<p>When I check the definition of &quot;WebhookClientConfig&quot; of API of Kubernetes I found comments like this:</p>
<pre><code>// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
// If unspecified, system trust roots on the apiserver are used.
// +optional
CABundle []byte `json:&quot;caBundle,omitempty&quot; protobuf:&quot;bytes,2,opt,name=caBundle&quot;`
</code></pre>
<p>in <a href="https://github.com/kubernetes/api/blob/508b64175e9264c2a4b42b1b81d2571bf036cf09/admissionregistration/v1beta1/types.go#L555" rel="nofollow noreferrer">WebhookClientConfig</a></p>
<p>I wonder to know, what's exactly the &quot;system trust roots &quot;?
and I'm afraid the internal signer for CSR API of Kubernetes is not one of them.</p>

<p>It is a good practice to use secure network connections. A Webhook-endpoint in Kubernetes is typically an endpoint in a private network. A custom private CABundle can be used to generate the TLS certificate to achieve a secure <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#contacting-the-webhook" rel="nofollow noreferrer">connection</a> within the cluster. See e.g. <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#contacting-the-webhook" rel="nofollow noreferrer">contacting the webhook</a>.</p>
<blockquote>
<p>Webhooks can either be called via a URL or a service reference, and can optionally include a custom CA bundle to use to verify the TLS connection.</p>
</blockquote>
<p>This CABundle is optional. See also <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#service-reference" rel="nofollow noreferrer">service reference</a> for how to connect.</p>
<blockquote>
<p>If the webhook is running within the cluster, then you should use service instead of url. The service namespace and name are required. The port is optional and defaults to 443. The path is optional and defaults to &quot;/&quot;.</p>
</blockquote>
<blockquote>
<p>Here is an example of a mutating webhook configured to call a service on port &quot;1234&quot; at the subpath &quot;/my-path&quot;, and to verify the TLS connection against the ServerName my-service-name.my-service-namespace.svc using a custom CA bundle</p>
</blockquote>
