fix: make the bootstrapper exit cleanly on subsequent runs

[voxeljorge]

Name of feature:

Make autocert-bootstrapper exit cleanly on subsequent runs

Pain or issue this feature alleviates:

Resolve #173

Why is this important to the project (if not answered above):

Hopefully it fixes a bug

Is there documentation on how to use this feature? If so, where?

I'm not sure additional documentation is necessary here.

In what environments or workflows is this feature supported?

Any environment where pods run for a long time.

In what environments or workflows is this feature explicitly NOT supported (if any)?

None specifically

Supporting links/other PRs/issues:

According to the Kubernetes docs pods can be restarted for a couple of reasons, and in the current setup the bootstrapper will fail on subsequent runs. https://kubernetes.io/docs/concepts/workloads/pods/init-containers/#pod-restart-reasons

[CLAassistant]

All committers have signed the CLA.

[voxeljorge]

I have tested this change locally with microk8s by doing the following:

1. Install microk8s with a local registry
2. Build all 3 containers (controller, bootstrapper, renewer) from this change

docker build . -t localhost:32000/autocert-bootstrapper -f bootstrapper/Dockerfile
docker build . -t localhost:32000/autocert-controller -f controller/Dockerfile
docker build . -t localhost:32000/autocert-renewer -f renewer/Dockerfile
docker push localhost:32000/autocert-bootstrapper
docker push localhost:32000/autocert-controller
docker push localhost:32000/autocert-renewer

3. install autocert from the helm chart, using values that look like the following:

autocert:
  image:
    repository: localhost:32000/autocert-controller
    tag: latest
    pullPolicy: Always
bootstrapper:
  image:
    repository: localhost:32000/autocert-bootstrapper
    tag: latest
    pullPolicy: Always
renewer:
  image:
    repository: localhost:32000/autocert-renewer
    tag: latest
    pullPolicy: Always

4. Create a pod with the autocert annotation, observe it gets created and bootstraps a cert correctly
5. Remove the generated token secret with kubectl delete secret
6. find the pause container for this pod with ps axf and kill it to simulate the full pod getting restarted

I can confirm that following these steps, I do see a log message like the following produced by the bootstrapper the second time around:

Found existing /var/run/autocert.step.sm/root.crt, skipping bootstrap

[dopey]

Hey @voxeljorge 👋 . Pleasure to e-meet you and thanks for the PR! We'll be taking a look at this shortly (within the next few weeks) - bogged down with some other work at the moment. Cheers!

[maraino]

Thanks @voxeljorge lgtm