[internal] Switch to go hooks and images build refactoring

.github/workflows/deploy_dev.yml

@@ -66,5 +66,5 @@ jobs:
         with:
           module_source: "${{ vars.DEV_MODULE_SOURCE }}"
           module_name: ${{ vars.MODULE_NAME }}
-          module_tag: $(echo pr${{ github.ref_name }} | sed 's/\/.*//g')
+          module_tag: $(echo ${{ github.ref_name }} | sed 's/\/.*//g')
       - uses: deckhouse/modules-actions/deploy@v2

.golangci.yaml

@@ -13,31 +13,27 @@ linters-settings:
     sections:
       - standard
       - default
-      - prefix(d8-controller)
-      - prefix(webhooks)
-
+      - prefix(github.com/deckhouse)
 
   errcheck:
     ignore: fmt:.*,[rR]ead|[wW]rite|[cC]lose,io:Copy
 
 linters:
   disable-all: true
   enable:
-  - dogsled
-  - errcheck
-  - gci
-  - gocritic
-  - gofmt
-# - goimports
-  - gosimple
-  - govet
-  - ineffassign
-  - misspell
-  - revive
-  - staticcheck
-#  - structcheck
-  - typecheck
-  - unconvert
-  - unparam
-  - whitespace
-  - copyloopvar
+    - dogsled
+    - errcheck
+    - gci
+    - gocritic
+    - gofmt
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - typecheck
+    - unconvert
+    - unparam
+    - whitespace
+    - copyloopvar

api/go.mod

@@ -1,8 +1,6 @@
 module github.com/deckhouse/csi-ceph/api
 
-go 1.23.0
-
-toolchain go1.23.6
+go 1.23.6
 
 require k8s.io/apimachinery v0.32.3
 

hooks/go/020-webhook-certs/webhook-certs.go

@@ -0,0 +1,22 @@
+package hooks_common
+
+import (
+	"fmt"
+
+	consts "github.com/deckhouse/csi-ceph/hooks/go/consts"
+	tlscertificate "github.com/deckhouse/module-sdk/common-hooks/tls-certificate"
+)
+
+var _ = tlscertificate.RegisterInternalTLSHookEM(tlscertificate.GenSelfSignedTLSHookConf{
+	CN:            consts.WebhookCertCn,
+	TLSSecretName: fmt.Sprintf("%s-webhook-cert", consts.WebhookCertCn),
+	Namespace:     consts.ModuleNamespace,
+	SANs: tlscertificate.DefaultSANs([]string{
+		consts.WebhookCertCn,
+		fmt.Sprintf("%s.%s", consts.WebhookCertCn, consts.ModuleNamespace),
+		fmt.Sprintf("%s.%s.svc", consts.WebhookCertCn, consts.ModuleNamespace),
+		// %CLUSTER_DOMAIN%:// is a special value to generate SAN like 'svc_name.svc_namespace.svc.cluster.local'
+		fmt.Sprintf("%%CLUSTER_DOMAIN%%://%s.%s.svc", consts.WebhookCertCn, consts.ModuleNamespace),
+	}),
+	FullValuesPathPrefix: fmt.Sprintf("%s.internal.customWebhookCert", consts.ModuleName),
+})

hooks/go/030-remove-sc-and-secrets-on-module-delete/remove-sc-and-secrets-on-module-delete.go

@@ -0,0 +1,117 @@
+package hooks_common
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	snapv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
+	storagev1 "k8s.io/api/storage/v1"
+	sv1 "k8s.io/api/storage/v1"
+	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/hooks/go/consts"
+	"github.com/deckhouse/module-sdk/pkg"
+	"github.com/deckhouse/module-sdk/pkg/registry"
+	"github.com/deckhouse/sds-common-lib/kubeclient"
+)
+
+
+func removeFinalizers(ctx context.Context, cl client.Client, obj client.Object, logger pkg.Logger) error {
+	logger.Info(fmt.Sprintf("[remove-sc-and-secrets-on-module-delete]: Removing finalizers from %s %s\n", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName()))
+
+	patch := client.MergeFrom(obj.DeepCopyObject().(client.Object))
+	obj.SetFinalizers(nil)
+
+	if err := cl.Patch(ctx, obj, patch); err != nil {
+		return fmt.Errorf("failed to patch %s %s: %w", obj.GetObjectKind().GroupVersionKind().Kind, obj.GetName(), err)
+	}
+	return nil
+}
+
+var _ = registry.RegisterFunc(configRemoveScAndSecretsOnModuleDelete, handlerRemoveScAndSecretsOnModuleDelete)
+
+var configRemoveScAndSecretsOnModuleDelete = &pkg.HookConfig{
+	OnAfterDeleteHelm: &pkg.OrderedConfig{Order: 10},
+}
+
+func handlerRemoveScAndSecretsOnModuleDelete(ctx context.Context, input *pkg.HookInput) error {
+	input.Logger.Info("[remove-sc-and-secrets-on-module-delete]: Started removing SC and Secrets on module delete")
+	var resultErr error
+
+	cl, err := kubeclient.New("",
+		v1alpha1.AddToScheme,
+		clientgoscheme.AddToScheme,
+		extv1.AddToScheme,
+		v1.AddToScheme,
+		sv1.AddToScheme,
+		snapv1.AddToScheme)
+	if err != nil {
+		return fmt.Errorf("failed to initialize kube client: %w", err)
+	}
+
+	secretList := &corev1.SecretList{}
+	if err := cl.List(ctx, secretList, client.InNamespace(consts.ModuleNamespace)); err != nil {
+		resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: failed to list secrets: %w", err))
+		return resultErr
+	}
+
+	for _, secret := range secretList.Items {
+		input.Logger.Info(fmt.Sprintf("[remove-sc-and-secrets-on-module-delete]: Removing finalizers from %s secret\n", secret.Name))
+
+		if err := removeFinalizers(ctx, cl, &secret, input.Logger); err != nil {
+			resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: failed to patch secret %s: %w", secret.Name, err))
+			continue
+		}
+	}
+
+	configMapList := &corev1.ConfigMapList{}
+	if err := cl.List(ctx, configMapList, client.InNamespace(consts.ModuleNamespace)); err != nil {
+		return errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: failed to list configmaps: %w", err))
+	}
+
+	for _, configMap := range configMapList.Items {
+		input.Logger.Info(fmt.Sprintf("[remove-sc-and-secrets-on-module-delete]: Removing finalizers from %s configmap\n", configMap.Name))
+
+		if err := removeFinalizers(ctx, cl, &configMap, input.Logger); err != nil {
+			resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: Failed to patch configmap %s: %w", configMap.Name, err))
+			continue
+		}
+	}
+
+	for _, provisioner := range consts.AllowedProvisioners {
+		scList := &storagev1.StorageClassList{}
+		if err := cl.List(ctx, scList); err != nil {
+			resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: Failed to list storage classes: %w", err))
+			return resultErr
+		}
+
+		for _, sc := range scList.Items {
+			if sc.Provisioner != provisioner {
+				continue
+			}
+			input.Logger.Info(fmt.Sprintf("[remove-sc-and-secrets-on-module-delete]: Removing finalizers from %s storage class\n", sc.Name))
+
+			if err := removeFinalizers(ctx, cl, &sc, input.Logger); err != nil {
+				resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: Failed to patch storage class %s: %w", sc.Name, err))
+				continue
+			}
+
+			input.Logger.Info(fmt.Sprintf("[remove-sc-and-secrets-on-module-delete]: Removing %s storage class\n", sc.Name))
+			if err := cl.Delete(ctx, &sc); err != nil {
+				resultErr = errors.Join(resultErr, fmt.Errorf("[remove-sc-and-secrets-on-module-delete]: Failed to delete storage class %s: %w", sc.Name, err))
+				continue
+			}
+		}
+	}
+
+	input.Logger.Info("[remove-sc-and-secrets-on-module-delete]: Stoped removing SC, ConfigMaps and Secrets on module delete\n")
+
+	return resultErr
+}
+

hooks/go/060-migrate-from-ceph-csi-module/migrate-from-ceph-csi-module.go

@@ -6,17 +6,17 @@ import (
 	"strings"
 	"time"
 
-	"github.com/deckhouse/csi-ceph/api/v1alpha1"
-	"github.com/deckhouse/module-sdk/pkg"
-	"github.com/deckhouse/module-sdk/pkg/registry"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	oldApi "csi-ceph/api/v1alpha1"
-	funcs "csi-ceph/funcs"
+	"github.com/deckhouse/csi-ceph/api/v1alpha1"
+	oldApi "github.com/deckhouse/csi-ceph/hooks/go/api/v1alpha1"
+	funcs "github.com/deckhouse/csi-ceph/hooks/go/funcs"
+	"github.com/deckhouse/module-sdk/pkg"
+	"github.com/deckhouse/module-sdk/pkg/registry"
 )
 
 const (

hooks/go/consts/consts.go

@@ -1,6 +1,12 @@
 package consts
 
 const (
-	MODULE_NAME      string = "csiCeph"
-	MODULE_NAMESPACE string = "d8-csi-ceph"
+	ModuleName      string = "csiCeph"
+	ModuleNamespace string = "d8-csi-ceph"
+	WebhookCertCn   string = "webhooks"
 )
+
+var AllowedProvisioners = []string{
+	"rbd.csi.ceph.com",
+	"cephfs.csi.ceph.com",
+}

hooks/go/funcs/funcs.go

@@ -9,9 +9,6 @@ import (
 	"strings"
 	"time"
 
-	oldApi "csi-ceph/api/v1alpha1"
-
-	"github.com/deckhouse/csi-ceph/api/v1alpha1"
 	"github.com/google/go-cmp/cmp"
 	snapv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	appsv1 "k8s.io/api/apps/v1"
@@ -30,6 +27,9 @@ import (
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+
+	"github.com/deckhouse/csi-ceph/api/v1alpha1"
+	oldApi "github.com/deckhouse/csi-ceph/hooks/go/api/v1alpha1"
 )
 
 const (

hooks/go/go.mod

@@ -1,24 +1,26 @@
-module csi-ceph
+module github.com/deckhouse/csi-ceph/hooks/go
 
 go 1.23.6
 
 require (
-	github.com/deckhouse/csi-ceph/api v0.0.0-20250314071238-6a7df30c52cc
+	github.com/deckhouse/csi-ceph/api v0.0.0-20250207141553-9b2c9a45ba22
 	github.com/deckhouse/module-sdk v0.2.0
+	github.com/deckhouse/sds-common-lib v0.0.0-20250331104837-4ed70c9f1a83
 	github.com/google/go-cmp v0.7.0
 	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.2.0
 	k8s.io/api v0.32.3
-	k8s.io/apiextensions-apiserver v0.32.3
+	k8s.io/apiextensions-apiserver v0.32.2
 	k8s.io/apimachinery v0.32.3
 	k8s.io/client-go v0.32.3
-	sigs.k8s.io/controller-runtime v0.20.3
+	sigs.k8s.io/controller-runtime v0.20.4
 )
 
 require (
 	github.com/DataDog/gostackparse v0.7.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/caarlos0/env/v11 v11.3.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/cfssl v1.6.5 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/deckhouse/deckhouse/pkg/log v0.0.0-20250320042525-77d066cf8f00 // indirect
@@ -38,11 +40,13 @@ require (
 	github.com/gojuno/minimock/v3 v3.4.5 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
+	github.com/google/certificate-transparency-go v1.1.7 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-containerregistry v0.20.3 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jmoiron/sqlx v1.3.5 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -53,7 +57,8 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/pelletier/go-toml v1.9.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.21.1 // indirect
@@ -68,15 +73,19 @@ require (
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/weppos/publicsuffix-go v0.30.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/zmap/zcrypto v0.0.0-20230310154051-c8b263fd8300 // indirect
+	github.com/zmap/zlint/v3 v3.5.0 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
 	golang.org/x/net v0.37.0 // indirect
-	golang.org/x/oauth2 v0.28.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
 	golang.org/x/sync v0.12.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/term v0.30.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	golang.org/x/time v0.10.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

hooks/go/main.go

@@ -1,10 +1,10 @@
 package main
 
 import (
+	_ "github.com/deckhouse/csi-ceph/hooks/go/020-webhook-certs"
+	_ "github.com/deckhouse/csi-ceph/hooks/go/030-remove-sc-and-secrets-on-module-delete"
+	_ "github.com/deckhouse/csi-ceph/hooks/go/060-migrate-from-ceph-csi-module"
 	"github.com/deckhouse/module-sdk/pkg/app"
-
-	_ "csi-ceph/060-migrate-from-ceph-csi-module"
-	_ "csi-ceph/070-remove-finalizers-on-module-delete"
 )
 
 func main() {

images/controller/src/cmd/main.go → images/controller/cmd/main.go

@@ -22,23 +22,22 @@ import (
 	"os"
 	goruntime "runtime"
 
-	"github.com/deckhouse/csi-ceph/api/v1alpha1"
 	snapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	v1 "k8s.io/api/core/v1"
 	sv1 "k8s.io/api/storage/v1"
 	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-
 	"k8s.io/apimachinery/pkg/runtime"
 	apiruntime "k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 
-	"d8-controller/pkg/config"
-	"d8-controller/pkg/controller"
-	"d8-controller/pkg/kubutils"
-	"d8-controller/pkg/logger"
+	"github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/config"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/controller"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/kubutils"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 var (

images/controller/src/go.mod → images/controller/go.mod

@@ -1,4 +1,4 @@
-module d8-controller
+module github.com/deckhouse/csi-ceph/images/controller
 
 go 1.23.6
 
@@ -17,7 +17,7 @@ require (
 	sigs.k8s.io/controller-runtime v0.20.3
 )
 
-replace github.com/deckhouse/csi-ceph/api => ../../../api
+replace github.com/deckhouse/csi-ceph/api => ../../api
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect

images/controller/src/pkg/config/config.go → images/controller/pkg/config/config.go

@@ -18,7 +18,7 @@ import (
 	"os"
 	"time"
 
-	"d8-controller/pkg/logger"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 const (

images/controller/src/pkg/controller/ceph_cluster_authentication_watcher.go → images/controller/pkg/controller/ceph_cluster_authentication_watcher.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	k8serr "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/workqueue"
@@ -32,8 +31,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
-	"d8-controller/pkg/config"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/config"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 const (

images/controller/src/pkg/controller/ceph_cluster_connection_watcher.go → images/controller/pkg/controller/ceph_cluster_connection_watcher.go

@@ -22,7 +22,6 @@ import (
 	"reflect"
 	"time"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	k8serr "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
@@ -35,9 +34,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
-	"d8-controller/pkg/config"
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/config"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 const (

images/controller/src/pkg/controller/ceph_cluster_connection_watcher_func.go → images/controller/pkg/controller/ceph_cluster_connection_watcher_func.go

@@ -25,13 +25,13 @@ import (
 	"slices"
 	"strings"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 func validateCephClusterConnectionSpec(cephClusterConnection *v1alpha1.CephClusterConnection) (bool, string) {

images/controller/src/pkg/controller/ceph_cluster_connection_watcher_test.go → images/controller/pkg/controller/ceph_cluster_connection_watcher_test.go

@@ -20,17 +20,17 @@ import (
 	"context"
 	"encoding/json"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"d8-controller/pkg/controller"
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/controller"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 var _ = Describe(controller.CephClusterConnectionCtrlName, func() {

images/controller/src/pkg/controller/ceph_storage_class_watcher.go → images/controller/pkg/controller/ceph_storage_class_watcher.go

@@ -22,7 +22,6 @@ import (
 	"reflect"
 	"time"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	snapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	v1 "k8s.io/api/storage/v1"
 	k8serr "k8s.io/apimachinery/pkg/api/errors"
@@ -36,9 +35,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
-	"d8-controller/pkg/config"
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/config"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 const (

images/controller/src/pkg/controller/ceph_storage_class_watcher_func.go → images/controller/pkg/controller/ceph_storage_class_watcher_func.go

@@ -22,7 +22,6 @@ import (
 	"slices"
 	"strings"
 
-	storagev1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	"github.com/google/go-cmp/cmp"
 	snapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -31,8 +30,9 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	storagev1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 var (

images/controller/src/pkg/controller/ceph_storage_class_watcher_test.go → images/controller/pkg/controller/ceph_storage_class_watcher_test.go

@@ -19,7 +19,6 @@ package controller_test
 import (
 	"context"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	snapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -29,9 +28,10 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"d8-controller/pkg/controller"
-	"d8-controller/pkg/internal"
-	"d8-controller/pkg/logger"
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/controller"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/internal"
+	"github.com/deckhouse/csi-ceph/images/controller/pkg/logger"
 )
 
 var _ = Describe(controller.CephStorageClassCtrlName, func() {

images/controller/src/pkg/controller/controller_suite_test.go → images/controller/pkg/controller/controller_suite_test.go

@@ -21,7 +21,6 @@ import (
 	"os"
 	"testing"
 
-	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 	snapshotv1 "github.com/kubernetes-csi/external-snapshotter/client/v8/apis/volumesnapshot/v1"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -32,6 +31,8 @@ import (
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	v1alpha1 "github.com/deckhouse/csi-ceph/api/v1alpha1"
 )
 
 func TestController(t *testing.T) {

images/controller/werf.inc.yaml

@@ -1,16 +1,23 @@
 ---
 image: {{ $.ImageName }}-src-artifact
-from: {{ $.Root.BASE_ALT }}
+from: {{ $.Root.BASE_ALT_P11 }}
 final: false
+
 git:
   - add: /
     to: /src
     includePaths:
       - api
-      - images/controller/src
+      - images/{{ $.ImageName }}
     stageDependencies:
       install:
         - '**/*'
+    excludePaths:
+      - images/{{ $.ImageName }}/werf.yaml
+
+shell:
+  install:
+    - echo "src artifact"
 
 ---
 image: {{ $.ImageName }}-golang-artifact
@@ -21,17 +28,17 @@ import:
   - image: {{ $.ImageName }}-src-artifact
     add: /src
     to: /src
-    before: setup
+    before: install
 
 mount:
   - fromPath: ~/go-pkg-cache
     to: /go/pkg
 
 shell:
   setup:
-    - cd /src/images/controller/src/cmd
-    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o /controller
-    - chmod +x /controller
+    - cd /src/images/{{ $.ImageName }}/cmd
+    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o /{{ $.ImageName }}
+    - chmod +x /{{ $.ImageName }}
 
 ---
 image: {{ $.ImageName }}-distroless-artifact
@@ -70,10 +77,10 @@ fromImage: {{ $.ImageName }}-distroless
 
 import:
   - image: {{ $.ImageName }}-golang-artifact
-    add: /controller
-    to: /controller
+    add: /{{ $.ImageName }}
+    to: /{{ $.ImageName }}
     before: setup
 
 docker:
-  ENTRYPOINT: ["/controller"]
+  ENTRYPOINT: ["/{{ $.ImageName }}"]
   USER: deckhouse:deckhouse

images/webhooks/src/cmd/main.go → images/webhooks/cmd/main.go

@@ -26,7 +26,7 @@ import (
 	kwhlogrus "github.com/slok/kubewebhook/v2/pkg/log/logrus"
 	storagev1 "k8s.io/api/storage/v1"
 
-	"webhooks/handlers"
+	"github.com/deckhouse/csi-ceph/images/webhooks/handlers"
 )
 
 type config struct {

images/webhooks/src/go.mod → images/webhooks/go.mod

@@ -1,4 +1,4 @@
-module webhooks
+module github.com/deckhouse/csi-ceph/images/webhooks
 
 go 1.23.6
 

images/webhooks/werf.inc.yaml

@@ -1,16 +1,23 @@
 ---
 image: {{ $.ImageName }}-src-artifact
-from: {{ $.Root.BASE_ALT }}
+from: {{ $.Root.BASE_ALT_P11 }}
 final: false
+
 git:
   - add: /
     to: /src
     includePaths:
       - api
-      - images/webhooks/src
+      - images/{{ $.ImageName }}
     stageDependencies:
       install:
         - '**/*'
+    excludePaths:
+      - images/{{ $.ImageName }}/werf.yaml
+
+shell:
+  install:
+    - echo "src artifact"
 
 ---
 image: {{ $.ImageName }}-golang-artifact
@@ -21,17 +28,17 @@ import:
   - image: {{ $.ImageName }}-src-artifact
     add: /src
     to: /src
-    before: setup
+    before: install
 
 mount:
   - fromPath: ~/go-pkg-cache
     to: /go/pkg
 
 shell:
   setup:
-    - cd /src/images/webhooks/src/cmd
-    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o /webhooks
-    - chmod +x /webhooks
+    - cd /src/images/{{ $.ImageName }}/cmd
+    - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o /{{ $.ImageName }}
+    - chmod +x /{{ $.ImageName }}
 
 ---
 image: {{ $.ImageName }}-distroless-artifact
@@ -70,10 +77,10 @@ fromImage: {{ $.ImageName }}-distroless
 
 import:
   - image: {{ $.ImageName }}-golang-artifact
-    add: /webhooks
-    to: /webhooks
+    add: /{{ $.ImageName }}
+    to: /{{ $.ImageName }}
     before: setup
 
 docker:
-  ENTRYPOINT: ["/webhooks"]
+  ENTRYPOINT: ["/{{ $.ImageName }}"]
   USER: deckhouse:deckhouse

module.yaml

@@ -1,2 +1,3 @@
+name: csi-ceph
 weight: 920
 description: "CSI Ceph"

templates/webhooks/deployment.yaml

@@ -41,6 +41,8 @@ spec:
       app: webhooks
   template:
     metadata:
+      annotations:
+        checksum/ca: {{ .Values.csiCeph.internal.customWebhookCert.ca | sha256sum | quote }}
       labels:
         app: webhooks
     spec:

templates/webhooks/secret.yaml

@@ -7,6 +7,6 @@ metadata:
   {{- include "helm_lib_module_labels" (list . (dict "app" "webhooks")) | nindent 2 }}
 type: kubernetes.io/tls
 data:
-  ca.crt: {{ .Values.csiCeph.internal.customWebhookCert.ca }}
-  tls.crt: {{ .Values.csiCeph.internal.customWebhookCert.crt }}
-  tls.key: {{ .Values.csiCeph.internal.customWebhookCert.key }}
+  ca.crt: {{ .Values.csiCeph.internal.customWebhookCert.ca | b64enc | quote }}
+  tls.crt: {{ .Values.csiCeph.internal.customWebhookCert.crt | b64enc | quote }}
+  tls.key: {{ .Values.csiCeph.internal.customWebhookCert.key | b64enc | quote }}

templates/webhooks/webhook.yaml

@@ -16,8 +16,7 @@ webhooks:
         namespace: "d8-{{ .Chart.Name }}"
         name: "webhooks"
         path: "/sc-validate"
-      caBundle: |
-        {{ .Values.csiCeph.internal.customWebhookCert.ca }}
+      caBundle: {{ .Values.csiCeph.internal.customWebhookCert.ca | b64enc | quote }}
     admissionReviewVersions: ["v1", "v1beta1"]
     sideEffects: None
     timeoutSeconds: 5