✨ webhook: Handle TLS certificate rotation

[bison]

This watches the configured TLS certificate and key files for admission webhooks. On any change, it attempts to reload them from disk.

Fixes: #390

[k8s-ci-robot]

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
• If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
• Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: login-issues@jira.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[mengqiy]

/assign

[mengqiy]

When a secret get updated it actually triggers a rename event. Ref: algorithm of volume writer.
I'd like to know what testing has been done to verify if it work.

[bison]

Right, this is a bit tricky. So, fsnotify always fully resolves symlinks. In the case of a Kubernetes volume mount, the certificate and key files in the current data directory are watched. On an update, it's actually the remove event after the rename that is picked up here, then the watch is re-added following the new symlink.

I've tested this manually pretty extensively. My use-case is that I have another controller in the cluster generating and rotating short-lived TLS certificates for my controller-runtime based project. With this patch, webhook requests have continued to succeed after the periodic refresh of the TLS assets.

[mengqiy]

@bison Please fix travis build

[bison]

@mengqiy, thanks for having a look! I rebased and the tests seem to be passing now.

[mengqiy]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: bison

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment