addressing pr comments

secret-injector/deploy/mutatingwebhook.yaml

@@ -1,14 +1,15 @@
 apiVersion: admissionregistration.k8s.io/v1beta1
 kind: MutatingWebhookConfiguration
 metadata:
-  name: op-secret-injector-webhook-cfg
+  name: op-secret-injector-webhook-config
   labels:
     app: op-secret-injector
 webhooks:
-- name: op-secret-injector.morven.me
+- name: op-secret-injector.1password
+  failurePolicy: Fail
   clientConfig:
     service:
-      name: op-secret-injector-webhook-svc
+      name: op-secret-injector-webhook-service
       namespace: op-secret-injector
       path: "/inject"
     caBundle: ${CA_BUNDLE}

secret-injector/deploy/service.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: op-secret-injector-webhook-svc
+  name: op-secret-injector-webhook-service
   namespace: op-secret-injector
   labels:
     app: op-secret-injector

secret-injector/deploy/webhook-create-signed-cert.sh

@@ -1,131 +0,0 @@
-#!/bin/bash
-
-set -e
-
-usage() {
-    cat <<EOF
-Generate certificate suitable for use with an op-secret-injector webhook service.
-
-This script uses k8s' CertificateSigningRequest API to a generate a
-certificate signed by k8s CA suitable for use with op-secret-injector webhook
-services. This requires permissions to create and approve CSR. See
-https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster for
-detailed explanation and additional instructions.
-
-The server key/cert k8s CA cert are stored in a k8s secret.
-
-usage: ${0} [OPTIONS]
-
-The following flags are required.
-
-       --service          Service name of webhook.
-       --namespace        Namespace where webhook service and secret reside.
-       --secret           Secret name for CA certificate and server certificate/key pair.
-EOF
-    exit 1
-}
-
-while [[ $# -gt 0 ]]; do
-    case ${1} in
-        --service)
-            service="$2"
-            shift
-            ;;
-        --secret)
-            secret="$2"
-            shift
-            ;;
-        --namespace)
-            namespace="$2"
-            shift
-            ;;
-        *)
-            usage
-            ;;
-    esac
-    shift
-done
-
-[ -z "${service}" ] && service=op-secret-injector-webhook-svc
-[ -z "${secret}" ] && secret=op-secret-injector-webhook-certs
-[ -z "${namespace}" ] && namespace=default
-
-if [ ! -x "$(command -v openssl)" ]; then
-    echo "openssl not found"
-    exit 1
-fi
-
-csrName=${service}.${namespace}
-tmpdir=$(mktemp -d)
-echo "creating certs in tmpdir ${tmpdir} "
-
-cat <<EOF >> "${tmpdir}"/csr.conf
-[req]
-req_extensions = v3_req
-distinguished_name = req_distinguished_name
-[req_distinguished_name]
-[ v3_req ]
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-[alt_names]
-DNS.1 = ${service}
-DNS.2 = ${service}.${namespace}
-DNS.3 = ${service}.${namespace}.svc
-EOF
-
-openssl genrsa -out "${tmpdir}"/server-key.pem 2048
-openssl req -new -key "${tmpdir}"/server-key.pem -subj "/CN=${service}.${namespace}.svc" -out "${tmpdir}"/server.csr -config "${tmpdir}"/csr.conf
-
-# clean-up any previously created CSR for our service. Ignore errors if not present.
-kubectl delete csr ${csrName} 2>/dev/null || true
-
-# create  server cert/key CSR and  send to k8s API
-cat <<EOF | kubectl create -f -
-apiVersion: certificates.k8s.io/v1beta1
-kind: CertificateSigningRequest
-metadata:
-  name: ${csrName}
-spec:
-  groups:
-  - system:authenticated
-  request: $(< "${tmpdir}"/server.csr base64 | tr -d '\n')
-  usages:
-  - digital signature
-  - key encipherment
-  - server auth
-EOF
-
-# verify CSR has been created
-while true; do
-    if kubectl get csr ${csrName}; then
-        break
-    else
-        sleep 1
-    fi
-done
-
-# approve and fetch the signed certificate
-kubectl certificate approve ${csrName}
-# verify certificate has been signed
-for _ in $(seq 10); do
-    serverCert=$(kubectl get csr ${csrName} -o jsonpath='{.status.certificate}')
-    if [[ ${serverCert} != '' ]]; then
-        break
-    fi
-    sleep 1
-done
-if [[ ${serverCert} == '' ]]; then
-    echo "ERROR: After approving csr ${csrName}, the signed certificate did not appear on the resource. Giving up after 10 attempts." >&2
-    exit 1
-fi
-echo "${serverCert}" | openssl base64 -d -A -out "${tmpdir}"/server-cert.pem
-
-
-# create the secret with CA cert and server cert/key
-kubectl create secret generic ${secret} \
-        --from-file=key.pem="${tmpdir}"/server-key.pem \
-        --from-file=cert.pem="${tmpdir}"/server-cert.pem \
-        --dry-run -o yaml |
-    kubectl -n ${namespace} apply -f -

secret-injector/deploy/webhook-patch-ca-bundle.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-CA_BUNDLE=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}')
-
-if [ -z "${CA_BUNDLE}" ]; then
-    CA_BUNDLE=$(kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='default')].data.ca\.crt}")
-fi
-
-export CA_BUNDLE
-
-if command -v envsubst >/dev/null 2>&1; then
-    envsubst
-else
-    sed -e "s|\${CA_BUNDLE}|${CA_BUNDLE}|g"
-fi