(M) - As a k8s Webhook developer, I need a WebHook Cert Provisioner pkg which can dynamically provision certs for my webhook.

[grodrigues3]

Story: I need a way to get Certificates for my webserver that are written to the webhookConfiguration and secrets.

[munnerz]

I have done some work on this using cert-manager, a PR is here: cert-manager/cert-manager#478

It is more complex in that PR ^ as I also perform some bootstrapping so that cert-manager can secure it's own webhook endpoints.

In short, you should be able to:

1. Generate a CA using openssl (this is until cert-manager supports a 'self signed' Issuer type, which should be very soon) (this can also be done within a helm chart in the meantime)

2. Create a secret containing the CA generated in (1)

3. Create a cert-manager CA Issuer that uses the secret created in (2)

4. Create a cert-manager Certificate resource for your webhook (i.e. a Certificate that specifies the appropriate dnsNames for your webhook). Set the issuerRef to the name of the Issuer you created in (3)

5. Create your ValidatingWebhookConfiguration caBundle field to the CA certificate generated in (1) and configure it like normal.

You can then configure the Deployment for your webhook to mount in the Secret created by cert-manager (i.e. the one named in certificate.spec.secretName).

I have also put this small project together which helps copying a Secret resource into a Validating/Mutating webhook configuration or APIService resource's caBundle field - it is not required in order to follow the above steps, but it will be required if you want to use the to be created 'selfsigned' Issuer type to replace step (1) above: https://github.com/munnerz/apiextensions-ca-helper

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale