patch-operator icon indicating copy to clipboard operation
patch-operator copied to clipboard

enableCertManager to false no working, and no way to inject custom certificates

Open leotomas837 opened this issue 3 years ago • 1 comments

The Helm chart does not work with enableCertManager set to false in values.yaml:

...
44 enableCertManager: false

Certificates are logically created only if enableCertManager is set to true in certificate.yaml:

1 {{ if .Values.enableCertManager }}
...

Indeed, volumes are defined in the manager.yaml even when cert-manager is not defined ( so when no secret are created):

88       volumes:
89       - name: patch-operator-certs
90         secret:
91           defaultMode: 420
92           secretName: patch-operator-certs  
93       - name: webhook-server-cert
94         secret:
95           secretName: webhook-server-cert
96           defaultMode: 420     

Also, it would be nice if we could use our own certificates, instead of having certificates from a self-signed issuer when enabling cert-manager.... Cert-manager itself strongly advised not to use self-signed issuers in production for example.

Notes: 1] Currently, both the root CA of the webhook and the CA of the kube-rcbac-proxy are self-signed certificates... 2] Both cannot not having these certs according to the kube-rbac-proxy and Kubernetes (for webhooks) doc. So it seems fair not to be able not to use tls certs, but we should be able to choose ourself how to inject these certs. Especially for kube-rbac-proxy.. because the webhook container could create and manage its CA as cert-manager does for its webhooks, but it would be more complicated to implement.

leotomas837 avatar Dec 07 '22 15:12 leotomas837

I can make a pull request for this purpose, but can you confirm that the repo is actively monitored and that the PR will be reviewed ?

leotomas837 avatar Dec 07 '22 21:12 leotomas837