Merge pull request #8249 from vflaux/fix_8248

fix(VPA): Do not update webhook CA when registerWebhook is disabled

Author: k8s-ci-robot

vertical-pod-autoscaler/pkg/admission-controller/certs.go

@@ -68,8 +68,11 @@ func (cr *certReloader) start(stop <-chan struct{}) error {
 	if err = watcher.Add(cr.tlsKeyPath); err != nil {
 		return err
 	}
-	if err = watcher.Add(cr.clientCaPath); err != nil {
-		return err
+	// we watch the CA file ony when registerWebhook is enabled
+	if cr.mutatingWebhookClient != nil {
+		if err = watcher.Add(cr.clientCaPath); err != nil {
+			return err
+		}
 	}
 
 	go func() {
@@ -123,6 +126,10 @@ func (cr *certReloader) load() error {
 
 func (cr *certReloader) reloadWebhookCA() error {
 	client := cr.mutatingWebhookClient
+	if client == nil {
+		// this should never happen as we don't watch the file if mutatingWebhookClient is nil
+		return fmt.Errorf("webhook client is not set")
+	}
 	webhook, err := client.Get(context.TODO(), webhookConfigName, metav1.GetOptions{})
 	if err != nil {
 		return err

vertical-pod-autoscaler/pkg/admission-controller/main.go

@@ -27,6 +27,7 @@ import (
 	"github.com/spf13/pflag"
 	"k8s.io/client-go/informers"
 	kube_client "k8s.io/client-go/kubernetes"
+	typedadmregv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 	kube_flag "k8s.io/component-base/cli/flag"
 	"k8s.io/klog/v2"
 
@@ -141,9 +142,13 @@ func main() {
 		as.Serve(w, r)
 		healthCheck.UpdateLastActivity()
 	})
+	var mutatingWebhookClient typedadmregv1.MutatingWebhookConfigurationInterface
+	if *registerWebhook {
+		mutatingWebhookClient = kubeClient.AdmissionregistrationV1().MutatingWebhookConfigurations()
+	}
 	server := &http.Server{
 		Addr:      fmt.Sprintf(":%d", *port),
-		TLSConfig: configTLS(*certsConfiguration, *minTlsVersion, *ciphers, stopCh, kubeClient.AdmissionregistrationV1().MutatingWebhookConfigurations()),
+		TLSConfig: configTLS(*certsConfiguration, *minTlsVersion, *ciphers, stopCh, mutatingWebhookClient),
 	}
 	url := fmt.Sprintf("%v:%v", *webhookAddress, *webhookPort)
 	ignoredNamespaces := strings.Split(commonFlags.IgnoredVpaObjectNamespaces, ",")