1.创建 Issuer
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:name: selfsigned-issuernamespace: default
spec:selfSigned: {}
2.Certificate（自动生成 TLS 证书）
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:name: webhook-certnamespace: default
spec:secretName: webhook-server-certduration: 8760h # 1 yearrenewBefore: 360hsubject:organizations:- example.comcommonName: webhook-service.default.svcdnsNames:- webhook-service.default.svc- webhook-service.default.svc.cluster.localissuerRef:name: selfsigned-issuerkind: Issuer
3. 对以上yaml执行apply,然后查看生成的证书
kubectl get webhook-server-cert
4. 在deploy中挂载证书
volumeMounts:- name: tlsmountPath: /tlsreadOnly: true
volumes:- name: tlssecret:secretName: webhook-server-cert
4.根据证书获取ca
kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}'
或者
kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt然后把这个值 粘贴进 MutatingWebhookConfiguration 的 caBundle 字段中。
本地开发时，可以导出tls.crt和tls.key
# 导出 tls.crt
kubectl get secret webhook-server-cert -n default -o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt# 导出 tls.key
kubectl get secret webhook-server-cert -n default -o jsonpath='{.data.tls\.key}' | base64 -d > tls.key5. 创建MutatingWebhookConfiguration webhook（设置 caBundle）
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:name: pod-mutator
webhooks:- name: mpod.kb.ioclientConfig:service:name: webhook-servicenamespace: defaultpath: /mutateport: 443caBundle: <填入 webhook-server-cert 中的 ca.crt 内容（Base64）>rules:- apiGroups: [""]apiVersions: ["v1"]operations: ["CREATE"]resources: ["pods"]admissionReviewVersions: ["v1"]sideEffects: None6.创建deploy
apiVersion: apps/v1
kind: Deployment
metadata:name: webhook-servernamespace: defaultlabels:app: webhook-server
spec:replicas: 1selector:matchLabels:app: webhook-servertemplate:metadata:labels:app: webhook-serverspec:containers:- name: webhook-serverimage: mesh-webhook:v0.0.1imagePullPolicy: Alwaysports:- containerPort: 8443name: httpsvolumeMounts:- name: webhook-tlsmountPath: /tlsreadOnly: trueargs:- "--tls-cert=/tls/tls.crt"- "--tls-key=/tls/tls.key"volumes:- name: webhook-tlssecret:secretName: webhook-server-cert # cert-manager 生成的 Secret 名称
---
apiVersion: v1
kind: Service
metadata:name: webhook-servicenamespace: default
spec:selector:app: webhook-serverports:- port: 443targetPort: 8443protocol: TCPname: https
)
