Add operator flag to define webhook port

cmd/manager/main.go

@@ -318,6 +318,11 @@ func Command() *cobra.Command {
 		DefaultWebhookName,
 		"Name of the Kubernetes ValidatingWebhookConfiguration resource. Only used when enable-webhook is true.",
 	)
+	cmd.Flags().Int(
+		operator.WebhookPortFlag,
+		WebhookPort,
+		"Port is the port that the webhook server serves at.",
+	)
 	cmd.Flags().String(
 		operator.SetDefaultSecurityContextFlag,
 		"auto-detect",
@@ -557,7 +562,7 @@ func startOperator(ctx context.Context) error {
 	}
 	opts.MetricsBindAddress = fmt.Sprintf(":%d", metricsPort) // 0 to disable
 
-	opts.Port = WebhookPort
+	opts.Port = viper.GetInt(operator.WebhookPortFlag)
 	mgr, err := ctrl.NewManager(cfg, opts)
 	if err != nil {
 		log.Error(err, "Failed to create controller manager")

deploy/eck-operator/templates/configmap.yaml

@@ -48,6 +48,7 @@ data:
     manage-webhook-certs: false
     webhook-cert-dir: {{ .Values.webhook.certsDir }}
       {{- end }}
+    webhook-port: {{ .Values.webhook.port }}
     {{- end }}
     {{- if .Values.managedNamespaces }}
     namespaces: [{{ join "," .Values.managedNamespaces  }}]

deploy/eck-operator/templates/operator-network-policy.yaml

@@ -44,7 +44,7 @@ spec:
   ingress:
 {{- if .Values.webhook.enabled }}
     - ports:
-        - port: 9443
+        - port: {{ .Values.webhook.port }}
       from:
         - ipBlock:
             cidr: "{{ $kubeAPIServerIP }}/32"

deploy/eck-operator/templates/statefulset.yaml

@@ -87,7 +87,7 @@ spec:
               protocol: TCP
             {{- end }}
             {{- if .Values.webhook.enabled }}
-            - containerPort: 9443
+            - containerPort: {{ .Values.webhook.port }}
               name: https-webhook
               protocol: TCP
             {{- end }}  
@@ -117,7 +117,7 @@ spec:
         {{- with .Values.volumes }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
-      {{- if .Values.webhook.hostNetwork }}
+      {{- if .Values.hostNetwork }}
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       {{- end }}

deploy/eck-operator/templates/webhook.yaml

@@ -426,7 +426,7 @@ spec:
   ports:
     - name: https
       port: 443
-      targetPort: 9443
+      targetPort: {{ .Values.webhook.port }}
   selector:
     {{- include "eck-operator.selectorLabels" . | nindent 4 }}
 {{- if .Values.webhook.manageCerts }}

deploy/eck-operator/values.yaml

@@ -126,10 +126,13 @@ webhook:
   # objectSelector corresponds to the objectSelector property of the webhook.
   # Setting this restricts the webhook to act only on objects that match the selector.
   objectSelector: {}
-  # HostNetwork allows a Pod to use the Node network namespace.
-  # This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
-  # CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
-  hostNetwork: false
+  # port is the port that the validating webhook binds to.
+  port: 9443
+
+# hostNetwork allows a Pod to use the Node network namespace.
+# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
+# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
+hostNetwork: false
 
 softMultiTenancy:
   # enabled determines whether the operator is installed with soft multi-tenancy extensions.

docs/operating-eck/operator-config.asciidoc

@@ -45,6 +45,7 @@ ECK can be configured using either command line flags or environment variables.
 |webhook-cert-dir |"{TempDir}/k8s-webhook-server/serving-certs" |Path to the directory that contains the webhook server key and certificate.
 |webhook-name |"elastic-webhook.k8s.elastic.co" |Name of the Kubernetes ValidatingWebhookConfiguration resource. Only used when `enable-webhook` is true.
 |webhook-secret |"" | K8s secret mounted into the path designated by webhook-cert-dir to be used for webhook certificates.
+|webhook-port   | 9443    | Port to listen for incoming validation requests.
 |===
 
 

docs/operating-eck/webhook.asciidoc

@@ -53,6 +53,7 @@ You can customise almost all aspects of the webhook setup by changing the <<{p}-
 |webhook-cert-dir     | /tmp/k8s-webhook-server/serving-certs | Path to mount the certificate.
 |webhook-name         | elastic-webhook.k8s.elastic.co | Name of the `ValidatingWebhookConfiguration` resource.
 |webhook-secret       | elastic-webhook-server-cert | Name of the secret containing the certificate for the webhook server.
+|webhook-port         | 9443    | Port to listen for incoming validation requests.
 |===
 
 

pkg/controller/common/operator/flags.go

@@ -41,4 +41,5 @@ const (
 	WebhookCertDirFlag                   = "webhook-cert-dir"
 	WebhookNameFlag                      = "webhook-name"
 	WebhookSecretFlag                    = "webhook-secret"
+	WebhookPortFlag                      = "webhook-port"
 )