add filepath tls server source in webhook init

Author: cahillsf

cmd/crossplane/core/init.go

@@ -19,6 +19,7 @@ package core
 import (
 	"context"
 	"fmt"
+	"path/filepath"
 
 	admv1 "k8s.io/api/admissionregistration/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -53,6 +54,9 @@ type initCommand struct {
 	TLSCASecretName         string `env:"TLS_CA_SECRET_NAME"        help:"The name of the Secret that the initializer will fill with TLS CA certificate."`
 	TLSServerSecretName     string `env:"TLS_SERVER_SECRET_NAME"    help:"The name of the Secret that the initializer will fill with TLS server certificates."`
 	TLSClientSecretName     string `env:"TLS_CLIENT_SECRET_NAME"    help:"The name of the Secret that the initializer will fill with TLS client certificates."`
+
+	WebhookTLSCertDir string `env:"WEBHOOK_TLS_CERT_DIR"  help:"Directory containing TLS certificates for webhooks. When set, certificates are read from files instead of Secrets."`
+	WebhookTLSCACert  string `default:"ca.crt"            env:"WEBHOOK_TLS_CA_CERT" help:"Filename of the CA certificate within the TLS cert directory."`
 }
 
 // Run starts the initialization process.
@@ -91,18 +95,28 @@ func (c *initCommand) Run(s *runtime.Scheme, log logging.Logger) error {
 			),
 		)
 
-		nn := types.NamespacedName{
-			Name:      c.TLSServerSecretName,
-			Namespace: c.Namespace,
-		}
 		svc := admv1.ServiceReference{
 			Name:      c.WebhookServiceName,
 			Namespace: c.WebhookServiceNamespace,
 			Port:      &c.WebhookServicePort,
 		}
-		steps = append(steps,
-			initializer.NewCoreCRDs(c.CRDsPath, s, initializer.WithWebhookTLSSecretRef(nn)),
-			initializer.NewWebhookConfigurations(c.WebhookConfigurationsPath, s, nn, svc))
+
+		var caProvider initializer.WebhookCAProvider
+		if c.WebhookTLSCertDir != "" {
+			caProvider = &initializer.FileCAProvider{Path: filepath.Join(c.WebhookTLSCertDir, c.WebhookTLSCACert)}
+			steps = append(steps,
+				initializer.NewCoreCRDs(c.CRDsPath, s),
+				initializer.NewWebhookConfigurations(c.WebhookConfigurationsPath, s, caProvider, svc))
+		} else {
+			nn := types.NamespacedName{
+				Name:      c.TLSServerSecretName,
+				Namespace: c.Namespace,
+			}
+			caProvider = &initializer.SecretCAProvider{SecretRef: nn}
+			steps = append(steps,
+				initializer.NewCoreCRDs(c.CRDsPath, s, initializer.WithWebhookTLSSecretRef(nn)),
+				initializer.NewWebhookConfigurations(c.WebhookConfigurationsPath, s, caProvider, svc))
+		}
 	} else {
 		log.Info("Warning: Webhooks are disabled, so deprecated ValidatingWebhookConfigurations will not be automatically deleted.")
 		steps = append(steps,

internal/initializer/webhook_configurations.go

@@ -18,6 +18,7 @@ package initializer
 
 import (
 	"context"
+	"os"
 
 	"github.com/spf13/afero"
 	admv1 "k8s.io/api/admissionregistration/v1"
@@ -35,8 +36,51 @@ import (
 const (
 	errApplyWebhookConfiguration = "cannot apply webhook configuration"
 	errGetWebhookSecret          = "cannot get webhook secret"
+	errReadCABundleFile          = "cannot read CA bundle file"
+	errEmptyCABundleFile         = "CA bundle file is empty"
 )
 
+// WebhookCAProvider provides a CA bundle for webhook configurations.
+type WebhookCAProvider interface {
+	GetCABundle(ctx context.Context, kube client.Client) ([]byte, error)
+}
+
+// SecretCAProvider loads the CA bundle from a Kubernetes Secret.
+type SecretCAProvider struct {
+	SecretRef types.NamespacedName
+}
+
+func (p *SecretCAProvider) GetCABundle(ctx context.Context, kube client.Client) ([]byte, error) {
+	s := &corev1.Secret{}
+	if err := kube.Get(ctx, p.SecretRef, s); err != nil {
+		return nil, errors.Wrap(err, errGetWebhookSecret)
+	}
+
+	if len(s.Data["tls.crt"]) == 0 {
+		return nil, errors.Errorf(errFmtNoTLSCrtInSecret, p.SecretRef.String())
+	}
+
+	return s.Data["tls.crt"], nil
+}
+
+// FileCAProvider loads the CA bundle from a file.
+type FileCAProvider struct {
+	Path string
+}
+
+func (p *FileCAProvider) GetCABundle(ctx context.Context, kube client.Client) ([]byte, error) {
+	data, err := os.ReadFile(p.Path)
+	if err != nil {
+		return nil, errors.Wrap(err, errReadCABundleFile)
+	}
+
+	if len(data) == 0 {
+		return nil, errors.New(errEmptyCABundleFile)
+	}
+
+	return data, nil
+}
+
 // WithWebhookConfigurationsFs is used to configure the filesystem the CRDs will
 // be read from. Its default is afero.OsFs.
 func WithWebhookConfigurationsFs(fs afero.Fs) WebhookConfigurationsOption {
@@ -45,15 +89,22 @@ func WithWebhookConfigurationsFs(fs afero.Fs) WebhookConfigurationsOption {
 	}
 }
 
+// WithWebhookCAProvider sets the CA provider for webhook configurations.
+func WithWebhookCAProvider(provider WebhookCAProvider) WebhookConfigurationsOption {
+	return func(c *WebhookConfigurations) {
+		c.caProvider = provider
+	}
+}
+
 // WebhookConfigurationsOption configures WebhookConfigurations step.
 type WebhookConfigurationsOption func(*WebhookConfigurations)
 
 // NewWebhookConfigurations returns a new *WebhookConfigurations.
-func NewWebhookConfigurations(path string, s *runtime.Scheme, tlsSecretRef types.NamespacedName, svc admv1.ServiceReference, opts ...WebhookConfigurationsOption) *WebhookConfigurations {
+func NewWebhookConfigurations(path string, s *runtime.Scheme, caProvider WebhookCAProvider, svc admv1.ServiceReference, opts ...WebhookConfigurationsOption) *WebhookConfigurations {
 	c := &WebhookConfigurations{
 		Path:             path,
 		Scheme:           s,
-		TLSSecretRef:     tlsSecretRef,
+		caProvider:       caProvider,
 		ServiceReference: svc,
 		fs:               afero.NewOsFs(),
 	}
@@ -69,7 +120,7 @@ func NewWebhookConfigurations(path string, s *runtime.Scheme, tlsSecretRef types
 type WebhookConfigurations struct {
 	Path             string
 	Scheme           *runtime.Scheme
-	TLSSecretRef     types.NamespacedName
+	caProvider       WebhookCAProvider
 	ServiceReference admv1.ServiceReference
 
 	fs afero.Fs
@@ -78,17 +129,11 @@ type WebhookConfigurations struct {
 // Run applies all webhook ValidatingWebhookConfigurations and
 // MutatingWebhookConfiguration in the given directory.
 func (c *WebhookConfigurations) Run(ctx context.Context, kube client.Client) error {
-	s := &corev1.Secret{}
-	if err := kube.Get(ctx, c.TLSSecretRef, s); err != nil {
-		return errors.Wrap(err, errGetWebhookSecret)
-	}
-
-	if len(s.Data["tls.crt"]) == 0 {
-		return errors.Errorf(errFmtNoTLSCrtInSecret, c.TLSSecretRef.String())
+	caBundle, err := c.caProvider.GetCABundle(ctx, kube)
+	if err != nil {
+		return err
 	}
 
-	caBundle := s.Data["tls.crt"]
-
 	r, err := parser.NewFsBackend(c.fs,
 		parser.FsDir(c.Path),
 		parser.FsFilters(

internal/initializer/webhook_configurations_test.go

@@ -189,7 +189,7 @@ func TestWebhookConfigurations(t *testing.T) {
 			err := NewWebhookConfigurations(
 				"/webhooks",
 				sch,
-				types.NamespacedName{},
+				&SecretCAProvider{SecretRef: types.NamespacedName{}},
 				tc.args.svc,
 				tc.opts...).Run(context.TODO(), tc.kube)
 			if diff := cmp.Diff(tc.err, err, test.EquateErrors()); diff != "" {