feat(helm): optional cert-manager integration for validating webhook

Chart shipped a ValidatingWebhookConfiguration but had no way to provide
TLS certs to the operator, so the webhook silently no-op'd ("TLS certs
not found, running without admission validation") and any kubectl create
of a ChainInstance failed with "connection refused" against the webhook
service. Adds webhook.certManager.enabled flag that provisions a
self-signed Issuer + Certificate, mounts the resulting Secret, passes
--webhook-cert-path/--webhook-cert-name/--webhook-cert-key to the
manager, and annotates the webhook with cert-manager.io/inject-ca-from
so the caBundle is populated automatically.

Context: tried to apply a small bitcoin ChainInstance against a freshly
installed v0.2.3 release and hit the webhook connection refused error,
inspected the manager logs (cert-dir empty), checked cert-manager was
present in the cluster (it was) and wired up the standard self-signed
flow used by kubebuilder/operator-sdk projects. Verified end-to-end by
upgrading the release with the new flag, confirming the cert/issuer
went Ready and the bitcoin-test instance reconciled into a Running
StatefulSet with PVC and started syncing block headers. Took ~30min.

Author: tazhate

charts/chainplane/templates/deployment.yaml

@@ -60,6 +60,10 @@ spec:
             - --webhook-cert-path={{ .Values.webhook.certDir }}
             - --webhook-cert-name={{ .Values.webhook.certName }}
             - --webhook-cert-key={{ .Values.webhook.certKey }}
+            {{- else if .Values.webhook.certManager.enabled }}
+            - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
+            - --webhook-cert-name=tls.crt
+            - --webhook-cert-key=tls.key
             {{- end }}
             {{- with .Values.extraArgs }}
             {{- toYaml . | nindent 12 }}
@@ -121,13 +125,27 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end }}
           {{- end }}
-          {{- if .Values.extraVolumeMounts }}
+          {{- if or .Values.extraVolumeMounts .Values.webhook.certManager.enabled }}
           volumeMounts:
-            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- if .Values.webhook.certManager.enabled }}
+            - name: webhook-cert
+              mountPath: /tmp/k8s-webhook-server/serving-certs
+              readOnly: true
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           {{- end }}
-      {{- if .Values.extraVolumes }}
+      {{- if or .Values.extraVolumes .Values.webhook.certManager.enabled }}
       volumes:
-        {{- toYaml .Values.extraVolumes | nindent 8 }}
+        {{- if .Values.webhook.certManager.enabled }}
+        - name: webhook-cert
+          secret:
+            secretName: {{ include "chainplane.fullname" . }}-webhook-cert
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:

charts/chainplane/templates/webhook-cert.yaml

@@ -0,0 +1,40 @@
+{{- if and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- if not .Values.webhook.certManager.issuerRef }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "chainplane.fullname" . }}-selfsigned
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "chainplane.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+{{- end }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "chainplane.fullname" . }}-webhook-cert
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "chainplane.labels" . | nindent 4 }}
+spec:
+  secretName: {{ include "chainplane.fullname" . }}-webhook-cert
+  dnsNames:
+    - {{ include "chainplane.webhookServiceName" . }}.{{ .Release.Namespace }}.svc
+    - {{ include "chainplane.webhookServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
+  {{- with .Values.webhook.certManager.duration }}
+  duration: {{ . }}
+  {{- end }}
+  {{- with .Values.webhook.certManager.renewBefore }}
+  renewBefore: {{ . }}
+  {{- end }}
+  issuerRef:
+    {{- if .Values.webhook.certManager.issuerRef }}
+    {{- toYaml .Values.webhook.certManager.issuerRef | nindent 4 }}
+    {{- else }}
+    name: {{ include "chainplane.fullname" . }}-selfsigned
+    kind: Issuer
+    group: cert-manager.io
+    {{- end }}
+{{- end }}

charts/chainplane/templates/webhook-configuration.yaml

@@ -5,6 +5,10 @@ metadata:
   name: {{ include "chainplane.fullname" . }}-validating
   labels:
     {{- include "chainplane.labels" . | nindent 4 }}
+  {{- if .Values.webhook.certManager.enabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "chainplane.fullname" . }}-webhook-cert
+  {{- end }}
 webhooks:
   - admissionReviewVersions:
       - v1

charts/chainplane/values.yaml

@@ -123,6 +123,15 @@ webhook:
   certDir: ""
   certName: tls.crt
   certKey: tls.key
+  # -- Provision a self-signed cert via cert-manager and inject CA bundle into
+  # the ValidatingWebhookConfiguration. Requires cert-manager installed in the cluster.
+  certManager:
+    enabled: false
+    # -- Issuer reference. By default a chart-managed self-signed Issuer is created.
+    issuerRef: {}
+    # -- Certificate duration / renewBefore (cert-manager defaults if empty)
+    duration: ""
+    renewBefore: ""
 
 prometheus:
   # -- Base URL of the Prometheus server used for node health checks