Add operator flag to define webhook port

[KrisJohnstone]

As discussed in #6655, changes have been made to support nominating the port to listen.

Couple of notes:

• As mentioned in Enable hostNetwork support in eck-operator Helm chart #6655 having issues running this up locally due to vault issues.
• I've left the operatorhub portions intact as it sources the yaml and applies it, not much room for modification from what I could see. Happy to be proven wrong.
• Dockerfile won't build due to missing dep config/eck.yaml. Will see if I can pinch a file from 2.7 or something hacky like that.

[barkbay]

Not from this PR but would it make sense to move hostNetwork as a "top level" field?
hostNetwork is part of the Pod specification, as resources, podSecurityContext, serviceAccount... and is not directly related to the webhook configuration.

[barkbay]

There is also a typo in the comment:

--- a/deploy/eck-operator/values.yaml
+++ b/deploy/eck-operator/values.yaml
@@ -126,7 +126,7 @@ webhook:
   # objectSelector corresponds to the objectSelector property of the webhook.
   # Setting this restricts the webhook to act only on objects that match the selector.
   objectSelector: {}
-  # HostNetwork allows a Pod to use the Node network namespace.
+  # hostNetwork allows a Pod to use the Node network namespace.
   # This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
   # CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
   hostNetwork: false

[thbkrkr]

Not from this PR but would it make sense to move hostNetwork as a "top level" field?
hostNetwork is part of the Pod specification, as resources, podSecurityContext, serviceAccount... and is not directly related to the webhook configuration.

You're absolutely right, I missed that in #6636.

[KrisJohnstone]

I had it at the root, but was asked to change. Will move it to the root :)

[thbkrkr]

Thanks. Also need to update:

diff --git a/deploy/eck-operator/templates/statefulset.yaml b/deploy/eck-operator/templates/statefulset.yaml
index e17c34a82..16d66e5e2 100644
--- a/deploy/eck-operator/templates/statefulset.yaml
+++ b/deploy/eck-operator/templates/statefulset.yaml
@@ -117,7 +117,7 @@ spec:
         {{- with .Values.volumes }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
-      {{- if .Values.webhook.hostNetwork }}
+      {{- if .Values.hostNetwork }}

[thbkrkr]

I'm fine not supporting that in this PR, but still, how would you deploy ECK with hostNetwork: true and replicaCount: 2?

[barkbay]

I'm fine not supporting that in this PR, but still, how would you deploy ECK with hostNetwork: true and replicaCount: 2?

IIRC there is a scheduler predicate that prevents 2 Pods with hostNetwork: true to be scheduled on a same k8s node as soon as their containers[*].ports[*] intersect.

Edit: to be confirmed, just a vague recollection.

[KrisJohnstone]

I'm fine not supporting that in this PR, but still, how would you deploy ECK with hostNetwork: true and replicaCount: 2?

IIRC there is a scheduler predicate that prevents 2 Pods with hostNetwork: true to be scheduled on a same k8s node as soon as their containers[*].ports[*] intersect.

Edit: to be confirmed, just a vague recollection.

By default I believe this is the case yes.

EDIT: Its undoubtedly much more work but one way that would also improve the security of the operator would be to separate the webhook validation from the operator.

[thbkrkr]

Could you also add these new config parameters in the following documents, please?

docs/operating-eck/operator-config.asciidoc
docs/operating-eck/webhook.asciidoc

[KrisJohnstone]

Could you also add these new config parameters in the following documents, please?

docs/operating-eck/operator-config.asciidoc docs/operating-eck/webhook.asciidoc

Done :)

[KrisJohnstone]

Missed a fetch config statement, so was always using default port.

[thbkrkr]

buildkite test this

[thbkrkr]

@elasticmachine run elasticsearch-ci/docs

[barkbay]

buildkite test this

[barkbay]

@elasticmachine run elasticsearch-ci/docs

[barkbay]

LGTM