Adding support for the webhook injector to be able to inject a cert into the mutated Pods using an environment var.

[gdasson]

• This PR adds the option for the webhook injector to be able to inject a cert into the mutated Pods using an environment var.
• This PR is an implementation of what has been suggested and explained very well here by @joemiller
• The newly introduced env variable for injector: AGENT_INJECT_VAULT_CACERT_VALUE could be supplied with a base64 encoded certificate string or plaintext.
• This PR provides a solution for the below issues/questions:
  Cannot specify root CA for external vault over HTTPS vault-helm#339
  Mechanism for injecting vault-ca.crt #19
  Unable to inject Vault CA into Vault Helm chart, injector complains w/self-signed cert vault-helm#777
  custom CA for external vault server #83

[hashicorp-cla]

All committers have signed the CLA.

[gdasson]

Hello @swenson, @jasonodonnell , @tvoran : Could you please review this PR? It has been pending review for a while. Thanks.

[aboukhal]

Until this very desirable PR gets merged, this is a valid work-around.

Dockerfile:

FROM hashicorp/vault:1.12.1
ENV VAULT_CAPATH /vault/tls/ca-cert.pem
COPY my-vault-certificate-chain.pem /vault/tls/ca-cert.pem

And then using that image in the helm chart values at injector.agentImage.

[alnet]

I would also like to see this merged as we've just run into this exact issue today when building out a k3s cluster that will use an externally hosted vault. We'll be looking into the work around, but it's a shame to have to maintain a local image for such a tiny change.

[tomhjp]

👋 thanks for opening this PR and for all the +1s, I've been looking into whether we could use VAULT_CACERT_BYTES, which as has been mentioned elsewhere had the potential to simplify this feature by eliminating the need for the CA to be written to a file. Unfortunately my testing showed up that consul-template hasn't implemented support for that env var yet, so I ended up adding a very similar file step anyway. I've opened #507 which has a lot of the same ideas as in this PR (+ some extra testing automation work), but once consul-template supports VAULT_CACERT_BYTES there are a few bits of code that we can delete and the rest should continue working without needing to write a file.

I'd welcome any comments on #507 - my intention is that it should be very well aligned with the outcome of this PR.

[tomhjp]

Thanks again for the PR - #507 is merged now and should be released pretty soon.