Enable CA injection from an existing webhook secret (#2721)

Signed-off-by: Leonardo M. Miranda <leonardomichalskim@gmail.com>

deploy/charts/external-secrets/README.md

@@ -148,10 +148,9 @@ The command removes all the Kubernetes components associated with the chart and
 | serviceMonitor.scrapeTimeout | string | `"25s"` | Timeout if metrics can't be retrieved in given time interval |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
+| webhook.addCustomCertSecretInjectorAnnotations | bool | `false` | Although webhook.certManager may be disabled, cert-manager still needs to be installed (and this chart does not install it for you). "cert-manager" is used to inject the caBundle into Kind=CustomResourceDefinition for conversion webhooks and Kind=ValidatingWebhookConfiguration for validating admission webhook. The Secret resource MUST have an `cert-manager.io/allow-direct-injection: "true"` annotation. |
 | webhook.affinity | object | `{}` |  |
 | webhook.certCheckInterval | string | `"5m"` | Specifices the time to check if the cert is valid |
-| webhook.certSecretNameOverride | string | `""` | If its value is different from the default one, it overrides the name of the secret resource where the webhook certificates are stored. |
-| webhook.createWebhookSecret | bool | `true` | Whether to create the webhook secret resource (doesn't interfere with `webhook.certManager.cert.create`). |
 | webhook.certDir | string | `"/tmp/certs"` |  |
 | webhook.certManager.addInjectorAnnotations | bool | `true` | Automatically add the cert-manager.io/inject-ca-from annotation to the webhooks and CRDs. As long as you have the cert-manager CA Injector enabled, this will automatically setup your webhook's CA to the one used by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector |
 | webhook.certManager.cert.annotations | object | `{}` | Add extra annotations to the Certificate resource. |
@@ -160,7 +159,9 @@ The command removes all the Kubernetes components associated with the chart and
 | webhook.certManager.cert.issuerRef | object | `{"group":"cert-manager.io","kind":"Issuer","name":"my-issuer"}` | For the Certificate created by this chart, setup the issuer. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec |
 | webhook.certManager.cert.renewBefore | string | `""` | How long before the currently issued certificate’s expiry cert-manager should renew the certificate. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec Note that renewBefore should be greater than .webhook.lookaheadInterval since the webhook will check this far in advance that the certificate is valid. |
 | webhook.certManager.enabled | bool | `false` | Enabling cert-manager support will disable the built in secret and switch to using cert-manager (installed separately) to automatically issue and renew the webhook certificate. This chart does not install cert-manager for you, See https://cert-manager.io/docs/ |
+| webhook.certSecretNameOverride | string | `""` | If not empty, overrides the name of the secret resource where the webhook certificates are stored. If the secret resource you want to use already exists, also check the following values: `certController.create`; `webhook.certManager.enabled`; `webhook.createWebhookSecret`; `webhook.addCustomCertSecretInjectorAnnotations`. |
 | webhook.create | bool | `true` | Specifies whether a webhook deployment be created. |
+| webhook.createWebhookSecret | bool | `true` | Whether to create the webhook secret resource (doesn't interfere with webhook.certManager.cert.create). |
 | webhook.deploymentAnnotations | object | `{}` | Annotations to add to Deployment |
 | webhook.extraArgs | object | `{}` |  |
 | webhook.extraEnv | list | `[]` |  |

deploy/charts/external-secrets/templates/validatingwebhook.yaml

@@ -8,7 +8,10 @@ metadata:
     {{- with .Values.commonLabels }}
     {{ toYaml . | nindent 4 }}
     {{- end }}
-  {{- if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+  {{- if .Values.webhook.addCustomCertSecretInjectorAnnotations }}
+  annotations:
+    cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ template "external-secrets-webhook.certSecretName" . }}
+  {{- else if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
   annotations:
     cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
   {{- end }}
@@ -54,7 +57,10 @@ metadata:
     {{- with .Values.commonLabels }}
     {{ toYaml . | nindent 4 }}
     {{- end }}
-  {{- if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+  {{- if .Values.webhook.addCustomCertSecretInjectorAnnotations }}
+  annotations:
+    cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ template "external-secrets-webhook.certSecretName" . }}
+  {{- else if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
   annotations:
     cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
   {{- end }}

deploy/charts/external-secrets/tests/webhook_test.yaml

@@ -171,6 +171,30 @@ tests:
     templates:
       - validatingwebhook.yaml
       - crds/externalsecret.yaml
+  - it: should add annotations, necessary when using a custom secret, to the webhook
+    set:
+      certController.create: false
+      webhook.create: true
+      webhook.certManager.enabled: false
+      webhook.addCustomCertSecretInjectorAnnotations: true
+    asserts:
+      - equal:
+          path: metadata.annotations["cert-manager.io/inject-ca-from-secret"]
+          value: "NAMESPACE/RELEASE-NAME-external-secrets-webhook"
+    templates:
+      - validatingwebhook.yaml
+      - crds/externalsecret.yaml
+  - it: should not add injector annotations for the *custom secret*
+    set:
+      webhook.addCustomCertSecretInjectorAnnotations: false
+      # just to avoid future conflicts with other annotations
+      webhook.certManager.addInjectorAnnotations: false
+    asserts:
+      - isNull:
+          path: metadata.annotations["cert-manager.io/inject-ca-from-secret"]
+    templates:
+      - validatingwebhook.yaml
+      - crds/externalsecret.yaml
   - it: should override the name of the certificates Secret
     set:
       webhook.certSecretNameOverride: custom-secret-name

deploy/charts/external-secrets/values.yaml

@@ -220,13 +220,22 @@ webhook:
   revisionHistoryLimit: 10
 
   # -- If not empty, overrides the name of the secret resource where the webhook certificates are
-  # stored.
+  # stored. If the secret resource you want to use already exists, also check the following values:
+  # `certController.create`; `webhook.certManager.enabled`; `webhook.createWebhookSecret`;
+  # `webhook.addCustomCertSecretInjectorAnnotations`.
   certSecretNameOverride: ""
 
   # -- Whether to create the webhook secret resource (doesn't interfere with
   # webhook.certManager.cert.create).
   createWebhookSecret: true
 
+  # -- Although webhook.certManager may be disabled, cert-manager still needs to be installed
+  # (and this chart does not install it for you). "cert-manager" is used to inject the caBundle
+  # into Kind=CustomResourceDefinition for conversion webhooks and Kind=ValidatingWebhookConfiguration
+  # for validating admission webhook. The Secret resource MUST have an
+  # `cert-manager.io/allow-direct-injection: "true"` annotation.
+  addCustomCertSecretInjectorAnnotations: false
+
   certDir: /tmp/certs
   # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
   failurePolicy: Fail

hack/helm.generate.sh

@@ -31,7 +31,7 @@ for i in "${HELM_DIR}"/templates/crds/*.yml; do
   rm "$i.bkp"
   $SEDPRG -i 's/name: kubernetes/name: {{ include "external-secrets.fullname" . }}-webhook/g' "$i"
   $SEDPRG -i 's/namespace: default/namespace: {{ .Release.Namespace | quote }}/g' "$i"
-  $SEDPRG -i '0,/annotations/!b;//a\    {{- with .Values.crds.annotations }}\n    {{- toYaml . | nindent 4}}\n    {{- end }}\n    {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}\n    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook\n    {{- end }}' "$i"
+  $SEDPRG -i '0,/annotations/!b;//a\    {{- with .Values.crds.annotations }}\n    {{- toYaml . | nindent 4}}\n    {{- end }}\n    {{- if .Values.webhook.addCustomCertSecretInjectorAnnotations }}\n    cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ template "external-secrets-webhook.certSecretName" . }}\n    {{- else if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}\n    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook\n    {{- end }}' "$i"
 
   $SEDPRG -i '/  conversion:/i{{- if .Values.crds.conversion.enabled }}' "$i"
   echo "{{- end }}" >> "$i"