dynamic host creation

config.yaml

@@ -13,3 +13,6 @@ mutate-ignored-images:
 - goharbor/redis-photon
 - goharbor/registry-photon
 - goharbor/trivy-adapter-photon
+kubernetes:
+  namespace: ingress-nginx
+  service-name: webhook

internal/certificate/create-csr.go

@@ -11,7 +11,9 @@ import (
 	"encoding/pem"
 )
 
-func CreateCSR(privateKey string) (string, error) {
+func CreateCSR(privateKey string, dnsNames []string) (string, error) {
+	dnsNames = append(dnsNames, "*.svc.cluster.local")
+
 	csr := x509.CertificateRequest{
 		Subject: pkix.Name{
 			Organization: []string{"Kubernetes Mutating Webserver"},
@@ -21,14 +23,7 @@ func CreateCSR(privateKey string) (string, error) {
 			//StreetAddress: []string{""},
 			//PostalCode:    []string{""},
 		},
-		DNSNames: []string{
+		DNSNames: dnsNames,
-			"webhook",
-			"webhook.ingress-nginx",
-			"webhook.ingress-nginx.svc",
-			"webhook.ingress-nginx.svc.cluster",
-			"webhook.ingress-nginx.svc.cluster.local",
-			"*.svc.cluster.local",
-		},
 		SignatureAlgorithm: x509.SHA384WithRSA,
 	}
 

internal/config/config.go

@@ -44,6 +44,10 @@ type Config struct {
 	CAPrivateKey   string `env:"ca_private_key"`
 	CertCert       string `env:"cert_cert"`
 	CertPrivateKey string `env:"cert_private_key"`
+
+	// kubernetes configuration
+	NameSpace string `env:"namespace" default:"ingress-nginx"`
+	ServiceName string `env:"service_name" default:"webhook"`
 }
 
 // DefaultConfig initializes the config variable for use with a prepared set of defaults.

internal/config/configFile.go

@@ -9,12 +9,13 @@ import (
 )
 
 type configFileStruct struct {
-	AllowAdminNoMutate       bool       `yaml:"allow-admin-nomutate"`
+	AllowAdminNoMutate       bool             `yaml:"allow-admin-nomutate"`
-	AllowAdminNoMutateToggle string     `yaml:"allow-admin-nomutate-toggle"`
+	AllowAdminNoMutateToggle string           `yaml:"allow-admin-nomutate-toggle"`
-	DockerhubRegistry        string     `yaml:"dockerhub-registry"`
+	DockerhubRegistry        string           `yaml:"dockerhub-registry"`
-	MutateIgnoredImages      []string   `yaml:"mutate-ignored-images"`
+	MutateIgnoredImages      []string         `yaml:"mutate-ignored-images"`
-	CertificateAuthority     CertStruct `yaml:"certificate-authority"`
+	CertificateAuthority     CertStruct       `yaml:"certificate-authority"`
-	Certificate              CertStruct `yaml:"certificate"`
+	Certificate              CertStruct       `yaml:"certificate"`
+	Kubernetes               KubernetesStruct `yaml:"kubernetes"`
 }
 
 type CertStruct struct {
@@ -23,6 +24,11 @@ type CertStruct struct {
 	PublicKey   string `yaml:"public-key"`
 }
 
+type KubernetesStruct struct {
+	Namespace   string `yaml:"namespace"`
+	ServiceName string `yaml:"service-name"`
+}
+
 func getConfigFileData(fileLocation string) (configFileStruct, error) {
 	// does file exist
 	if _, err := os.Stat(fileLocation); os.IsNotExist(err) {

internal/config/initialize.go

@@ -104,6 +104,12 @@ func updateValues(cfg *Config, configFileData configFileStruct) {
 	if cfg.DockerhubRegistry == "registry.hub.docker.com" && configFileData.DockerhubRegistry != "registry.hub.docker.com" {
 		cfg.DockerhubRegistry = configFileData.DockerhubRegistry
 	}
+	if cfg.NameSpace == "ingress-nginx" && configFileData.Kubernetes.Namespace != "ingress-nginx" {
+		cfg.NameSpace = configFileData.Kubernetes.Namespace
+	}
+	if cfg.ServiceName == "webhook" && configFileData.Kubernetes.ServiceName != "webhook" {
+		cfg.ServiceName = configFileData.Kubernetes.ServiceName
+	}
 	if len(configFileData.MutateIgnoredImages) != 0 {
 		cfg.MutateIgnoredImages = configFileData.MutateIgnoredImages
 	}
@@ -167,7 +173,7 @@ func certificateInit(cfg *Config) error {
 	// certificate certificate is missing, create it
 	if len(cfg.CertCert) == 0 {
 		log.Printf("[TRACE] No server certificate detected")
-		csr, err := certificate.CreateCSR(cfg.CertPrivateKey)
+		csr, err := certificate.CreateCSR(cfg.CertPrivateKey, getDNSNames(cfg.NameSpace, cfg.ServiceName))
 		if err != nil {
 			return fmt.Errorf("Create CSR (%v)", err)
 		}
@@ -180,3 +186,14 @@ func certificateInit(cfg *Config) error {
 
 	return nil
 }
+
+func getDNSNames(ns, service string) []string {
+	return []string{
+		fmt.Sprintf("%s", service),
+		fmt.Sprintf("%s.%s", service, ns),
+		fmt.Sprintf("%s.%s", service, ns),
+		fmt.Sprintf("%s.%s.svc", service, ns),
+		fmt.Sprintf("%s.%s.svc.cluster", service, ns),
+		fmt.Sprintf("%s.%s.svc.cluster.local", service, ns),
+	}
+}