Extend the REST service to keep a CertIssuer.

Signed-off-by: Matt Moyer <moyerm@vmware.com>

pkg/apiserver/apiserver.go

@@ -57,6 +57,7 @@ type Config struct {
 
 type ExtraConfig struct {
 	Webhook authenticator.Token
+	Issuer  loginrequest.CertIssuer
 }
 
 type PlaceHolderServer struct {
@@ -108,7 +109,7 @@ func (c completedConfig) New() (*PlaceHolderServer, error) {
 		NegotiatedSerializer:         Codecs,
 	}
 
-	loginRequestStorage := loginrequest.NewREST(c.ExtraConfig.Webhook)
+	loginRequestStorage := loginrequest.NewREST(c.ExtraConfig.Webhook, c.ExtraConfig.Issuer)
 
 	v1alpha1Storage, ok := apiGroupInfo.VersionedResourcesStorageMap[gvr.Version]
 	if !ok {

pkg/registry/loginrequest/rest.go

@@ -8,7 +8,9 @@ package loginrequest
 
 import (
 	"context"
+	"crypto/x509/pkix"
 	"fmt"
+	"time"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -28,14 +30,20 @@ var (
 	_ rest.Storage                 = &REST{}
 )
 
-func NewREST(webhook authenticator.Token) *REST {
+type CertIssuer interface {
+	IssuePEM(subject pkix.Name, dnsNames []string, ttl time.Duration) ([]byte, []byte, error)
+}
+
+func NewREST(webhook authenticator.Token, issuer CertIssuer) *REST {
 	return &REST{
 		webhook: webhook,
+		issuer:  issuer,
 	}
 }
 
 type REST struct {
 	webhook authenticator.Token
+	issuer  CertIssuer
 }
 
 func (r *REST) New() runtime.Object {