feat: use cert-controller rotator for server certs

[aramase]

Signed-off-by: Anish Ramasekar [email protected]

Reason for Change:

Requirements

• squashed commits
• included documentation
• added unit tests and e2e tests (if applicable).

Issue Fixed:

fixes #91

Please answer the following questions with yes/no:

Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?

• yes
• no

The changes have been inspired by the gatekeeper project: https://github.com/open-policy-agent/gatekeeper

Notes for Reviewers:
Doc update to remove cert-manager requirement/install will be done at the time of release.

[aramase]

Had to add this sleep because the mount timing isn't deterministic. @sozercan Is there anything in this change that's different from gatekeeper that you think could cause the delay?

I think the secret data isn't up-to-date during the initial mount republish by kubelet and it only succeeds in the next republish loop.

[sozercan]

Couldn't repro this

[chewong]

pending review from @sozercan

new comments

[chewong]

Let's remove the following volume mount in third_party/open-policy-agent/gatekeeper/helmify/kustomize-for-helm.yaml, which was merged to the helm chart template:

        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true