Merge pull request #134 from kanopy-platform/add_certwatcher_support

Use certwatcher to support mounting cert-manager certificates.

.github/workflows/test.yaml

@@ -10,7 +10,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.16.x
+        go-version: 1.17.x
     - name: Checkout code
       uses: actions/checkout@v2
     - name: Test

go.mod

@@ -1,21 +1,57 @@
 module github.com/aws/amazon-eks-pod-identity-webhook
 
-go 1.13
+go 1.17
 
 require (
-	github.com/evanphx/json-patch v4.4.0+incompatible // indirect
-	github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef // indirect
-	github.com/google/go-cmp v0.5.2 // indirect
-	github.com/googleapis/gnostic v0.2.0 // indirect
-	github.com/imdario/mergo v0.3.7 // indirect
-	github.com/pkg/errors v0.8.1
-	github.com/prometheus/client_golang v0.9.3
+	github.com/pkg/errors v0.9.1
+	github.com/prometheus/client_golang v1.11.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.4.0
+	github.com/stretchr/testify v1.7.0
 	gopkg.in/square/go-jose.v2 v2.5.1
-	k8s.io/api v0.18.8
-	k8s.io/apimachinery v0.18.9-rc.0
-	k8s.io/client-go v0.18.8
+	k8s.io/api v0.23.0
+	k8s.io/apimachinery v0.23.0
+	k8s.io/client-go v0.23.0
 	k8s.io/klog v1.0.0
-	sigs.k8s.io/yaml v1.2.0
+	sigs.k8s.io/controller-runtime v0.11.0
+	sigs.k8s.io/yaml v1.3.0
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/fsnotify/fsnotify v1.5.1 // indirect
+	github.com/go-logr/logr v1.2.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/go-cmp v0.5.5 // indirect
+	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/googleapis/gnostic v0.5.5 // indirect
+	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.28.0 // indirect
+	github.com/prometheus/procfs v0.6.0 // indirect
+	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect
+	golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect
+	golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f // indirect
+	golang.org/x/sys v0.0.0-20211029165221-6e7872819dc8 // indirect
+	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
+	golang.org/x/text v0.3.7 // indirect
+	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	k8s.io/klog/v2 v2.30.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
+	k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b // indirect
+	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.0 // indirect
 )

main.go

@@ -36,6 +36,8 @@ import (
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog"
+	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 )
 
 var webhookVersion = "v0.1.0"
@@ -148,6 +150,8 @@ func main() {
 		// Expose other debug paths
 	}
 
+	// setup signal handler to be passed to certwatcher and http server
+	signalHandlerCtx := signals.SetupSignalHandler()
 	tlsConfig := &tls.Config{}
 
 	if *inCluster {
@@ -185,11 +189,18 @@ func main() {
 			return certificate, nil
 		}
 	} else {
-		certificate, err := tls.LoadX509KeyPair(*tlsCertFile, *tlsKeyFile)
+		watcher, err := certwatcher.New(*tlsCertFile, *tlsKeyFile)
 		if err != nil {
-			klog.Fatalf("failed to load TLS cert and key: %v", err)
+			klog.Fatalf("Error initializing certwatcher: %q", err)
 		}
-		tlsConfig.Certificates = []tls.Certificate{certificate}
+
+		go func() {
+			if err := watcher.Start(signalHandlerCtx); err != nil {
+				klog.Fatalf("Error starting certwatcher: %q", err)
+			}
+		}()
+
+		tlsConfig.GetCertificate = watcher.GetCertificate
 	}
 
 	klog.Info("Creating server")
@@ -198,7 +209,8 @@ func main() {
 		Handler:   mux,
 		TLSConfig: tlsConfig,
 	}
-	handler.ShutdownOnTerm(server, time.Duration(10)*time.Second)
+
+	handler.ShutdownFromContext(signalHandlerCtx, server, time.Duration(10)*time.Second)
 
 	metricsServer := &http.Server{
 		Addr:    metricsAddr,

pkg/cert/request.go

@@ -21,16 +21,15 @@ import (
 	"fmt"
 
 	"github.com/prometheus/client_golang/prometheus"
-	certificates "k8s.io/api/certificates/v1beta1"
+	certificates "k8s.io/api/certificates/v1"
 	clientset "k8s.io/client-go/kubernetes"
-	certificatesclient "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 	"k8s.io/client-go/util/certificate"
 )
 
 // NewServerCertificateManager returns a certificate manager that stores TLS keys in Kubernetes Secrets
 func NewServerCertificateManager(kubeClient clientset.Interface, namespace, secretName string, csr *x509.CertificateRequest) (certificate.Manager, error) {
-	clientFn := func(_ *tls.Certificate) (certificatesclient.CertificateSigningRequestInterface, error) {
-		return kubeClient.CertificatesV1beta1().CertificateSigningRequests(), nil
+	clientsetFn := func(_ *tls.Certificate) (clientset.Interface, error) {
+		return kubeClient, nil
 	}
 
 	certificateStore := NewSecretCertStore(
@@ -49,8 +48,8 @@ func NewServerCertificateManager(kubeClient clientset.Interface, namespace, secr
 	prometheus.MustRegister(certificateRotation)
 
 	m, err := certificate.NewManager(&certificate.Config{
-		ClientFn: clientFn,
-		Template: csr,
+		ClientsetFn: clientsetFn,
+		Template:    csr,
 		Usages: []certificates.KeyUsage{
 			// https://tools.ietf.org/html/rfc5280#section-4.2.1.3
 			//
@@ -65,7 +64,9 @@ func NewServerCertificateManager(kubeClient clientset.Interface, namespace, secr
 			// authenticate itself to a TLS client.
 			certificates.UsageServerAuth,
 		},
-		SignerName:          certificates.LegacyUnknownSignerName,
+		// Hard coding this since LegacyUnknownSignerName is no longer available in certificates/v1
+		// https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers.
+		SignerName:          "kubernetes.io/legacy-unknown",
 		CertificateStore:    certificateStore,
 		CertificateRotation: certificateRotation,
 	})

pkg/handler/shutdown.go

@@ -18,30 +18,19 @@ package handler
 import (
 	"context"
 	"net/http"
-	"os"
-	"os/signal"
-	"syscall"
 	"time"
 
 	"k8s.io/klog"
 )
 
-var term = syscall.SIGTERM
-
-// ShutdownOnTerm will wait for SIGTERM or SIGINT and gracefully shuts down the
-// http server or kill it after the specified timeout
-func ShutdownOnTerm(server *http.Server, timeout time.Duration) {
-	c := make(chan os.Signal)
-	signal.Notify(c, os.Interrupt)
-	signal.Notify(c, term)
-
+func ShutdownFromContext(ctx context.Context, server *http.Server, timeout time.Duration) {
 	go func() {
-		<-c
-		klog.Infof("Received SIGTERM/SIGINT. Beginning shutdown")
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		<-ctx.Done()
+
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), timeout)
 		defer cancel()
-		if err := server.Shutdown(ctx); err != http.ErrServerClosed {
-			<-ctx.Done()
+
+		if err := server.Shutdown(shutdownCtx); err != nil {
 			klog.Errorf("Error shutting server down: %v", err)
 			if err := server.Close(); err != nil {
 				klog.Fatalf("Error closing server: %v", err)