add webhook - fixes #10

[davidkarlsen]

Signed-off-by: David J. M. Karlsen [email protected]

---

This change is 

[davidkarlsen]

Do you have any CI?
It could be automated with github-actions / kind / helm-tooling-actions like this: https://github.com/evryfs/helm-charts/commit/0aa28bdb22f3471a3c09265082765f97b38dae3e/checks?check_suite_id=358671120

[zhill]

Do you have any CI?
It could be automated with github-actions / kind / helm-tooling-actions like this: https://github.com/evryfs/helm-charts/commit/0aa28bdb22f3471a3c09265082765f97b38dae3e/checks?check_suite_id=358671120

Yeah, that's a good call. We also use CircleCI so that's an option. I'll look into it.

[zhill]

I'll be getting to this soon. The holidays in the US have delayed my availability but should be getting it fully reviewed and able to merge soon. Thanks for your patience @davidkarlsen

[zhill]

Looks good. I'll merge this once the refactor merge is in

[davidkarlsen]

I wonder if the ca-bundle is really needed https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#webhook-configuration, "URL" Here is an example of a mutating webhook configured to call a URL (and expects the TLS certificate to be verified using system trust roots, so does not specify a caBundle):

[davidkarlsen]

I’ll Get a fresh squashed PR which passes dco once the other one is merged...

[davidkarlsen]

OK - clean patch applied.
Can you test this in a cluster? I am not sure that the caBundle actually needs to be set for successful use&installation.

[davidkarlsen]

@zhill did you have a chance to look at this? Does it work OOTB w/o any caBundle?

[davidkarlsen]

@zhill ?

[zhill]

@zhill ?

I've done some very initial testing that it does install OOTB w/o caBundle, but need further testing to ensure it works as expected. I'll try to get to that later tonight so we can get this resolved soon. Thanks @davidkarlsen !

[zhill]

I'm going to go ahead and merge this. I'm seeing some issues with the apiservice selection but I think that is not part of this change since it is setup in the init-ca script run during the install init-ca job.

kc get apiservice/v1beta1.admission.anchore.io
NAME                           SERVICE                                        AVAILABLE                  AGE
v1beta1.admission.anchore.io   default/admctrl-anchore-admission-controller   False (MissingEndpoints)   13s

[davidkarlsen]

Ah - init-ca - we set out to fix that in #9. But is that really needed?

[davidkarlsen]

OK, found a good description here: https://github.com/elithrar/admission-control#generating-tls-certificates

[davidkarlsen]

And also https://www.scottguymer.co.uk/post/kubernetes-mutating-webhook-configuration/, lets fix this in #9