From 175f13e1363f09db8e35037af423446a7d3f276a Mon Sep 17 00:00:00 2001
From: Daniel Morsing <dmo@jetstack.io>
Date: Mon, 18 Feb 2019 15:56:48 +0000
Subject: [PATCH 1/2] watch TLS cert file

The admissions server middleware we use doesn't want to do
hot-reloading, so instead, watch the file and if it changes, have
the k8s server restart the webhook

Signed-off-by: Daniel Morsing <dmo@jetstack.io>
---
 cmd/webhook/main.go | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
index 481c542ef..ffae3f2ff 100644
--- a/cmd/webhook/main.go
+++ b/cmd/webhook/main.go
@@ -18,6 +18,8 @@ package main
 
 import (
 	"flag"
+	"os"
+	"time"
 
 	"github.com/openshift/generic-admission-server/pkg/cmd"
 
@@ -32,9 +34,43 @@ func main() {
 	// Avoid "logging before flag.Parse" errors from glog
 	flag.CommandLine.Parse([]string{})
 
+	// parse the command line flags to pull out the tls-cert-file
+	// argument. This flag will be parsed by code inside cmd.RunAdmissionServer
+	// so no need to pass it through the call stack or have nice errors
+	tlsflagSet := flag.NewFlagSet("tls", flag.ContinueOnError)
+	tlsflagVal := tlsflagSet.String("tls-cert-file", "", "")
+	tlsflagSet.Parse(os.Args[1:])
+	if *tlsflagVal != "" {
+		runfilewatch(*tlsflagVal)
+	}
+
 	cmd.RunAdmissionServer(
 		certHook,
 		issuerHook,
 		clusterIssuerHook,
 	)
 }
+
+func runfilewatch(filename string) {
+	info, err := os.Stat(filename)
+	if err != nil {
+		// missing TLS cert file will get turned into a proper error later
+		return
+	}
+	modtime := info.ModTime()
+	go func() {
+		for {
+			time.Sleep(1 * time.Minute)
+			info, err := os.Stat(filename)
+			if err != nil {
+				continue
+			}
+			if info.ModTime().After(modtime) {
+				// let the k8s scheduler restart us
+				// TODO(dmo): figure out if there's a way to do this with clean
+				// shutdown
+				os.Exit(0)
+			}
+		}
+	}()
+}

From af019ad1e8dd46b7054203bd7774373e241831a5 Mon Sep 17 00:00:00 2001
From: Daniel Morsing <dmo@jetstack.io>
Date: Mon, 18 Feb 2019 16:22:37 +0000
Subject: [PATCH 2/2] add log line when restarting

Signed-off-by: Daniel Morsing <dmo@jetstack.io>
---
 cmd/webhook/BUILD.bazel | 1 +
 cmd/webhook/main.go     | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/cmd/webhook/BUILD.bazel b/cmd/webhook/BUILD.bazel
index 2493501c6..581f561a5 100644
--- a/cmd/webhook/BUILD.bazel
+++ b/cmd/webhook/BUILD.bazel
@@ -14,6 +14,7 @@ go_library(
     visibility = ["//visibility:private"],
     deps = [
         "//pkg/apis/certmanager/validation/webhooks:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/github.com/openshift/generic-admission-server/pkg/cmd:go_default_library",
     ],
 )
diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
index ffae3f2ff..cb4220734 100644
--- a/cmd/webhook/main.go
+++ b/cmd/webhook/main.go
@@ -21,6 +21,7 @@ import (
 	"os"
 	"time"
 
+	"github.com/golang/glog"
 	"github.com/openshift/generic-admission-server/pkg/cmd"
 
 	"github.com/jetstack/cert-manager/pkg/apis/certmanager/validation/webhooks"
@@ -69,6 +70,7 @@ func runfilewatch(filename string) {
 				// let the k8s scheduler restart us
 				// TODO(dmo): figure out if there's a way to do this with clean
 				// shutdown
+				glog.Info("Detected change in TLS certificate %s. Restarting to pick up new certificate", filename)
 				os.Exit(0)
 			}
 		}