Fix lint

Author: richardwxn

deploy/clusterrole.yaml

@@ -110,4 +110,17 @@ rules:
   - serviceaccounts
   verbs:
   - '*'
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - '*'
+- apiGroups:
+  - certmanager.k8s.io
+  resources:
+  - certificate
+  - issuer
+  verbs:
+  - '*'
 ---

deploy/crds/istio_v1alpha2_istiocontrolplane_cr.yaml

@@ -5,4 +5,29 @@ metadata:
   name: example-istiocontrolplane
 spec:
   profile: demo
+  trafficManagem:
+    components:
+      pilot:
+        k8s:
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: GODEBUG
+              value: gctrace=1
+            - name: PILOT_TRACE_SAMPLING
+              value: "100"
+            - name: CONFIG_NAMESPACE
+              value: istio-config
+          resources:
+            requests:
+              cpu: 10m
+              memory: 100Mi
 ---

deploy/operator.yaml

@@ -24,6 +24,12 @@ spec:
           command:
           - istio-operator
           - server
+          securityContext:
+            runAsUser: 0
+            runAsNonRoot: false
+            capabilities:
+              add:
+                - NET_ADMIN
           imagePullPolicy: Always
           env:
             - name: WATCH_NAMESPACE

pkg/webhook/istiocontrolplane/iscpwebhook.go

@@ -16,13 +16,16 @@ package istiocontrolplane
 
 import (
 	"context"
-	"istio.io/operator/pkg/apis/istio/v1alpha2"
-	"istio.io/operator/pkg/validate"
+
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	"istio.io/operator/pkg/apis/istio/v1alpha2"
+	"istio.io/operator/pkg/validate"
 )
 
-// +kubebuilder:webhook:path=/validate-v1alpha2-istiocontrolplane,mutating=true,failurePolicy=fail,groups="install.istio.io",resources=IstioControlPlane,verbs=create;update,versions=v1alpha2,name=mistiocontrolplane.kb.io
+// +kubebuilder:webhook:path=/validate-v1alpha2-istiocontrolplane,mutating=true,failurePolicy=fail,
+// groups="install.istio.io",resources=IstioControlPlane,verbs=create;update,versions=v1alpha2,name=mistiocontrolplane.kb.io
 
 // podAnnotator annotates Pods
 type iscpValidator struct {
@@ -54,4 +57,4 @@ func (a *iscpValidator) InjectClient(c client.Client) error {
 func (a *iscpValidator) InjectDecoder(d *admission.Decoder) error {
 	a.decoder = d
 	return nil
-}
+}

pkg/webhook/istiocontrolplane/server.go

@@ -28,7 +28,6 @@ func Add(mgr manager.Manager) error {
 func add(mgr manager.Manager) error {
 	log.Info("setting up webhook server")
 	webhookServer := mgr.GetWebhookServer()
-	//webhookServer.CertDir = "/tmp/cert"
 
 	webhookServer.Register("/validate-v1alpha2-istiocontrolplane",
 		&webhook.Admission{Handler: &iscpValidator{}})

pkg/webhook/webhook.go

@@ -15,12 +15,12 @@
 package webhook
 
 import (
-	"istio.io/operator/pkg/webhook/istiocontrolplane"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
-)
 
+	"istio.io/operator/pkg/webhook/istiocontrolplane"
+)
 
 // AddToManager adds all webhooks to the Manager
 func AddToManager(m manager.Manager) error {
 	return istiocontrolplane.Add(m)
-}
+}