k/digitalocean: add a Certificate for snapshot validation webhook

kustomizations/digitalocean/csi-driver/kustomization.yaml

@@ -4,7 +4,6 @@ namespace: digitalocean-csi
 resources:
 - driver.yaml
 - crds.yaml
-- snapshot-validation-webhook.yaml
 - snapshot-controller.yaml
 images:
 - name: k8s.gcr.io/sig-storage/snapshot-validation-webhook:v6.0.1

kustomizations/digitalocean/csi-driver/webhook/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- resources.yaml

kustomizations/digitalocean/csi-driver/webhook/kustomizeconfig.yaml

@@ -0,0 +1,7 @@
+nameReference:
+  - kind: Issuer
+    group: cert-manager.io
+    fieldSpecs:
+      - kind: Certificate
+        group: cert-manager.io
+        path: spec/issuerRef/name

kustomizations/digitalocean/csi-driver/webhook/resources.yaml

@@ -16,8 +16,10 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: "validation-webhook.snapshot.storage.k8s.io"
+  annotations:
+    cert-manager.io/inject-ca-from: default/snapshot-validation
 webhooks:
-  - name: "validation-webhook.snapshot.storage.k8s.io"
+- name: "validation-webhook.snapshot.storage.k8s.io"
   rules:
   - apiGroups:   ["snapshot.storage.k8s.io"]
     apiVersions: ["v1", "v1beta1"]
@@ -29,9 +31,6 @@ webhooks:
       namespace: "kube-system"
       name: "snapshot-validation-service"
       path: "/volumesnapshot"
-      # XXX Uncomment and populate the CA bundle field accordingly if a dedicated
-      # CA is to be used.
-      # caBundle: ${CA_BUNDLE}
   admissionReviewVersions: ["v1", "v1beta1"]
   sideEffects: None
   failurePolicy: Fail
@@ -66,7 +65,7 @@ spec:
       - name: snapshot-validation
         image: registry.k8s.io/sig-storage/snapshot-validation-webhook:v6.1.0
         imagePullPolicy: IfNotPresent
-          args: ['--tls-cert-file=/etc/snapshot-validation-webhook/certs/cert.pem', '--tls-private-key-file=/etc/snapshot-validation-webhook/certs/key.pem']
+        args: ['--tls-cert-file=/etc/snapshot-validation-webhook/certs/tls.crt', '--tls-private-key-file=/etc/snapshot-validation-webhook/certs/tls.key']
         ports:
         - containerPort: 443
         volumeMounts:
@@ -76,7 +75,6 @@ spec:
       volumes:
       - name: snapshot-validation-webhook-certs
         secret:
-            # XXX Populate the secret properly with a certificate and key
           secretName: snapshot-validation-secret
 
 ---
@@ -126,3 +124,25 @@ roleRef:
   kind: ClusterRole
   name: snapshot-validation
   apiGroup: rbac.authorization.k8s.io
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: snapshot-validation
+spec:
+  dnsNames:
+    - snapshot-validation-service
+    - snapshot-validation-service.default.svc
+  issuerRef:
+    kind: Issuer
+    name: selfsigned-issuer
+  secretName: snapshot-validation-secret

kustomizations/digitalocean/kustomization.yaml

@@ -4,5 +4,30 @@ namespace: kube-system
 resources:
 - cloud-controller-manager
 - csi-driver
+- csi-driver/webhook
 generators:
 - secret-generator.yaml
+replacements:
+- source:
+    kind: Certificate
+    fieldPath: metadata.namespace
+  targets:
+  - select:
+      kind: ValidatingWebhookConfiguration
+    fieldPaths:
+    - metadata.annotations.[cert-manager.io/inject-ca-from]
+    options:
+      delimiter: /
+- source:
+    kind: Service
+    fieldPath: metadata.namespace
+    name: snapshot-validation-service
+  targets:
+  - select:
+      kind: Certificate
+      name: snapshot-validation
+    fieldPaths:
+    - spec.dnsNames.1
+    options:
+      delimiter: .
+      index: 1