func SetupWebhookTLS(ctx context.Context, ns, dir string) error {
	cfg, err := ctrl.GetConfig()
	if err != nil {
		return errors.Wrap(err, "failed to get REST config")
	}
	cs, err := kubernetes.NewForConfig(cfg)
	if err != nil {
		return errors.Wrap(err, "failed to create client set")
	}
	webhookAPI := cs.AdmissionregistrationV1()
	secretsAPI := cs.CoreV1().Secrets(ns)
	cert, err := resource.CreateWebhookCertificate(ctx, secretsAPI, ns)
	if err != nil {
		return errors.Wrap(err, "failed find or create webhook certificate")
	}
	if err := writeWebhookSecrets(cert, dir); err != nil {
		return errors.Wrap(err, "failed to write webhook certificate to disk")
	}
	ca, err := resource.FindOrCreateWebhookCA(ctx, secretsAPI)
	if err != nil {
		return errors.Wrap(err, "failed to find webhook CA certificate")
	}
	if err := resource.PatchMutatingWebhookConfig(ctx, webhookAPI.MutatingWebhookConfigurations(), ca); err != nil {
		return errors.Wrap(err, "failed to patch mutating webhook")
	}
	if err := resource.PatchValidatingWebhookConfig(ctx, webhookAPI.ValidatingWebhookConfigurations(), ca); err != nil {
		return errors.Wrap(err, "failed to patch validating webhook")
	}
	return nil
}
SetupWebhookTLS ensures that the webhook TLS secret exists, the necesary files are in place, and that the webhook
client configuration has the correct CABundle for TLS. This should be called before starting the controller manager
to ensure everything is in place at startup.

Certificate rotation is as simple as deleting the pod and letting the deployment start a new one. If you're using
your own certificates, be sure to update them before deleting the pod.
package main
import (
	"context"
	"io/ioutil"
	"os"
	"path/filepath"
	"github.com/cockroachdb/cockroach-operator/pkg/resource"
	"github.com/cockroachdb/cockroach-operator/pkg/security"
	"github.com/cockroachdb/errors"
	"k8s.io/client-go/kubernetes"
	ctrl "sigs.k8s.io/controller-runtime"
)