// deployGmsaWebhook deploys the GMSA webhook, and returns a cleanup function // to be called when done with testing, that removes the temp files it's created // on disks as well as the API resources it's created. <del> func deployGmsaWebhook(f *framework.Framework, deployScriptPath string) (func(), error) { cleanUpFunc := func() {} </del> <ins> func deployGmsaWebhook(f *framework.Framework) (func(), error) { deployerName := "webhook-deployer" deployerNamespace := f.Namespace.Name webHookName := "gmsa-webhook" webHookNamespace := deployerNamespace + "-webhook" </ins> <del> tempDir, err := os.MkdirTemp("", "") if err != nil { return cleanUpFunc, fmt.Errorf("unable to create temp dir: %w", err) } </del> <ins> // regardless of whether the deployment succeeded, let's do a best effort at cleanup cleanUpFunc := func() { framework.Logf("Best effort clean up of the webhook:n") stdout, err := framework.RunKubectl("", "delete", "CustomResourceDefinition", "gmsacredentialspecs.windows.k8s.io") framework.Logf("stdout:%snerror:%s", stdout, err) </ins> <del> manifestsFile := path.Join(tempDir, "manifests.yml") name := "gmsa-webhook" namespace := f.Namespace.Name + "-webhook" certsDir := path.Join(tempDir, "certs") </del> <ins> stdout, err = framework.RunKubectl("", "delete", "CertificateSigningRequest", fmt.Sprintf("%s.%s", webHookName, webHookNamespace)) framework.Logf("stdout:%snerror:%s", stdout, err) </ins> <del> // regardless of whether the deployment succeeded, let's do a best effort at cleanup cleanUpFunc = func() { framework.RunKubectl(f.Namespace.Name, "delete", "--filename", manifestsFile) framework.RunKubectl(f.Namespace.Name, "delete", "CustomResourceDefinition", "gmsacredentialspecs.windows.k8s.io") framework.RunKubectl(f.Namespace.Name, "delete", "CertificateSigningRequest", fmt.Sprintf("%s.%s", name, namespace)) os.RemoveAll(tempDir) </del> <ins> stdout, err = runKubectlExecInNamespace(deployerNamespace, deployerName, "--", "kubectl", "delete", "-f", "/manifests.yml") framework.Logf("stdout:%snerror:%s", stdout, err) } // ensure the deployer has ability to approve certificatesigningrequests to install the webhook s := createServiceAccount(f) bindClusterRBACRoleToServiceAccount(f, s, "cluster-admin") installSteps := []string{ "echo "@testing http://dl-cdn.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories", "&& apk add kubectl@testing gettext openssl", "&& apk add --update coreutils", fmt.Sprintf("&& curl %s > gmsa.sh", gmsaWebhookDeployScriptURL), "&& chmod +x gmsa.sh", fmt.Sprintf("&& ./gmsa.sh --file %s --name %s --namespace %s --certs-dir %s --tolerate-master", "/manifests.yml", webHookName, webHookNamespace, "certs"), "&& /agnhost pause", </ins> } <ins> installCommand := strings.Join(installSteps, " ") </ins> <del> cmd := exec.Command("bash", deployScriptPath, "--file", manifestsFile, "--name", name, "--namespace", namespace, "--certs-dir", certsDir, "--tolerate-master") </del> <ins> pod := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Name:      deployerName, Namespace: deployerNamespace, }, Spec: v1.PodSpec{ ServiceAccountName: s, NodeSelector: map[string]string{ "kubernetes.io/os": "linux", }, Containers: []v1.Container{ { Name:    deployerName, Image:   imageutils.GetE2EImage(imageutils.Agnhost), Command: []string{"bash", "-c"}, Args:    []string{installCommand}, }, }, Tolerations: []v1.Toleration{ { Operator: v1.TolerationOpExists, Effect:   v1.TaintEffectNoSchedule, }, }, }, } f.PodClient().CreateSync(pod) </ins> <del> output, err := cmd.CombinedOutput() </del> <ins> // Wait for the Webhook deployment to become ready. The deployer pod takes a few seconds to initialize and create resources err := waitForDeployment(func() (*appsv1.Deployment, error) { return f.ClientSet.AppsV1().Deployments(webHookNamespace).Get(context.TODO(), webHookName, metav1.GetOptions{}) }, 10*time.Second, f.Timeouts.PodStart) </ins> if err == nil { <del> framework.Logf("GMSA webhook successfully deployed, output:n%s", string(output)) </del> <ins> framework.Logf("GMSA webhook successfully deployed") </ins> } else { <del> err = fmt.Errorf("unable to deploy GMSA webhook, output:n%s: %w", string(output), err) </del> <ins> err = fmt.Errorf("GMSA webhook did not become ready: %w", err) </ins> } <ins> // Dump deployer logs logs, _ := e2epod.GetPodLogs(f.ClientSet, deployerNamespace, deployerName, deployerName) framework.Logf("GMSA deployment logs:n%s", logs) </ins> return cleanUpFunc, err }