From 5d56bdf421e6d3cad3cdd4e9a97ab204e2731733 Mon Sep 17 00:00:00 2001
From: liamfallon <liam.fallon@est.tech>
Date: Wed, 28 Feb 2024 16:44:27 +0000
Subject: [PATCH 1/2] Allow porch namespace in cert/webhook to be configured

---
 pkg/apiserver/apiserver.go     | 10 ++++++++--
 pkg/apiserver/webhooks.go      | 20 ++++++++++----------
 pkg/apiserver/webhooks_test.go |  2 +-
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index 73cfac4b..3af6bc84 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/nephio-project/porch/api/porch/install"
@@ -281,9 +282,14 @@ func (c completedConfig) New() (*PorchServer, error) {
 
 func (s *PorchServer) Run(ctx context.Context) error {
 	porch.RunBackground(ctx, s.coreClient, s.cache)
+	webhookNs, found := os.LookupEnv("CERT_NAMESPACE")
+	if !found || strings.TrimSpace(webhookNs) == "" {
+		webhookNs = "porch-system"
+	}
+
 	certStorageDir, found := os.LookupEnv("CERT_STORAGE_DIR")
-	if found && certStorageDir != "" {
-		if err := setupWebhooks(ctx, certStorageDir); err != nil {
+	if found && strings.TrimSpace(certStorageDir) != "" {
+		if err := setupWebhooks(ctx, webhookNs, certStorageDir); err != nil {
 			klog.Errorf("%v\n", err)
 			return err
 		}
diff --git a/pkg/apiserver/webhooks.go b/pkg/apiserver/webhooks.go
index 8196ec3f..48ecc0d5 100644
--- a/pkg/apiserver/webhooks.go
+++ b/pkg/apiserver/webhooks.go
@@ -51,12 +51,12 @@ const (
 	serverEndpoint     = "/validate-deletion"
 )
 
-func setupWebhooks(ctx context.Context, certStorageDir string) error {
-	caBytes, err := createCerts(certStorageDir)
+func setupWebhooks(ctx context.Context, webhookNs string, certStorageDir string) error {
+	caBytes, err := createCerts(webhookNs, certStorageDir)
 	if err != nil {
 		return err
 	}
-	if err := createValidatingWebhook(ctx, caBytes); err != nil {
+	if err := createValidatingWebhook(ctx, webhookNs, caBytes); err != nil {
 		return err
 	}
 	if err := runWebhookServer(certStorageDir); err != nil {
@@ -65,11 +65,11 @@ func setupWebhooks(ctx context.Context, certStorageDir string) error {
 	return nil
 }
 
-func createCerts(certStorageDir string) ([]byte, error) {
-	klog.Infoln("creating self-signing TLS cert and key ")
+func createCerts(webhookNs string, certStorageDir string) ([]byte, error) {
+	klog.Infoln("creating self-signing TLS cert and key with namespace " + webhookNs + " in directory " + certStorageDir)
 	dnsNames := []string{"api",
-		"api.porch-system", "api.porch-system.svc"}
-	commonName := "api.porch-system.svc"
+		"api." + webhookNs, "api." + webhookNs + ".svc"}
+	commonName := "api." + webhookNs + ".svc"
 
 	var caPEM, serverCertPEM, serverPrivateKeyPEM *bytes.Buffer
 	// CA config
@@ -165,8 +165,8 @@ func WriteFile(filepath string, c []byte) error {
 	return nil
 }
 
-func createValidatingWebhook(ctx context.Context, caCert []byte) error {
-	klog.Infoln("Creating validating webhook")
+func createValidatingWebhook(ctx context.Context, webhookNs string, caCert []byte) error {
+	klog.Infoln("Creating validating webhook with namespace " + webhookNs)
 
 	cfg := ctrl.GetConfigOrDie()
 	kubeClient, err := kubernetes.NewForConfig(cfg)
@@ -175,7 +175,7 @@ func createValidatingWebhook(ctx context.Context, caCert []byte) error {
 	}
 
 	var (
-		webhookNamespace  = "porch-system"
+		webhookNamespace  = webhookNs
 		validationCfgName = "packagerev-deletion-validating-webhook"
 		webhookService    = "api"
 		path              = serverEndpoint
diff --git a/pkg/apiserver/webhooks_test.go b/pkg/apiserver/webhooks_test.go
index 9a24c9ca..5223148d 100644
--- a/pkg/apiserver/webhooks_test.go
+++ b/pkg/apiserver/webhooks_test.go
@@ -36,7 +36,7 @@ func TestCreateCerts(t *testing.T) {
 		require.NoError(t, os.RemoveAll(dir))
 	}()
 
-	caCert, err := createCerts(dir)
+	caCert, err := createCerts("", dir)
 	require.NoError(t, err)
 
 	caStr := strings.TrimSpace(string(caCert))

From 5ce3d0d7ffd44e3e98fd6d4d7efd7eb7066d83ba Mon Sep 17 00:00:00 2001
From: liamfallon <liam.fallon@est.tech>
Date: Fri, 1 Mar 2024 10:08:07 +0000
Subject: [PATCH 2/2] Updated date on copyright notices

---
 pkg/apiserver/apiserver.go     | 2 +-
 pkg/apiserver/webhooks.go      | 2 +-
 pkg/apiserver/webhooks_test.go | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index 3af6bc84..31e54eda 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -1,4 +1,4 @@
-// Copyright 2022 The kpt and Nephio Authors
+// Copyright 2022,2024 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/apiserver/webhooks.go b/pkg/apiserver/webhooks.go
index 48ecc0d5..934b20ef 100644
--- a/pkg/apiserver/webhooks.go
+++ b/pkg/apiserver/webhooks.go
@@ -1,4 +1,4 @@
-// Copyright 2022 The kpt and Nephio Authors
+// Copyright 2022,2024 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/apiserver/webhooks_test.go b/pkg/apiserver/webhooks_test.go
index 5223148d..84aad665 100644
--- a/pkg/apiserver/webhooks_test.go
+++ b/pkg/apiserver/webhooks_test.go
@@ -1,4 +1,4 @@
-// Copyright 2022 The kpt and Nephio Authors
+// Copyright 2022,2024 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.