Allow override of Certificate resource fields for duration of webhook certs (#4105)

* Allow override Certificate fields for duration

* Add docs for new fields

* Update documentation text to be more precise

* fix typo

Author: usamaahmadkhan

helm/aws-load-balancer-controller/README.md

@@ -17,6 +17,7 @@ AWS Load Balancer controller manages the following AWS resources
 - Network Load Balancers to satisfy Kubernetes service objects of type LoadBalancer with appropriate annotations
 
 ## Security updates
+
 **Note**: Deployed chart does not receive security updates automatically. You need to manually upgrade to a newer chart.
 #### Node isolation
 As a security best practice, we recommend isolating the controller deployment pods to specific node groups which run critical components. The helm chart provides parameters ```nodeSelector```, ```tolerations``` and ```affinity``` to configure node isolation. For more information, please refer to the guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/multitenancy/#isolating-tenant-workloads-to-specific-nodes).
@@ -257,6 +258,8 @@ The default values set by the application itself can be confirmed [here](https:/
 | `podDisruptionBudget`                          | Limit the disruption for controller pods. Require at least 2 controller replicas and 3 worker nodes                                                                                                                                                                                                                                          | `{}`                                              |
 | `updateStrategy`                               | Defines the update strategy for the deployment                                                                                                                                                                                                                                                                                               | `{}`                                              |
 | `enableCertManager`                            | If enabled, cert-manager issues the webhook certificates instead of the helm template, requires cert-manager and it's CRDs to be installed                                                                                                                                                                                                   | `false`                                           |
+| `certManager.duration`                         | Overrides the default expiry duration for the webhook certificates. defaults to `90d`                                                                                                                                                                                           | `""`                                              |
+| `certManager.renewBefore`                      | Overrides the renewal time period duration for the webhook certificates. defaults to `60d`                                                                                                                                                                              | `""`                                              |
 | `enableEndpointSlices`                         | If enabled, controller uses k8s EndpointSlices instead of Endpoints for IP targets                                                                                                                                                                                                                                                           | `false`                                           |
 | `enableBackendSecurityGroup`                   | If enabled, controller uses shared security group for backend traffic                                                                                                                                                                                                                                                                        | `true`                                            |
 | `backendSecurityGroup`                         | Backend security group to use instead of auto created one if the feature is enabled                                                                                                                                                                                                                                                          | ``                                                |

helm/aws-load-balancer-controller/templates/webhook.yaml

@@ -237,6 +237,14 @@ spec:
     kind: Issuer
     name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
   secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
+  {{- with .Values.certManager -}}
+  {{ if .duration }}
+  duration: {{ .duration }}
+  {{- end }}
+  {{- if .renewBefore }}
+  renewBefore: {{ .renewBefore }}
+  {{- end }}
+  {{- end }}
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer

helm/aws-load-balancer-controller/values.yaml

@@ -115,6 +115,11 @@ additionalLabels: {}
 # Enable cert-manager
 enableCertManager: false
 
+# Overrideable variables when enableCertManager is set to true
+certManager:
+  duration:
+  renewBefore:
+
 # The name of the Kubernetes cluster. A non-empty value is required
 clusterName: