Support cert-manager for admission webhooks

[elanv]

trafficstars

In order to automatically renew certificates, cert-manager is widely used in the k8s production environments. I think we should support cert-manager for webhooks.

[functicons]

Originally it is supported, then replaced by the current approach, we can consider adding it back as an option.

[Mrart]

I think it don't need support cert-manager , It is too heavy for operator. So If you used this ,you neen maintained it? we have use this operator in product env, and delete the cert-manager.

[functicons]

cert-manager is not mandatory, but some users might want to use it for the reasons mentioned by @elanv.

[elanv]

We use cert-mananger in our operating environment. It seems very cumbersome to remember and manually renew the expiration of many certificates without cert-mananger on a large cluster.

[jlewi]

I thought using cert manager was the recommended way to generate certificates for webhooks with kubebuilder built CRDs?

It is too heavy for operator

Could you say more? It looks like it was removed in #167 but the PR doesn't provide much information about why it was removed?

[stylius]

I also agree that cert-manager should be used for webhook certificates. It is too much of a burden to manually maintain certificates across multiple clusters. It may not be instant, but K8S is self healing and will recover once the certificates are ready, unlike when the chart release is updated. This breaks certificates and requires manual intervention.