Add webhookconfig checksum to deployment annotations #269
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changing the webhook sometimes results into the creation of a new certificate and because of that an updated secret.
The updated secret introduces the following error:
tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "opa-admission-ca")
The secret is updated in the pod (since kubernetes automatically updates mounted secrets and configmaps), but the OPA process does not reload the secrets. After restarting the pods the issue is solved, we now how to do this manually for each update to this chart.
Adding the sha256 of the certificate secret as an annotation will result in an update to the deployment and thus restarting its pods.