Support configuring securePort in webhook service

Signed-off-by: James Munnelly <jmunnelly@apple.com>

deploy/charts/cert-manager/templates/webhook-deployment.yaml

@@ -79,11 +79,21 @@ spec:
           ports:
           - name: https
             protocol: TCP
+            {{- if $config.securePort }}
+            containerPort: {{ $config.securePort }}
+            {{- else if .Values.webhook.securePort }}
             containerPort: {{ .Values.webhook.securePort }}
+            {{- else }}
+            containerPort: 6443
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /livez
+              {{- if $config.healthzPort }}
+              port: {{ $config.healthzPort }}
+              {{- else }}
               port: 6080
+              {{- end }}
               scheme: HTTP
             initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
             periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
@@ -93,7 +103,11 @@ spec:
           readinessProbe:
             httpGet:
               path: /healthz
+              {{- if $config.healthzPort }}
+              port: {{ $config.healthzPort }}
+              {{- else }}
               port: 6080
+              {{- end }}
               scheme: HTTP
             initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
             periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}

deploy/charts/cert-manager/templates/webhook-service.yaml

@@ -25,7 +25,7 @@ spec:
   - name: https
     port: 443
     protocol: TCP
-    targetPort: {{ .Values.webhook.securePort }}
+    targetPort: "https"
   selector:
     app.kubernetes.io/name: {{ include "webhook.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

deploy/charts/cert-manager/values.yaml

@@ -214,6 +214,15 @@ webhook:
     # apiVersion: config.webhook.cert-manager.io/v1alpha1
     # kind: WebhookConfiguration
 
+    # The port that the webhook should listen on for requests.
+    # In GKE private clusters, by default kubernetes apiservers are allowed to
+    # talk to the cluster nodes only on 443 and 10250. so configuring
+    # securePort: 10250, will work out of the box without needing to add firewall
+    # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
+    # This should be uncommented and set as a default by the chart once we graduate
+    # the apiVersion of WebhookConfiguration past v1alpha1.
+    # securePort: 10250
+
   strategy: {}
     # type: RollingUpdate
     # rollingUpdate: