Repository: kubernetes-sigs/security-profiles-operator
Pull request #412 (2021-04-23 08:59:33)

Cleanup deployments and bump cert-manager

#### What type of PR is this?

/kind cleanup


#### What this PR does / why we need it:
This removes the not required webhook kustomization and bumps cert
manager to its latest release.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/412#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
JAORMX: /lgtm

Patch:
diff --git a/deploy/base/webhook/kustomization.yaml b/deploy/base/webhook/kustomization.yaml
deleted file mode 100644
index 602f7f2ef..000000000
--- a/deploy/base/webhook/kustomization.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-images:
-  - name: security-profiles-operator
-    newName: gcr.io/k8s-staging-sp-operator/security-profiles-operator
-    newTag: latest
-    # For images to be released:
-    # newName: k8s.gcr.io/security-profiles-operator/security-profiles-operator
-    # newTag: v0.3.0
-
-commonLabels:
-  app: security-profiles-operator-webhook
-
-resources:
-  - crd-binding.yaml
-  - crd-recording.yaml
-  - service_account.yaml
-  - role.yaml
-  - role_binding.yaml
-  - deployment.yaml
-  - config.yaml
-  - certificate.yaml
-  - service.yaml
-
-generatorOptions:
-  disableNameSuffixHash: true
diff --git a/deploy/webhook.yaml b/deploy/webhook.yaml
deleted file mode 100644
index b9bfd9355..000000000
--- a/deploy/webhook.yaml
+++ /dev/null
@@ -1,523 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.5.0
-  creationTimestamp: null
-  labels:
-    app: security-profiles-operator-webhook
-  name: profilebindings.security-profiles-operator.x-k8s.io
-spec:
-  group: security-profiles-operator.x-k8s.io
-  names:
-    kind: ProfileBinding
-    listKind: ProfileBindingList
-    plural: profilebindings
-    singular: profilebinding
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ProfileBinding is the Schema for the profilebindings API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ProfileBindingSpec defines the desired state of ProfileBinding.
-            properties:
-              image:
-                description: Image name within pod containers to match to the profile.
-                type: string
-              profileRef:
-                description: ProfileRef references a SeccompProfile or other profile
-                  type in the current namespace.
-                properties:
-                  kind:
-                    description: Kind of object to be bound.
-                    enum:
-                    - SeccompProfile
-                    type: string
-                  name:
-                    description: Name of the profile within the current namespace
-                      to which to bind the selected pods.
-                    type: string
-                required:
-                - kind
-                - name
-                type: object
-            required:
-            - image
-            - profileRef
-            type: object
-          status:
-            description: ProfileBindingStatus contains status of the Profilebinding.
-            properties:
-              activeWorkloads:
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.5.0
-  creationTimestamp: null
-  labels:
-    app: security-profiles-operator-webhook
-  name: profilerecordings.security-profiles-operator.x-k8s.io
-spec:
-  group: security-profiles-operator.x-k8s.io
-  names:
-    kind: ProfileRecording
-    listKind: ProfileRecordingList
-    plural: profilerecordings
-    singular: profilerecording
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .spec.podSelector
-      name: PodSelector
-      priority: 10
-      type: string
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ProfileRecording is the Schema for the profilerecordings API.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ProfileRecordingSpec defines the desired state of ProfileRecording.
-            properties:
-              kind:
-                description: Kind of object to be recorded.
-                enum:
-                - SeccompProfile
-                type: string
-              podSelector:
-                description: PodSelector selects the pods to record. This field follows
-                  standard label selector semantics. An empty podSelector matches
-                  all pods in this namespace.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: A label selector requirement is a selector that
-                        contains values, a key, and an operator that relates the key
-                        and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: operator represents a key's relationship to
-                            a set of values. Valid operators are In, NotIn, Exists
-                            and DoesNotExist.
-                          type: string
-                        values:
-                          description: values is an array of string values. If the
-                            operator is In or NotIn, the values array must be non-empty.
-                            If the operator is Exists or DoesNotExist, the values
-                            array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: matchLabels is a map of {key,value} pairs. A single
-                      {key,value} in the matchLabels map is equivalent to an element
-                      of matchExpressions, whose key field is "key", the operator
-                      is "In", and the values array contains only "value". The requirements
-                      are ANDed.
-                    type: object
-                type: object
-            required:
-            - kind
-            - podSelector
-            type: object
-          status:
-            description: ProfileRecordingStatus contains status of the ProfileRecording.
-            properties:
-              activeWorkloads:
-                items:
-                  type: string
-                type: array
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-webhook
-  namespace: security-profiles-operator
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  creationTimestamp: null
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-webhook
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilebindings
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilebindings/finalizers
-  verbs:
-  - delete
-  - get
-  - patch
-  - update
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilebindings/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilerecordings
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilerecordings/finalizers
-  verbs:
-  - delete
-  - get
-  - patch
-  - update
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - profilerecordings/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - security-profiles-operator.x-k8s.io
-  resources:
-  - seccompprofiles
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  creationTimestamp: null
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-webhook
-  namespace: security-profiles-operator
-rules:
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - create
-  - get
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-webhook
-  namespace: security-profiles-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: spo-webhook
-subjects:
-- kind: ServiceAccount
-  name: spo-webhook
-  namespace: security-profiles-operator
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-webhook
-  namespace: security-profiles-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: spo-webhook
-subjects:
-- kind: ServiceAccount
-  name: spo-webhook
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: security-profiles-operator-webhook
-  namespace: security-profiles-operator
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: security-profiles-operator-webhook
-      name: security-profiles-operator-webhook
-  template:
-    metadata:
-      annotations:
-        seccomp.security.alpha.kubernetes.io/pod: runtime/default
-      labels:
-        app: security-profiles-operator-webhook
-        name: security-profiles-operator-webhook
-    spec:
-      containers:
-      - args:
-        - webhook
-        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
-        imagePullPolicy: Always
-        name: security-profiles-operator
-        ports:
-        - containerPort: 9443
-          name: webhook
-          protocol: TCP
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: cert
-          readOnly: true
-      serviceAccountName: spo-webhook
-      tolerations:
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/master
-        operator: Exists
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/control-plane
-        operator: Exists
-      - effect: NoExecute
-        key: node.kubernetes.io/not-ready
-        operator: Exists
-      volumes:
-      - name: cert
-        secret:
-          defaultMode: 420
-          secretName: webhook-server-cert
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  annotations:
-    cert-manager.io/inject-ca-from: security-profiles-operator/webhook-cert
-  labels:
-    app: security-profiles-operator-webhook
-  name: spo-mutating-webhook-configuration
-webhooks:
-- admissionReviewVersions:
-  - v1beta1
-  clientConfig:
-    caBundle: Cg==
-    service:
-      name: webhook-service
-      namespace: security-profiles-operator
-      path: /mutate-v1-pod-binding
-  failurePolicy: Fail
-  name: binding.spo.io
-  objectSelector:
-    matchExpressions:
-    - key: name
-      operator: NotIn
-      values:
-      - security-profiles-operator
-      - security-profiles-operator-webhook
-  rules:
-  - apiGroups:
-    - ""
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    - DELETE
-    resources:
-    - pods
-  sideEffects: None
-- admissionReviewVersions:
-  - v1beta1
-  clientConfig:
-    caBundle: Cg==
-    service:
-      name: webhook-service
-      namespace: security-profiles-operator
-      path: /mutate-v1-pod-recording
-  failurePolicy: Fail
-  name: recording.spo.io
-  objectSelector:
-    matchExpressions:
-    - key: name
-      operator: NotIn
-      values:
-      - security-profiles-operator
-      - security-profiles-operator-webhook
-  rules:
-  - apiGroups:
-    - ""
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    - DELETE
-    resources:
-    - pods
-  sideEffects: None
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: selfsigned-issuer
-  namespace: security-profiles-operator
-spec:
-  selfSigned: {}
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: webhook-cert
-  namespace: security-profiles-operator
-spec:
-  dnsNames:
-  - webhook-service.security-profiles-operator.svc
-  - webhook-service.security-profiles-operator.svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: selfsigned-issuer
-  secretName: webhook-server-cert
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: security-profiles-operator-webhook
-  name: webhook-service
-  namespace: security-profiles-operator
-spec:
-  ports:
-  - port: 443
-    targetPort: 9443
-  selector:
-    app: security-profiles-operator-webhook
-    name: security-profiles-operator-webhook
diff --git a/installation-usage.md b/installation-usage.md
index c53cda31b..a4055a410 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -24,7 +24,7 @@ architectures `amd64` and `arm64` for now. To deploy the operator, first install
 cert-manager via `kubectl`:
 
 ```sh
-$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager.yaml
+$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.3.1/cert-manager.yaml
 $ kubectl --namespace cert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 ```
 


Test patch:
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 89b03a1e1..f3582a6fc 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -31,7 +31,7 @@ import (
 )
 
 const (
-	certmanager       = "https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-manager.yaml"
+	certmanager       = "https://github.com/jetstack/cert-manager/releases/download/v1.3.1/cert-manager.yaml"
 	manifest          = "deploy/operator.yaml"
 	namespaceManifest = "deploy/namespace-operator.yaml"
 	testNamespace     = "test-ns"