1.創建 Issuer

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:name: selfsigned-issuernamespace: default
spec:selfSigned: {}

2.Certificate（自動生成 TLS 證書）

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:name: webhook-certnamespace: default
spec:secretName: webhook-server-certduration: 8760h # 1 yearrenewBefore: 360hsubject:organizations:- example.comcommonName: webhook-service.default.svcdnsNames:- webhook-service.default.svc- webhook-service.default.svc.cluster.localissuerRef:name: selfsigned-issuerkind: Issuer

3. 對以上yaml執行apply,然后查看生成的證書

kubectl get webhook-server-cert

4. 在deploy中掛載證書

volumeMounts:- name: tlsmountPath: /tlsreadOnly: true
volumes:- name: tlssecret:secretName: webhook-server-cert

4.根據證書獲取ca

kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}'

或者

kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

然后把這個值 粘貼進 MutatingWebhookConfiguration 的 caBundle 字段中。

本地開發時，可以導出tls.crt和tls.key

# 導出 tls.crt
kubectl get secret webhook-server-cert  -n default -o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt# 導出 tls.key
kubectl get secret webhook-server-cert  -n default -o jsonpath='{.data.tls\.key}' | base64 -d > tls.key

5. 創建MutatingWebhookConfiguration webhook（設置 caBundle）

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:name: pod-mutator
webhooks:- name: mpod.kb.ioclientConfig:service:name: webhook-servicenamespace: defaultpath: /mutateport: 443caBundle: <填入 webhook-server-cert 中的 ca.crt 內容（Base64）>rules:- apiGroups: [""]apiVersions: ["v1"]operations: ["CREATE"]resources: ["pods"]admissionReviewVersions: ["v1"]sideEffects: None

6.創建deploy

apiVersion: apps/v1
kind: Deployment
metadata:name: webhook-servernamespace: defaultlabels:app: webhook-server
spec:replicas: 1selector:matchLabels:app: webhook-servertemplate:metadata:labels:app: webhook-serverspec:containers:- name: webhook-serverimage: mesh-webhook:v0.0.1imagePullPolicy: Alwaysports:- containerPort: 8443name: httpsvolumeMounts:- name: webhook-tlsmountPath: /tlsreadOnly: trueargs:- "--tls-cert=/tls/tls.crt"- "--tls-key=/tls/tls.key"volumes:- name: webhook-tlssecret:secretName: webhook-server-cert  # cert-manager 生成的 Secret 名稱
---
apiVersion: v1
kind: Service
metadata:name: webhook-servicenamespace: default
spec:selector:app: webhook-serverports:- port: 443targetPort: 8443protocol: TCPname: https