Update webhook certs mountpath from /tmp directory to other path to eliminate security risk (#3685)

Author: vdkotkar

manifests/supervisorcluster/1.30/cns-csi.yaml

@@ -519,7 +519,7 @@ spec:
               readOnly: true
             - mountPath: /etc/vmware/wcp/tls/
               name: host-vmca
-            - mountPath: /tmp/k8s-webhook-server/serving-certs/client-ca
+            - mountPath: /etc/vmware/wcp/webhook-certs/client-ca
               name: client-ca
               readOnly: true
         - name: csi-snapshotter
@@ -818,6 +818,8 @@ spec:
       nodeSelector:
         node-role.kubernetes.io/control-plane: ""
       terminationGracePeriodSeconds: 10
+      securityContext:
+        fsGroup: 65533
       tolerations:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
@@ -860,11 +862,11 @@ spec:
             runAsUser: 65534
             runAsGroup: 65533
           volumeMounts:
-            - mountPath: /tmp/k8s-webhook-server/serving-certs
+            - mountPath: /etc/vmware/wcp/webhook-certs
               name: webhook-certs
               readOnly: true
       volumes:
         - name: webhook-certs
           secret:
-            defaultMode: 420
+            defaultMode: 0440
             secretName: vmware-system-csi-webhook-service-cert

manifests/supervisorcluster/1.31/cns-csi.yaml

@@ -519,7 +519,7 @@ spec:
               readOnly: true
             - mountPath: /etc/vmware/wcp/tls/
               name: host-vmca
-            - mountPath: /tmp/k8s-webhook-server/serving-certs/client-ca
+            - mountPath: /etc/vmware/wcp/webhook-certs/client-ca
               name: client-ca
               readOnly: true
         - name: csi-snapshotter
@@ -818,6 +818,8 @@ spec:
       nodeSelector:
         node-role.kubernetes.io/control-plane: ""
       terminationGracePeriodSeconds: 10
+      securityContext:
+        fsGroup: 65533
       tolerations:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
@@ -860,11 +862,11 @@ spec:
             runAsUser: 65534
             runAsGroup: 65533
           volumeMounts:
-            - mountPath: /tmp/k8s-webhook-server/serving-certs
+            - mountPath: /etc/vmware/wcp/webhook-certs
               name: webhook-certs
               readOnly: true
       volumes:
         - name: webhook-certs
           secret:
-            defaultMode: 420
+            defaultMode: 0440
             secretName: vmware-system-csi-webhook-service-cert

manifests/supervisorcluster/1.32/cns-csi.yaml

@@ -519,7 +519,7 @@ spec:
               readOnly: true
             - mountPath: /etc/vmware/wcp/tls/
               name: host-vmca
-            - mountPath: /tmp/k8s-webhook-server/serving-certs/client-ca
+            - mountPath: /etc/vmware/wcp/webhook-certs/client-ca
               name: client-ca
               readOnly: true
         - name: csi-snapshotter
@@ -818,6 +818,8 @@ spec:
       nodeSelector:
         node-role.kubernetes.io/control-plane: ""
       terminationGracePeriodSeconds: 10
+      securityContext:
+        fsGroup: 65533
       tolerations:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
@@ -860,11 +862,11 @@ spec:
             runAsUser: 65534
             runAsGroup: 65533
           volumeMounts:
-            - mountPath: /tmp/k8s-webhook-server/serving-certs
+            - mountPath: /etc/vmware/wcp/webhook-certs
               name: webhook-certs
               readOnly: true
       volumes:
         - name: webhook-certs
           secret:
-            defaultMode: 420
+            defaultMode: 0440
             secretName: vmware-system-csi-webhook-service-cert

pkg/syncer/admissionhandler/cnscsi_admissionhandler.go

@@ -43,6 +43,7 @@ const (
 	MutationWebhookPath              = "/mutate"
 	DefaultWebhookPort               = 9883
 	DefaultWebhookMetricsBindAddress = "0"
+	DefaultWebhookCertDir            = "/etc/vmware/wcp/webhook-certs"
 	devopsUserLabelKey               = "cns.vmware.com/user-created"
 	vmUIDLabelKey                    = "cns.vmware.com/vm-uid"
 	pvcUIDLabelKey                   = "cns.vmware.com/pvc-uid"
@@ -113,6 +114,7 @@ func startCNSCSIWebhookManager(ctx context.Context, enableWebhookClientCertVerif
 		},
 		WebhookServer: webhook.NewServer(webhook.Options{
 			Port:         webhookPort,
+			CertDir:      DefaultWebhookCertDir,
 			TLSOpts:      tlsConfigOpts,
 			ClientCAName: clientCAName,
 		})}