fix

Signed-off-by: SequeI <[email protected]>

Author: SequeI

ci/init-certs.sh

@@ -1,33 +1,81 @@
 #!/bin/bash
-# Script to generate TLS assets and patch the ValidatingWebhookConfiguration
-set -eo pipefail
+# Generate TLS certificates for testing environment using cfssl.
+set -euo pipefail
 
-WEBHOOK_SVC="rhtas-controller-manager-webhook-service"
+CERT_DIR="${1:-/tmp}" 
+
+WEBHOOK_SVC_NAME="controller-manager-webhook-service"
 WEBHOOK_NS="openshift-rhtas-operator"
-WEBHOOK_DNS="${WEBHOOK_SVC}.${WEBHOOK_NS}.svc"
-CERT_DIR="/tmp/k8s-webhook-certs"
-
-mkdir -p ${CERT_DIR}
-cd ${CERT_DIR}
-
-cat > openssl.cnf <<EOF
-[req]
-distinguished_name = req_distinguished_name
-commonName = Webhook-Server
-commonName_max = 64
-prompt = no
-[SAN]
-subjectAltName = DNS:${WEBHOOK_DNS}
+WEBHOOK_FQDN_1="${WEBHOOK_SVC_NAME}.${WEBHOOK_NS}.svc"
+WEBHOOK_FQDN_2="${WEBHOOK_SVC_NAME}.${WEBHOOK_NS}.svc.cluster.local"
+WEBHOOK_CONFIG_NAME="rhtas-validation.securesigns.rhtas.redhat.com"
+SECRET_NAME="webhook-server-tls"
+
+echo "Generating TLS certificates for webhook in ${CERT_DIR}..."
+
+mkdir -p "${CERT_DIR}"
+
+cat > "${CERT_DIR}/ca-config.json" <<EOF
+{
+  "signing": {
+    "default": {
+      "expiry": "175200h"
+    },
+    "profiles": {
+      "default": {
+        "usages": ["signing", "key encipherment", "server auth", "client auth"],
+        "expiry": "175200h"
+      }
+    }
+  }
+}
 EOF
 
-openssl genrsa -out ca.key 4096
-openssl req -new -x509 -key ca.key -out ca.crt -days 365 -subj "/CN=Admission-Webhook-CA"
+cat > "${CERT_DIR}/ca-csr.json" <<EOF
+{
+  "hosts": [
+    "${WEBHOOK_FQDN_1}",
+    "${WEBHOOK_FQDN_2}",
+    "localhost",
+    "127.0.0.1"
+  ],
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "C": "AU",
+      "L": "Melbourne",
+      "O": "Example",
+      "OU": "CA",
+      "ST": "Example"
+    }
+  ]
+}
+EOF
+
+cfssl gencert -initca "${CERT_DIR}/ca-csr.json" | cfssljson -bare "${CERT_DIR}/ca"
+
+cfssl gencert \
+  -ca="${CERT_DIR}/ca.pem" \
+  -ca-key="${CERT_DIR}/ca-key.pem" \
+  -config="${CERT_DIR}/ca-config.json" \
+  -hostname="${WEBHOOK_FQDN_1},${WEBHOOK_FQDN_2},localhost,127.0.0.1" \
+  -profile=default \
+  "${CERT_DIR}/ca-csr.json" | cfssljson -bare "${CERT_DIR}/example-webhook"
 
-openssl req -new -newkey rsa:4096 -keyout tls.key -out tls.csr -nodes -config openssl.cnf -extensions SAN
+cp "${CERT_DIR}/example-webhook.pem" "${CERT_DIR}/tls.crt"
+cp "${CERT_DIR}/example-webhook-key.pem" "${CERT_DIR}/tls.key"
+cp "${CERT_DIR}/ca.pem" "${CERT_DIR}/ca.crt"
 
-openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out tls.crt -days 365 -extfile openssl.cnf -extensions SAN
+echo "TLS certificates generated:"
+echo "  - CA certificate: ${CERT_DIR}/ca.crt"
+echo "  - TLS certificate: ${CERT_DIR}/tls.crt"
+echo "  - TLS private key: ${CERT_DIR}/tls.key"
 
-kubectl create secret tls webhook-server-tls \
+echo "Creating TLS Secret '${SECRET_NAME}' in namespace '${WEBHOOK_NS}'..."
+kubectl create secret tls "${SECRET_NAME}" \
   --cert=tls.crt \
   --key=tls.key \
-  -n ${WEBHOOK_NS} --dry-run=client -o yaml | kubectl apply -f -
+  -n "${WEBHOOK_NS}" --dry-run=client -o yaml | kubectl apply -f -