Skip to content

operator: store generated CA cert and TLS keys in k8s secret - #2833

Open
KushagraB424 wants to merge 1 commit into
kubearmor:mainfrom
KushagraB424:fix-operator-ca-secret
Open

operator: store generated CA cert and TLS keys in k8s secret#2833
KushagraB424 wants to merge 1 commit into
kubearmor:mainfrom
KushagraB424:fix-operator-ca-secret

Conversation

@KushagraB424

Copy link
Copy Markdown

Purpose of PR?:
Stores the generated CA certificate and TLS keys for the MutatingWebhookConfiguration in a Kubernetes Secret (kubearmor-controller-webhook-server-cert). On operator restarts, it reuses them if they are still valid instead of unconditionally generating new ones. This resolves the TODO: Keep CA certificate in k8s secret comment in resources.go.

Fixes #2832

Does this PR introduce a breaking change?
No

If the changes in this PR are manually verified, list down the scenarios covered::

  • Verified that KubeArmorOperator successfully compiles.
  • Verified that restarting the operator pod successfully reuses the existing CA and TLS certificates from the kubearmor-controller-webhook-server-cert secret without regenerating them, avoiding unnecessary webhook configuration updates.

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

@AryanBakliwal
AryanBakliwal force-pushed the fix-operator-ca-secret branch from f1c83cc to 96ffef3 Compare August 10, 2026 04:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Operator] Store generated CA certificate and TLS keys in a Kubernetes Secret

1 participant