genSignedCert should check for expiration of cert in next n days and ensure new self signed cert is provisioned if this happens

[sheldonhull]

current behavior

• genSignedCert in charts/dsv-injector/templates/webhook.yaml generates a cert if the user doesn't provide their own.
• If the releasename-tls is found, it defaults to this.

So the basics of current behavior

{{- $tlsCert := genSelfSignedCert (include "dsv.dnsname" .) nil (list (include "dsv.dnsname" .) (include "dsv.name" .)) (default 365 .Values.webhookCertExpireDays | int) -}}
{{- $tlsSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" (include "dsv.name" .)) -}}

• $tlsCert == self signed cert always generated on run (it's a helm function)

• $tlsSecret is a lookup to find the "CurrentReleaseName-tls".

• The clientConfig: value for the webhook:

    clientConfig:
{{- if eq .Values.service.type "ExternalName" }}
      caBundle: {{ .Values.caBundle }}
{{- else if $tlsSecret }}
      caBundle: {{ $tlsSecret.data.cert }}
{{- else }}
      caBundle: {{ $tlsCert.Cert | b64enc }}

Logic explained:

• eq .Values.service.type "ExternalName" is set, then this takes precedence (for when service is running external to kubernetes). The default in charts/dsv-injector/values.yaml is set to type: ClusterIP. This means unless this is changed, the default behavior will fall through to checking if existing cert found in namespace for this release (aka someone installed their own cert before.
• caBundle is not set by default, but could be passed in with the helm install command if desired the caBundle must be a base64 string containing a PEM-encoded certificate chain that validates the certificate per charts/dsv-injector/values.yaml.
• Else if existing $tlsSecret that was looked up is found, then it uses this. That doesn't check if it's valid or not, so it will just reuse what's there.
• else if no existing cert (meaning fresh install/or expired cert was deleted) then it uses the self signed cert from helm function genSelfSignedCert.
• The logic expects caBundle to only be used when designating an external service.

improvement to behavior

• The check against {{- else if $tlsSecret }} should check if exists, but also check that the tls secret cert expiration <= in days from recreateSelfSignedCertThreshold.
• recreateSelfSignedCertThreshold will default in helm values to 90 days.
• webhookCertExpireDays should be exposed in the values.yaml with default of 365, rather than default set in the webhook.yaml so it's more visible
• This same check should be on the secret, which creates the cert files separated in: charts/dsv-injector/templates/webhook.yaml. This should be modified to also have the same check for expiration.

data:
{{- if $tlsSecret }}
  cert.pem: {{ $tlsSecret.data.cert }}
  key.pem: {{ $tlsSecret.data.key }}
{{- else }}
  cert.pem: {{ $tlsCert.Cert | b64enc }}
  key.pem: {{ $tlsCert.Key | b64enc }}
{{- end }}

Looking Into

• should this be gated behind a SelfSignedCertRegeneration to avoid impact to custom provided cert. ANSWER: The logic expects caBundle to only be used when designating an external service. Otherwise genSelfSignedCert is what's used.
• we load custom provided cert via config map with DSV_CERT I believe. Validate if this impacts anything here, since it's not exposed as a helm input for this process currently, but expected to be done on app loading. ANSWERED below.

How this Relates to the DSV_CERT and loading in injector

• cmd/injector/main.go caused some confusion initially as a container wouldn't have knowledge of "${HOME}". I backtracked this though and recall now why this is set.
  • Using chainguard base images.
  • User is nonroot by convention with them.
  • Helm charts create the secret, which contains the data of the cert
  • which is then referenced mounted as a volume
  • which is then consumed as a mounted volume to /home/nonroot/credentials.

So yes it was always finding it (else it would error as fatal/termination of Run.
But nothing was checking the expiration of the cert.

related to AB#590946

[sheldonhull]

Adjusted behavior in PR since couldn't get cert auto renewal to be detected. Closing PR will mark this done.