Add spark operator chart 2.0.2

2024-12-09 10:56:10 +09:00
parent 3c9aed159c
commit 229d5e49a8
25 changed files with 25506 additions and 0 deletions
@@ -0,0 +1,166 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Create the name of webhook component
+*/}}
+{{- define "spark-operator.webhook.name" -}}
+{{- include "spark-operator.fullname" . }}-webhook
+{{- end -}}
+
+{{/*
+Common labels for the webhook
+*/}}
+{{- define "spark-operator.webhook.labels" -}}
+{{ include "spark-operator.labels" . }}
+app.kubernetes.io/component: webhook
+{{- end -}}
+
+{{/*
+Selector labels for the webhook
+*/}}
+{{- define "spark-operator.webhook.selectorLabels" -}}
+{{ include "spark-operator.selectorLabels" . }}
+app.kubernetes.io/component: webhook
+{{- end -}}
+
+{{/*
+Create the name of service account to be used by webhook
+*/}}
+{{- define "spark-operator.webhook.serviceAccountName" -}}
+{{- if .Values.webhook.serviceAccount.create -}}
+{{ .Values.webhook.serviceAccount.name | default (include "spark-operator.webhook.name" .) }}
+{{- else -}}
+{{ .Values.webhook.serviceAccount.name | default "default" }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the cluster role to be used by the webhook
+*/}}
+{{- define "spark-operator.webhook.clusterRoleName" -}}
+{{ include "spark-operator.webhook.name" . }}
+{{- end }}
+
+{{/*
+Create the name of the cluster role binding to be used by the webhook
+*/}}
+{{- define "spark-operator.webhook.clusterRoleBindingName" -}}
+{{ include "spark-operator.webhook.clusterRoleName" . }}
+{{- end }}
+
+{{/*
+Create the name of the role to be used by the webhook
+*/}}
+{{- define "spark-operator.webhook.roleName" -}}
+{{ include "spark-operator.webhook.name" . }}
+{{- end }}
+
+{{/*
+Create the name of the role binding to be used by the webhook
+*/}}
+{{- define "spark-operator.webhook.roleBindingName" -}}
+{{ include "spark-operator.webhook.roleName" . }}
+{{- end }}
+
+{{/*
+Create the name of the secret to be used by webhook
+*/}}
+{{- define "spark-operator.webhook.secretName" -}}
+{{ include "spark-operator.webhook.name" . }}-certs
+{{- end -}}
+
+
+{{/*
+Create the name of the service to be used by webhook
+*/}}
+{{- define "spark-operator.webhook.serviceName" -}}
+{{ include "spark-operator.webhook.name" . }}-svc
+{{- end -}}
+
+{{/*
+Create the name of mutating webhook configuration
+*/}}
+{{- define "spark-operator.mutatingWebhookConfigurationName" -}}
+webhook.sparkoperator.k8s.io
+{{- end -}}
+
+{{/*
+Create the name of mutating webhook configuration
+*/}}
+{{- define "spark-operator.validatingWebhookConfigurationName" -}}
+quotaenforcer.sparkoperator.k8s.io
+{{- end -}}
+
+{{/*
+Create the name of the deployment to be used by webhook
+*/}}
+{{- define "spark-operator.webhook.deploymentName" -}}
+{{ include "spark-operator.webhook.name" . }}
+{{- end -}}
+
+{{/*
+Create the name of the lease resource to be used by leader election
+*/}}
+{{- define "spark-operator.webhook.leaderElectionName" -}}
+{{ include "spark-operator.webhook.name" . }}-lock
+{{- end -}}
+
+{{/*
+Create the name of the pod disruption budget to be used by webhook
+*/}}
+{{- define "spark-operator.webhook.podDisruptionBudgetName" -}}
+{{ include "spark-operator.webhook.name" . }}-pdb
+{{- end -}}
+
+{{/*
+Create the role policy rules for the webhook in every Spark job namespace
+*/}}
+{{- define "spark-operator.webhook.policyRules" -}}
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - resourcequotas
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - sparkoperator.k8s.io
+  resources:
+  - sparkapplications
+  - sparkapplications/status
+  - sparkapplications/finalizers
+  - scheduledsparkapplications
+  - scheduledsparkapplications/status
+  - scheduledsparkapplications/finalizers
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+{{- end -}}
@@ -0,0 +1,159 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "spark-operator.webhook.deploymentName" . }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.webhook.replicas }}
+  selector:
+    matchLabels:
+      {{- include "spark-operator.webhook.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "spark-operator.webhook.selectorLabels" . | nindent 8 }}
+      {{- with .Values.webhook.labels }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      containers:
+      - name: spark-operator-webhook
+        image: {{ include "spark-operator.image" . }}
+        {{- with .Values.image.pullPolicy }}
+        imagePullPolicy: {{ . }}
+        {{- end }}
+        args:
+        - webhook
+        - start
+        {{- with .Values.webhook.logLevel }}
+        - --zap-log-level={{ . }}
+        {{- end }}
+        {{- with .Values.spark.jobNamespaces }}
+        {{- if has "" . }}
+        - --namespaces=""
+        {{- else }}
+        - --namespaces={{ . | join "," }}
+        {{- end }}
+        {{- end }}
+        - --webhook-secret-name={{ include "spark-operator.webhook.secretName" . }}
+        - --webhook-secret-namespace={{ .Release.Namespace }}
+        - --webhook-svc-name={{ include "spark-operator.webhook.serviceName" . }}
+        - --webhook-svc-namespace={{ .Release.Namespace }}
+        - --webhook-port={{ .Values.webhook.port }}
+        - --mutating-webhook-name={{ include "spark-operator.webhook.name" . }}
+        - --validating-webhook-name={{ include "spark-operator.webhook.name" . }}
+        {{- with .Values.webhook.resourceQuotaEnforcement.enable }}
+        - --enable-resource-quota-enforcement=true
+        {{- end }}
+        {{- if .Values.prometheus.metrics.enable }}
+        - --enable-metrics=true
+        - --metrics-bind-address=:{{ .Values.prometheus.metrics.port }}
+        - --metrics-endpoint={{ .Values.prometheus.metrics.endpoint }}
+        - --metrics-prefix={{ .Values.prometheus.metrics.prefix }}
+        - --metrics-labels=app_type
+        {{- end }}
+        - --leader-election=true
+        - --leader-election-lock-name={{ include "spark-operator.webhook.leaderElectionName" . }}
+        - --leader-election-lock-namespace={{ .Release.Namespace }}
+        ports:
+        - name: {{ .Values.webhook.portName | quote }}
+          containerPort: {{ .Values.webhook.port }}
+        {{- if .Values.prometheus.metrics.enable }}
+        - name: {{ .Values.prometheus.metrics.portName | quote }}
+          containerPort: {{ .Values.prometheus.metrics.port }}
+        {{- end }}
+        {{- with .Values.webhook.env }}
+        env:
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.webhook.envFrom }}
+        envFrom:
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.webhook.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.webhook.resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            port: 8081
+            scheme: HTTP
+            path: /healthz
+        readinessProbe:
+          httpGet:
+            port: 8081
+            scheme: HTTP
+            path: /readyz
+        {{- with .Values.webhook.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+      {{- with .Values.webhook.sidecars }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webhook.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
+      serviceAccountName: {{ include "spark-operator.webhook.serviceAccountName" . }}
+      {{- with .Values.webhook.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.webhook.topologySpreadConstraints }}
+      {{- if le (int .Values.webhook.replicas) 1 }}
+      {{- fail "webhook.replicas must be greater than 1 to enable topology spread constraints for webhook pods"}}
+      {{- end }}
+      {{- $selectorLabels := include "spark-operator.webhook.selectorLabels" . | fromYaml }}
+      {{- $labelSelectorDict := dict "labelSelector" ( dict "matchLabels" $selectorLabels ) }}
+      topologySpreadConstraints:
+      {{- range .Values.webhook.topologySpreadConstraints }}
+      - {{ mergeOverwrite . $labelSelectorDict | toYaml | nindent 8 | trim }}
+      {{- end }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,124 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ include "spark-operator.webhook.name" . }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+webhooks:
+- name: mutate--v1-pod.sparkoperator.k8s.io
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: {{ include "spark-operator.webhook.serviceName" . }}
+      namespace: {{ .Release.Namespace }}
+      port: {{ .Values.webhook.port }}
+      path: /mutate--v1-pod
+  sideEffects: NoneOnDryRun
+  {{- with .Values.webhook.failurePolicy }}
+  failurePolicy: {{ . }}
+  {{- end }}
+  {{- with .Values.spark.jobNamespaces }}
+  {{- if not (has "" .) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      {{- range $jobNamespace := . }}
+      - {{ $jobNamespace }}
+      {{- end }}
+  {{- end }}
+  {{- end }}
+  objectSelector:
+    matchLabels:
+      sparkoperator.k8s.io/launched-by-spark-operator: "true"
+  rules:
+  - apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+    operations: ["CREATE"]
+  {{- with .Values.webhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+- name: mutate-sparkoperator-k8s-io-v1beta2-sparkapplication.sparkoperator.k8s.io
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: {{ include "spark-operator.webhook.serviceName" . }}
+      namespace: {{ .Release.Namespace }}
+      port: {{ .Values.webhook.port }}
+      path: /mutate-sparkoperator-k8s-io-v1beta2-sparkapplication
+  sideEffects: NoneOnDryRun
+  {{- with .Values.webhook.failurePolicy }}
+  failurePolicy: {{ . }}
+  {{- end }}
+  {{- with .Values.spark.jobNamespaces }}
+  {{- if not (has "" .) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      {{- range $jobNamespace := . }}
+      - {{ $jobNamespace }}
+      {{- end }}
+  {{- end }}
+  {{- end }}
+  rules:
+  - apiGroups: ["sparkoperator.k8s.io"]
+    apiVersions: ["v1beta2"]
+    resources: ["sparkapplications"]
+    operations: ["CREATE", "UPDATE"]
+  {{- with .Values.webhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+- name: mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication.sparkoperator.k8s.io
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: {{ include "spark-operator.webhook.serviceName" . }}
+      namespace: {{ .Release.Namespace }}
+      port: {{ .Values.webhook.port }}
+      path: /mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication
+  sideEffects: NoneOnDryRun
+  {{- with .Values.webhook.failurePolicy }}
+  failurePolicy: {{ . }}
+  {{- end }}
+  {{- with .Values.spark.jobNamespaces }}
+  {{- if not (has "" .) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      {{- range $jobNamespace := . }}
+      - {{ $jobNamespace }}
+      {{- end }}
+  {{- end }}
+  {{- end }}
+  rules:
+  - apiGroups: ["sparkoperator.k8s.io"]
+    apiVersions: ["v1beta2"]
+    resources: ["scheduledsparkapplications"]
+    operations: ["CREATE", "UPDATE"]
+  {{- with .Values.webhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,36 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+{{- if .Values.webhook.podDisruptionBudget.enable }}
+{{- if le (int .Values.webhook.replicas) 1 }}
+{{- fail "webhook.replicas must be greater than 1 to enable pod disruption budget for webhook" }}
+{{- end -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "spark-operator.webhook.podDisruptionBudgetName" . }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spark-operator.webhook.selectorLabels" . | nindent 6 }}
+  {{- with .Values.webhook.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ . }}
+  {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,193 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+{{- if .Values.webhook.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spark-operator.webhook.clusterRoleName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - update
+  - patch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  resourceNames:
+  - {{ include "spark-operator.webhook.name" . }}
+  verbs:
+  - get
+  - update
+{{- if not .Values.spark.jobNamespaces | or (has "" .Values.spark.jobNamespaces) }}
+{{ include "spark-operator.webhook.policyRules" . }}
+{{- end }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "spark-operator.webhook.clusterRoleBindingName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "spark-operator.webhook.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "spark-operator.webhook.clusterRoleName" . }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "spark-operator.webhook.roleName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ include "spark-operator.webhook.secretName" . }}
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - {{ include "spark-operator.webhook.leaderElectionName" . }}
+  verbs:
+  - get
+  - update
+{{- if has .Release.Namespace .Values.spark.jobNamespaces }}
+{{ include "spark-operator.webhook.policyRules" . }}
+{{- end }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "spark-operator.webhook.roleBindingName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "spark-operator.webhook.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "spark-operator.webhook.roleName" . }}
+
+{{- if and .Values.spark.jobNamespaces (not (has "" .Values.spark.jobNamespaces)) }}
+{{- range $jobNamespace := .Values.spark.jobNamespaces }}
+{{- if ne $jobNamespace $.Release.Namespace }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "spark-operator.webhook.roleName" $ }}
+  namespace: {{ $jobNamespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" $ | nindent 4 }}
+  {{- with $.Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+{{ include "spark-operator.webhook.policyRules" $ }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "spark-operator.webhook.roleBindingName" $ }}
+  namespace: {{ $jobNamespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" $ | nindent 4 }}
+  {{- with $.Values.webhook.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "spark-operator.webhook.serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "spark-operator.webhook.roleName" $ }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spark-operator.webhook.serviceName" . }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "spark-operator.webhook.selectorLabels" . | nindent 4 }}
+  ports:
+  - port: {{ .Values.webhook.port }}
+    targetPort: {{ .Values.webhook.portName | quote }}
+    name: {{ .Values.webhook.portName }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+{{- if .Values.webhook.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spark-operator.webhook.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,89 @@
+{{/*
+Copyright 2024 The Kubeflow authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.webhook.enable }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "spark-operator.webhook.name" . }}
+  labels:
+    {{- include "spark-operator.webhook.labels" . | nindent 4 }}
+webhooks:
+- name: validate-sparkoperator-k8s-io-v1beta2-sparkapplication.sparkoperator.k8s.io
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: {{ include "spark-operator.webhook.serviceName" . }}
+      namespace: {{ .Release.Namespace }}
+      port: {{ .Values.webhook.port }}
+      path: /validate-sparkoperator-k8s-io-v1beta2-sparkapplication
+  sideEffects: NoneOnDryRun
+  {{- with .Values.webhook.failurePolicy }}
+  failurePolicy: {{ . }}
+  {{- end }}
+  {{- with .Values.spark.jobNamespaces }}
+  {{- if not (has "" .) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      {{- range $jobNamespace := . }}
+      - {{ $jobNamespace }}
+      {{- end }}
+  {{- end }}
+  {{- end }}
+  rules:
+  - apiGroups: ["sparkoperator.k8s.io"]
+    apiVersions: ["v1beta2"]
+    resources: ["sparkapplications"]
+    operations: ["CREATE", "UPDATE"]
+  {{- with .Values.webhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+- name: validate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication.sparkoperator.k8s.io
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: {{ include "spark-operator.webhook.serviceName" . }}
+      namespace: {{ .Release.Namespace }}
+      port: {{ .Values.webhook.port }}
+      path: /validate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication
+  sideEffects: NoneOnDryRun
+  {{- with .Values.webhook.failurePolicy }}
+  failurePolicy: {{ . }}
+  {{- end }}
+  {{- with .Values.spark.jobNamespaces }}
+  {{- if not (has "" .) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: kubernetes.io/metadata.name
+      operator: In
+      values:
+      {{- range $jobNamespace := . }}
+      - {{ $jobNamespace }}
+      {{- end }}
+  {{- end }}
+  {{- end }}
+  rules:
+  - apiGroups: ["sparkoperator.k8s.io"]
+    apiVersions: ["v1beta2"]
+    resources: ["scheduledsparkapplications"]
+    operations: ["CREATE", "UPDATE"]
+  {{- with .Values.webhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+{{- end }}