RefreshCert should be based on the cert expire time, not after 180 days

[anfernee]

A server restart will reset the timer but not the certificate. Unless we refresh certificate every time we start the server.

controller-runtime/pkg/webhook/server.go

Line 226 in a8ea205

timer := time.Tick(6 * 30 * 24 * time.Hour)

[anfernee]

cc @mengqiy

[mengqiy]

This is not an real issue, since each time the server starts, it checks if the cert is valid (i.e. not expire in the next 6 months).
In current setup, timer is 180 days.
In the worst case, the server restarts at 179th day after the certs are generated. And after another 180 days, timer fires, the server rotates the certs. Nothing breaks.

[mengqiy]

It probably makes more sense to reduce the timer to 90 days (~ 3 months).
I will do it in #260

[anfernee]

SGTM.