Webhook deployment issues and certificate management

[kiki35135]

I'm unsure about the deployment process for webhook authorization. I've generated the certificates on my end, but I'm not sure how to push and use these certificates within the Cedar-authzWebhook pods. Have you encountered any issues if the cluster doesn't start?

[micahhausler]

Thanks for trying this out! Can you tell us a little more about your environment? Are you trying to run this in a cluster other than Kind?

If you are running this somewhere besides Kind, the authorization webhook will only work if you have control over Kubernetes API server configuration.

If you just want to run the admission webhook, we don't provide configuration for that (yet!), but it should be doable if you install cert-manager for certificates, build and push the container image to a registry, update the image in config/default/manager_webhook_patch.yaml, and run make deploy. There are probably steps I've missed in there, but that should get you 90% of the way.

[kiki35135]

Thank you for your response. Currently, I am not using cert-manager to manage certificates for the authorization webhook or any other webhook. I am testing different architectures:

1. Generating certificates locally with OpenSSL
2. Deploying the Cedar AuthZ webhook locally
3. Starting Kubernetes with Kind

This setup works well.

However, when I attempt to deploy the AuthZ webhook in Kubernetes, I encounter issues starting the API server through Kind. I would like to deploy the certificates and the AuthZ webhook using Kind. I use make kind and i thint the certficatannd authz Webhook deplay via the file in manifest folder :)

[micahhausler]

What is your use case to use OpenSSL with a Kind cluster? The webhook will automatically generate a certificate and key pair on startup, so for local testing, you shouldn't need to worry about certificate generation if you use the documented make kind and make admisison-webhook setup

[kiki35135]

Thanks a lot. When I test, the kind does not start my cluster because the api server does not find the authorization webhook :). I re-checked my kind config and the authentication webhook yaml in mount folder. I mus comment the ligneauthozation-config :
...
featureGates:
AuthorizeNodeWithSelectors: true
AuthorizeWithSelectors: true
kubeadmConfigPatches:

• |
  apiVersion: kubeadm.k8s.io/v1beta3
  kind: ClusterConfiguration
  apiServer:
  extraArgs:
  authorization-config: "/cedar-authorizer/authorization-config.yaml"
  audit-policy-file: "/cedar-authorizer/audit-policy.yaml"
  ...

[kiki35135]

I've relaunched ... I've still got kind running on a loop ... I think the API-SERVER can't find the webhook authorization.
How do you enable cert-manager and the other services defined in the config folder when deploying the cluster? I think I'm missing a config step before launching make kind.
Your Experimenation is very interested .

[kiki35135]

i continue tu troubleshhoot I modify the Kind.yml with comment line #authorization-config: "/cedar-authorizer/authorization-config.yaml"

I deploy cert-manager i find the certfiicate for cedar-authz-webhook

but i dont find the file mount/certs/cedar-authorizer-server.crt

But the Secrets is ok

Thks a lof for your help