Policy server certificate renewal

From time to time we need to renew the certificate issued to a Policy Server instance. The main reason to perform this operation is to ensure the Policy Server is not using an expired certificate.

To renew a Policy Server certificate the following actions have to be done:

Generate new certificate, sign it with our CA
Force a rollout of the Policy Server deployment. This will ensure the HTTPS server uses the new certificate

Note: there's no need to touch the webhook configuration objects related to the policies hosted by the Policy Server. The new certificate is still signed by the same CA, hence nothing has to be changed.

Reconcilation loop

Reconciliation loops are triggered whenever an event dealing with a watched resource happens. In this case it could be the create/update/delete of a PolicyServer. The reconciliation loop is also triggered every 10 hours by SyncPeriod as a way to cope with possible glitcheswith the event notification system.

At the beginning of the reconciliation loop, the code should check the expiration date of the certificate used by the Policy Server. If the certificate is about to expire a new one should be created. Check the previous section to see which actions have to be done in this circumstance.

The loop should also monitor changes done to the secret that holds the internal CA. The reconciliation loop should then make sure that the Policy Server certificate has been signed by our CA. If not, a new certificate should be issued (like during a renewal).

Note: checking if the Policy Server certificate has been issued by our CA might be computationally intense. We have to ensure this is not going to cause a CPU spike. We could resort to do something clever using the revision number of the Secret that holds the CA.

SyncPeriod or RequeueAfter

We'd rather be explicit by adding a configuration value and triggering the reconciliation loop via a RequeueAfter.

Refer to this discussion: https://github.com/kubewarden/rfc/pull/24/files#r1333119954

kubewarden / kubewarden-controller

Policy server certificate renewal #545

Reconcilation loop

SyncPeriod or RequeueAfter