Simpler, more reliable webhook TLS via a cert-manager CSI mount

[scotwells]

Value

Operators get a simpler, more reliable webhook TLS setup. Webhook serving certificates are now mounted directly from a cert-manager CSI volume, which means:

• No standalone, cluster-scoped Certificate resource to reconcile, and no cainjection / inject-ca-from wiring on the webhook configurations for production.
• No dependency on the cert-manager controller having reconciled a Certificate before the manager can serve — Milo trusts the configured issuer directly, so the CA bundle no longer has to be injected into each webhook config.
• Certificate rotation is handled inline by the CSI driver at mount time — fewer moving parts.

This is a config-only change with no behavioral change to the webhook itself.

What

• Remove the config/base/certmanager base (Issuer/Certificate, name-reference config, CA-injection replacements).
• Add a generic config/components/csi-webhook-cert component that mounts the webhook-server-tls CSI volume on the manager Deployment. The issuer is intentionally left unset — each consuming overlay (or the infra repo) patches csi.cert-manager.io/issuer-kind / issuer-name for its environment, so different environments can use different issuers without forking the component.
• Drop the optional compute-webhook-cert Secret volume/mount from the base manager Deployment.
• single-cluster overlay: drop the certmanager base, the cainjection patch, and the dnsName/CA replacement blocks; wire in the csi-webhook-cert component.
• dev overlay: keep an inline self-signed Issuer + Certificate for the local host.docker.internal webhook (the dev kind/docker setup has no CSI driver) and annotate the webhook configs with inject-ca-from directly.

Verification

kustomize build passes for config/overlays/single-cluster, config/overlays/dev, and config/base/manager. Rendered single-cluster output wires webhook TLS via the CSI webhook-server-tls volume with no remaining Certificate / cainjection.

Coordination notes

• This re-authors, against main, the webhook-TLS refactor that also lives in feat: route workloads to city locations via distributed scheduling (foundation) #107. It de-duplicates the same refactor in feat: datumctl compute plugin — deploy and manage workloads from the CLI #113 — only one should land; landing this standalone lets both feat: route workloads to city locations via distributed scheduling (foundation) #107 and feat: datumctl compute plugin — deploy and manage workloads from the CLI #113 drop their copy on rebase.
• Production overlays must supply the issuer (csi.cert-manager.io/issuer-kind / issuer-name); for this repo that is expected to come from the infra repo (there is no management-plane overlay on main).

🤖 Generated with Claude Code