Add certwatcher to webhook server

[ggriffiths]

Signed-off-by: Grant Griffiths grant@portworx.com

What type of PR is this?
/kind bug

What this PR does / why we need it:

• Adds the certwatcher implementation from the internal pkg https://github.com/kubernetes-sigs/controller-runtime/blob/master/pkg/webhook/internal/certwatcher/certwatcher.go
• Using github.com/kubernetes-sigs/controller-runtime/pkg/webhook directly is more involved at the moment and would require a breaking change (controller-runtime assumes the Cert/Key files are in the same directory, which external-snapshotter currently does not assume).

Which issue(s) this PR fixes:
Fixes #422

Special notes for your reviewer:
n/a

Does this PR introduce a user-facing change?:

The validation-webhook server will now watch for changes to --tls-cert-file and --tls-private-key-file and update the server's TLS config accordingly.

[xing-yang]

Thanks @ggriffiths! That was quick:)

[xing-yang]

/assign @yuxiangqian

[xing-yang]

/assign

[xing-yang]

@ggriffiths Can you do some manual testing and simulate a cert rotation?

[ggriffiths]

Yes I'll give that a shot.
/hold

[ggriffiths]

Tested this with valid and invalid certs @xing-yang. The valid cert was rotated and refreshed in memory. The invalid cert caused problems without a pod restart, as expected.

Valid cert rotation:

1. attempted to create invalid snapshot, correctly denied

[grant@PDC4-SM26-N8 external-snapshotter]$ date
Tue Dec  1 15:32:50 PST 2020
[grant@PDC4-SM26-N8 external-snapshotter]$ kubectl create -f ./examples/kubernetes/invalid-snapshot.yaml
Error from server: error when creating "./examples/kubernetes/invalid-snapshot.yaml": admission webhook "validation-webhook.snapshot.storage.k8s.io" denied the request: only one of Spec.Source.PersistentVolumeClaimName = pvc and Spec.Source.VolumeSnapshotContentName = vsc should be set

2. Re-generated the cert

[grant@PDC4-SM26-N8 external-snapshotter]$ ./deploy/kubernetes/webhook-example/create-cert.sh --service snapshot-validation-service --secret snapshot-validation-secret --namespace kube-system
creating certs in tmpdir /tmp/tmp.9eOHCqeCsm 
Generating RSA private key, 2048 bit long modulus
...........................................................+++
..........................+++
e is 65537 (0x10001)
certificatesigningrequest.certificates.k8s.io "snapshot-validation-service.kube-system" deleted
certificatesigningrequest.certificates.k8s.io/snapshot-validation-service.kube-system created
NAME                                      AGE   REQUESTOR          CONDITION
snapshot-validation-service.kube-system   0s    kubernetes-admin   Pending
certificatesigningrequest.certificates.k8s.io/snapshot-validation-service.kube-system approved
secret/snapshot-validation-secret configured
[grant@PDC4-SM26-N8 external-snapshotter]$ date
Tue Dec  1 15:33:14 PST 2020

3. TLS certificate updated in the validation pod
   I1201 23:33:20.251368 1 certwatcher.go:129] Updated current TLS certificate

4. Validation webhook still works

[grant@PDC4-SM26-N8 external-snapshotter]$ kubectl create -f ./examples/kubernetes/invalid-snapshot.yaml
Error from server: error when creating "./examples/kubernetes/invalid-snapshot.yaml": admission webhook "validation-webhook.snapshot.storage.k8s.io" denied the request: only one of Spec.Source.PersistentVolumeClaimName = pvc and Spec.Source.VolumeSnapshotContentName = vsc should be set

Performed a similar flow above with an invalid cert and saw the below error, as expected.

[grant@PDC4-SM26-N8 external-snapshotter]$ kk apply -f examples/kubernetes/invalid-snapshot.yaml 
Error from server (InternalError): error when creating "examples/kubernetes/invalid-snapshot.yaml": Internal error occurred: failed calling webhook "validation-webhook.snapshot.storage.k8s.io": Post https://snapshot-validation-service.kube-system.svc:443/volumesnapshot?timeout=2s: x509: certificate has expired or is not yet vali

[ggriffiths]

/hold cancel

[xing-yang]

Thanks @ggriffiths!

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ggriffiths, xing-yang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [xing-yang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment