Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhancement: Use self-signed certs for webhook server #80

Closed
senthilrch opened this issue Jul 21, 2021 · 0 comments · Fixed by #81
Closed

Enhancement: Use self-signed certs for webhook server #80

senthilrch opened this issue Jul 21, 2021 · 0 comments · Fixed by #81
Assignees
Labels
enhancement Enhancement to existing feature
Milestone

Comments

@senthilrch
Copy link
Owner

Kube-fledged installation currently relies on Kubernetes CertificateSigningRequest to generate the server certificate for the webhook server. This creates problems:-

  • The stable v1 version of CertificateSigningRequest doesn't supports signer kubernetes/legacy-unknown
  • The supported in-built signers are not usable to generate a server certificate. There's support only for client certificates
  • On clusters that have only v1 enabled, it is impossible to generate server certificate.
  • Bash script is used to generate certificate, so installing via GitOps (e.g. ArgoCD) is not fully supported.
  • Ref issue Deployment using the Operator 0.8.0 #75 , issue Deployment via Helm chart fail #76

The solution is to generate self-signed certificate for the webhook server and add the CA bundle to the validatingwebhookconfiguration, using init container or as init method within the webhook server.

@senthilrch senthilrch added the enhancement Enhancement to existing feature label Jul 21, 2021
@senthilrch senthilrch added this to the v0.8.1 milestone Jul 21, 2021
@senthilrch senthilrch self-assigned this Jul 21, 2021
@senthilrch senthilrch linked a pull request Jul 23, 2021 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Enhancement to existing feature
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant