Reimplement katib-cert-generator in Go

cmd/cert-generator/v1beta1/Dockerfile

@@ -1,13 +1,29 @@
-FROM alpine:3.12.4
+# Build the Katib Cert Generatoe.
+FROM golang:alpine AS build-env
 
-ARG KUBECTL_VERSION="v1.19.3"
+WORKDIR /go/src/github.com/kubeflow/katib
 
-RUN apk add --update openssl
-RUN wget https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl \
-  && chmod +x ./kubectl && mv ./kubectl /usr/local/bin/kubectl
+# Download packages.
+COPY go.mod .
+COPY go.sum .
+RUN go mod download -x
 
-COPY ./hack/cert-generator.sh /app/cert-generator.sh
-RUN chmod +x /app/cert-generator.sh
+# Copy sources.
+COPY cmd/ cmd/
+COPY pkg/ pkg/
 
+# Build the binary.
+RUN if [ "$(uname -m)" = "ppc64le" ]; then \
+    CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -a -o katib-cert-generator ./cmd/cert-generator/v1beta1; \
+    elif [ "$(uname -m)" = "aarch64" ]; then \
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -o katib-cert-generator ./cmd/cert-generator/v1beta1; \
+    else \
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -o katib-cert-generator ./cmd/cert-generator/v1beta1; \
+    fi
+
+# Copy the cert-generator into a thin image.
+FROM gcr.io/distroless/static:nonroot
 WORKDIR /app
-ENTRYPOINT ["sh", "./cert-generator.sh"]
+COPY --from=build-env /go/src/github.com/kubeflow/katib/katib-cert-generator /app/
+USER 65532:65532
+ENTRYPOINT ["./katib-cert-generator"]

cmd/cert-generator/v1beta1/main.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2021 The Kubeflow Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"github.com/kubeflow/katib/pkg/cert-generator/v1beta1"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/klog"
+	"os"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+)
+
+func main() {
+	kubeClient, err := client.New(config.GetConfigOrDie(), client.Options{Scheme: scheme.Scheme})
+	if err != nil {
+		klog.Fatalf("Failed to create kube client.")
+	}
+
+	cmd, err := v1beta1.NewKatibCertGeneratorCmd(kubeClient)
+	if err != nil {
+		klog.Fatalf("Failed to generate cert: %v", err)
+	}
+
+	if err = cmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

docs/developer-guide.md

@@ -101,10 +101,9 @@ to generate certificates for the webhooks.
 
 Once Katib is deployed in the Kubernetes cluster, the `cert-generator` Job follows these steps:
 
-- Generate a certificate using [`openssl`](https://www.openssl.org/).
+- Generate the self-signed CA certificate and private key.
 
-- Create a Kubernetes [Certificate Signing Request](https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/)
-  to approve and sign the certificate.
+- Generate public certificate and private key signed with the key generated in the previous step.
 
 - Create a Kubernetes Secret with the signed certificate. Secret has
   the `katib-webhook-cert` name and `cert-generator` Job's `ownerReference` to
@@ -115,7 +114,7 @@ Once Katib is deployed in the Kubernetes cluster, the `cert-generator` Job follo
 
 - Patch the webhooks with the `CABundle`.
 
-You can find the `cert-generator` source code [here](../hack/cert-generator.sh).
+You can find the `cert-generator` source code [here](../cmd/cert-generator/v1beta1).
 
 ## Implement a new algorithm and use it in Katib
 

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/go-openapi/spec v0.19.3
 	github.com/go-sql-driver/mysql v1.5.0
 	github.com/golang/mock v1.6.0
-	github.com/golang/protobuf v1.4.3
+	github.com/golang/protobuf v1.5.2
 	github.com/google/go-containerregistry v0.4.1-0.20210128200529-19c2b639fab1
 	github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20210224013640-6928f6d356ab
 	github.com/grpc-ecosystem/go-grpc-middleware v1.2.0
@@ -20,10 +20,11 @@ require (
 	github.com/onsi/gomega v1.10.3
 	github.com/prometheus/client_golang v1.9.0
 	github.com/shirou/gopsutil v2.20.7+incompatible
-	github.com/spf13/viper v1.7.0
+	github.com/spf13/cobra v1.2.1
+	github.com/spf13/viper v1.8.1
 	github.com/tidwall/gjson v1.6.0
 	golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
-	google.golang.org/grpc v1.32.0
+	google.golang.org/grpc v1.38.0
 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	k8s.io/api v0.20.4
 	k8s.io/apimachinery v0.20.4