hardened webhook certificate management and rotation

Author: Firanzo

charts/typesense-operator/templates/deployment.yaml

@@ -66,6 +66,9 @@ spec:
         - containerPort: 9443
           name: webhook-server
           protocol: TCP
+        - containerPort: 8081
+          name: health
+          protocol: TCP
         readinessProbe:
           httpGet:
             path: /readyz
@@ -78,7 +81,7 @@ spec:
           | nindent 10 }}
         volumeMounts:
         - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: webhook-certs
+          name: cert-dir
       nodeSelector: {{- toYaml .Values.controllerManager.nodeSelector | nindent 8 }}
       securityContext: {{- toYaml .Values.controllerManager.podSecurityContext | nindent
         8 }}
@@ -90,4 +93,4 @@ spec:
         | nindent 8 }}
       volumes:
       - emptyDir: {}
-        name: webhook-certs
+        name: cert-dir

charts/typesense-operator/values.yaml

@@ -16,6 +16,7 @@ controllerManager:
       capabilities:
         drop:
         - ALL
+      readOnlyRootFilesystem: true
     image:
       repository: example.com/typesense-operator
       tag: v0.0.1