Webhook Server Certificate

[bdwyertech]

Description

Seems like the webhook server is not getting restarted when cert-manager issues a new certificate. I would expect the devworkspace-controller-manager to do this, or for the webhook server to see that the cert has been rolled.

ERROR: Job failed (system failure): prepare environment: setting up trapping scripts on emptyDir: Internal error occurred: failed calling webhook "validate-exec.devworkspace-controller.svc": failed to call webhook: Post "[https://devworkspace-webhookserver.devworkspace-controller.svc:443/validate?timeout=10s](https://devworkspace-webhookserver.devworkspace-controller.svc/validate?timeout=10s)": tls: failed to verify certificate: x509: certificate signed by unknown authority. Check https://docs.gitlab.com/runner/shells/index.html#shell-profile-loading for more information

Perhaps I just have something misconfigured, but when this cert expires, it causes issues for other non-devworkspace pods. Killing the webhook server and letting a new pod come up resolves the issue.

I am using the following Flux config to deploy the manifests under deploy/deployment/kubernetes/objects/

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
metadata:
  name: devworkspace-operator
  namespace: devworkspace-controller
spec:
  interval: 1h
  url: https://github.com/devfile/devworkspace-operator
  ref:
    tag: v0.22.0
  ignore: |
    # exclude all
    /*
    # include k8s deploy objects directory
    !/deploy/deployment/kubernetes/objects/
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: devworkspace-operator
  namespace: devworkspace-controller
spec:
  interval: 1h
  retryInterval: 1m
  timeout: 5m
  sourceRef:
    kind: GitRepository
    name: devworkspace-operator
  path: ./deploy/deployment/kubernetes/objects
  prune: true

[jsnouffer]

I also have been encountering this issue when cert-manager renews the webhook certificate, requiring a restart of the pod. It would be nice to get this addressed.

[AObuchow]

@bdwyertech @jsnouffer Thank you for reporting and following up on this issue. I apologize it went unattended for so long. I have been caught up with other priorities but wanted to let you know this issue's priority will be assessed, and it will hopefully be worked on in the near future.