Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Webhook certs patch 1 #2739

Merged
merged 4 commits into from
Jan 5, 2024
+12 −6
Merged

Webhook certs patch 1 #2739

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8713dfb
Workaround for very short webhook certs.
omniproc Jan 3, 2024
d96c650
Workaround for very short webhook certs.
omniproc Jan 3, 2024
a366000
Fix ShellCheck SC2004
omniproc Jan 5, 2024
e4b7ebf
Fix ShellCheck SC2004
omniproc Jan 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 6 additions & 3 deletions manifests/vanilla/deploy-csi-snapshot-components.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,10 +197,13 @@ deploy_validation_webhook() {
DNS.3 = ${service}.${namespace}.svc
EOF

openssl req -nodes -new -x509 -keyout "${tmpdir}"/ca.key -out "${tmpdir}"/ca.crt -subj "/CN=vSphere CSI Admission Controller Webhook CA"
# Default webhook server and ca certificate validity
validity=180

openssl req -nodes -new -x509 -keyout "${tmpdir}"/ca.key -days ${validity} -out "${tmpdir}"/ca.crt -subj "/CN=vSphere CSI Admission Controller Webhook CA"
openssl genrsa -out "${tmpdir}"/webhook-server-tls.key 2048
openssl req -new -key "${tmpdir}"/webhook-server-tls.key -subj "/CN=${service}.${namespace}.svc" -config "${tmpdir}"/server.conf \
| openssl x509 -req -CA "${tmpdir}"/ca.crt -CAkey "${tmpdir}"/ca.key -days 180 -CAcreateserial -out "${tmpdir}"/webhook-server-tls.crt -extensions v3_req -extfile "${tmpdir}"/server.conf
| openssl x509 -req -CA "${tmpdir}"/ca.crt -CAkey "${tmpdir}"/ca.key -days $((validity-1)) -CAcreateserial -out "${tmpdir}"/webhook-server-tls.crt -extensions v3_req -extfile "${tmpdir}"/server.conf
cat <<EOF >"${tmpdir}"/webhook.config
[WebHookConfig]
port = "8443"
Expand Down Expand Up @@ -322,4 +325,4 @@ else
fi

# Check if vSphere CSI Driver has the snapshotter sidecar, if not patch the deployment
check_snapshotter_sidecar
check_snapshotter_sidecar
9 changes: 6 additions & 3 deletions manifests/vanilla/deploy-vsphere-csi-validation-webhook.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,14 @@ DNS.2 = ${service}.${namespace}
DNS.3 = ${service}.${namespace}.svc
EOF

# Default webhook server and ca certificate validity
validity=180

# Generate the CA cert and private key
openssl req -nodes -new -x509 -keyout "${tmpdir}"/ca.key -out "${tmpdir}"/ca.crt -subj "/CN=vSphere CSI Admission Controller Webhook CA"
openssl req -nodes -new -x509 -keyout "${tmpdir}"/ca.key -days ${validity} -out "${tmpdir}"/ca.crt -subj "/CN=vSphere CSI Admission Controller Webhook CA"
openssl genrsa -out "${tmpdir}"/webhook-server-tls.key 2048
openssl req -new -key "${tmpdir}"/webhook-server-tls.key -subj "/CN=${service}.${namespace}.svc" -config "${tmpdir}"/server.conf \
| openssl x509 -req -CA "${tmpdir}"/ca.crt -CAkey "${tmpdir}"/ca.key -days 180 -CAcreateserial -out "${tmpdir}"/webhook-server-tls.crt -extensions v3_req -extfile "${tmpdir}"/server.conf
| openssl x509 -req -CA "${tmpdir}"/ca.crt -CAkey "${tmpdir}"/ca.key -days $((validity-1)) -CAcreateserial -out "${tmpdir}"/webhook-server-tls.crt -extensions v3_req -extfile "${tmpdir}"/server.conf

cat <<eof >"${tmpdir}"/webhook.config
[WebHookConfig]
Expand Down Expand Up @@ -114,4 +117,4 @@ kubectl delete clusterrolebinding.rbac.authorization.k8s.io vsphere-csi-webhook-
kubectl delete deployment vsphere-csi-webhook --namespace "${namespace}" 2>/dev/null || true

# patch validatingwebhook.yaml with CA_BUNDLE and create service and validatingwebhookconfiguration
sed "s/caBundle: .*$/caBundle: ${CA_BUNDLE}/g" <validatingwebhook.yaml | kubectl apply -f -
sed "s/caBundle: .*$/caBundle: ${CA_BUNDLE}/g" <validatingwebhook.yaml | kubectl apply -f -