion patches + the `configurations:` reference), along with the empty + `patches:` key they lived under and the `crdkustomizewebhookpatch` marker. + Kept the one-line `crdkustomizeresource` marker — `kubebuilder create api` + could legitimately run again. +- `config/crd/kustomizeconfig.yaml` — only consumer was the removed + `configurations:` block. + +Verified: `bin/kustomize build config/default` and `... config/crd` both +render cleanly (no dangling references), `go build`/`go vet` clean with and +without `-tags=e2e`, `make test` green with coverage numbers identical to +pre-cleanup.