Manage external cert

[kangclzjc]

What type of PR is this?

Currently we do the certificate generation ourselves. If they already have certificate in their system, we should manage external existing certificate by mounting them

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a API change?

Additional documentation e.g., enhancement proposals, usage docs, etc.:

[gflarity]

Hmm... maybe just default to auto provision in the code if SecretName isn't set, then the user doesn't have to remember to disable and we don't need to track this variable.

[kangclzjc]

You're right. It seems that we can detect secretName or certFilesPath user want to mount to decide whether to auto provision

[gflarity]

As discussed, let's simplify the logic by enabling automatic certs when the secretName isn't provided.

[kangclzjc]

As discussed, let's simplify the logic by enabling automatic certs when the secretName isn't provided.
Currently， this ps will implement these feature:

1. If enable certManagerEnabled, then certmanager should handle the certificate/secret creation process
2. if certFilesPath is not empty, then we only mount the certfiles into grove operator pod
3. if certManagerEnabled and certFilesPath are not provided, then we use the default auto provision logic which currently is cert controller

[gflarity]

Thanks, left an example that I implemented a while ago (running in production for some time now). The only difference is we need to enable auto provision. Otherwise you can just follow this.

[gflarity]

Sorry for the delay, planning to review this today.

[gflarity]

Thanks @kangclzjc, gave it a quick review today. Looks good, I'll do a slower review tomorrow morning first thing. In the mean time:

One thing we'll need is a simple E2E test to verifying everything works using cert manager. Please take a look at the current E2E tests, all it really needs to do is install cert manager, then update the helm values to use it. If you start a simple grove deployment successfully, it means the webhooks are still working with this change.

There is code in the cluster setup utilities for installing a helm chart (cert manager). You should be able to reuse some of that logic to install cert manager for this specific test. Please let me know if you have any questions.

[kangclzjc]

Thanks @kangclzjc, gave it a quick review today. Looks good, I'll do a slower review tomorrow morning first thing. In the mean time:

One thing we'll need is a simple E2E test to verifying everything works using cert manager. Please take a look at the current E2E tests, all it really needs to do is install cert manager, then update the helm values to use it. If you stat a simple grove deployment successfully, it means the webhooks are still working with this change.

There code in the cluster setup utilities for installing a helm chart (cert manager). You should be able to reuse some of that logic to install cert manager for this specific test. Please let me know if you have any questions.

Thanks @gflarity , let me check the E2E test first. And then do a simple E2E test to verifying everything works using cert manager.

[gflarity]

Just a couple small things, otherwise looks good. Just need the E2E test(s).

[gflarity]

There's a default column, let's fill it in.

Suggested change

	| `secretName` _string_ | SecretName is the name of the Kubernetes Secret containing webhook certificates.<br />The Secret must contain tls.crt, tls.key, and ca.crt. | | |
	| `autoProvision` _boolean_ | AutoProvision enables automatic certificate generation and management via cert-controller.<br />When true: cert-controller automatically generates self-signed certificates and stores them in the Secret.<br />When false: certificates are expected to be provided externally (e.g., by cert-manager, cluster admin).<br />Default: true (auto-generate certificates for easy setup) | | |
	| `secretName` _string_ | SecretName is the name of the Kubernetes Secret containing webhook certificates.<br />The Secret must contain tls.crt, tls.key, and ca.crt. | grove-webhook-server-cert | |
	| `autoProvision` _boolean_ | AutoProvision enables automatic certificate generation and management via cert-controller.<br />When true: cert-controller automatically generates self-signed certificates and stores them in the Secret.<br />When false: certificates are expected to be provided externally (e.g., by cert-manager, cluster admin).| true | |

[kangclzjc]

OK~

[gflarity]

Set this to "grove-webhook-server-cert" to match the default in the code? That way anyone reading the values knows where to look in Kubernetes.

[kangclzjc]

Yes, no problem