search

cert-manager / trust-manager

trust-manager is an operator for distributing trust bundles across a Kubernetes cluster.
https://cert-manager.io/docs/projects/trust-manager/
Apache License 2.0
251 stars 66 forks source link

Allow to specify admission webhooks CA from Bundle #340

Open qcattez opened 5 months ago

qcattez commented 5 months ago

When creating ValidatingWebhookConfiguration or MutatingWebhookConfiguration, we can specify the CA bundle to use in the ClientConfig : https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#webhookclientconfig-v1-admissionregistration-k8s-io

However, those ressources doesn't allow to specify the CA bundle from a Secret or Configmap (only inline). cert-manager tackles this problem by injecting the CA bundle on resources annotated with cert-manager.io/inject-ca-from: <namespace>/<certificate>.

So in order to provide the same functionality as cert-manager, it would be nice to introduce a trust-manager-ca-injector that would be responsible to inject the CA bundle on resources annotated with trust.cert-manager.io/inject-ca-from: <namespace>/<bundle>.

qcattez commented 5 months ago

When looking into the cert-manager-ca-injector documentation, I found this : https://cert-manager.io/docs/concepts/ca-injector/#injecting-ca-data-from-a-secret-resource

Thus allowing us to inject the CA bundle from a secret that would have been created by trust-manager.

Sorry for the inconvenience 🙏

qcattez commented 5 months ago

In the end, the use of the annotation cert-manager.io/inject-ca-from-secret allows us to specify a secret to define the CA for admissions webhooks.

But the only thing missing for this feature to be achievable is to be able to add custom annotations on the secret created by the Bundle. For now, only the key can be specified : https://cert-manager.io/docs/trust/trust-manager/api-reference/#bundlespectargetsecret

It would be nice to be able to add the cert-manager.io/allow-direct-injection: "true" annotation on the created secret.

erikgb commented 5 months ago

It could make sense to add a feature similar to cert-manager secretTemplate. That should make the feature address more use cases, and not just this one specifically. It should also cover target configmaps if implemented.