<p>I have a wehook running in my cluster.</p>
<p>I created a certificate and signed it successfully.</p>
<p>certificate configuration:</p>
<pre><code>cat &gt; csr.conf &lt;&lt;EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = s-controller.ns-controller
DNS.2 = s-controller.ns-controller.svc
EOF
</code></pre>
<p>I them create the certificate as following:</p>
<pre><code>openssl genrsa -out server-key.pem 2048
openssl req -new -key server-key.pem -subj &quot;/CN=s-controller.ns-controller.svc&quot; -out server.csr -config csr.conf

</code></pre>
<p>certificate signing request (<code>v1beta1</code>)</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
    name: csr-controller
spec:
    groups:
    - system:authenticated
    request: $(cat server.csr | base64 | tr -d '\n')
    usages:
    - digital signature
    - key encipherment
    - server auth
EOF
</code></pre>
<p>This worked just fine!</p>
<p>Since I updated my kubernetes version, I get the following warning: <code>Warning: certificates.k8s.io/v1beta1 CertificateSigningRequest is deprecated in v1.19+, unavailable in v1.22+; use certificates.k8s.io/v1</code>, I updated the <code>CertificateSigningRequest</code> so now it is as following:</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
    name: csr-controller
spec:
    groups:
    - system:authenticated
    request: $(cat server.csr | base64 | tr -d '\n')
    signerName: kubernetes.io/kube-apiserver-client
    usages:
    - digital signature
    - key encipherment
    - client auth
EOF
</code></pre>
<p>And now the api server fails to connect to my webhook: <code>Post &quot;https://s-controller.ns-controller.svc:443/mutate?timeout=30s&quot;: x509: certificate specifies an incompatible key usage</code></p>
<p>I tried updateding the certificate configuration to <code>extendedKeyUsage = clientAuth</code> but it didnt help.</p>
<p>Any idea what is the correct <code>signerName</code> and configuration to the <code>certificates.k8s.io/v1</code> apiVersion</p>

<p>I haven't managed to create a <code>CertificateSigningRequest</code> as I wished, <strong>HOWEVER</strong> I bypassed the issue by create my own CA as following:</p>
<p>First, I edited my certificate configurations file so it will include a <code>commonName</code> and currect <code>extendedKeyUsage </code>:</p>
<pre><code>cat &gt; csr.conf &lt;&lt;EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
prompt = no
[req_distinguished_name]
CN = s-controller.ns-controller.svc
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = s-controller.ns-controller
DNS.2 = s-controller.ns-controller.svc
EOF
</code></pre>
<p>Generate CA certificate (notice the <code>-days 365</code>)</p>
<pre><code>openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -days 365 -out ca.crt -subj &quot;/CN=admission_ca&quot;
</code></pre>
<p>Generate tls key and certificdate</p>
<pre><code>openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -config csr.conf
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -extensions v3_req -extfile csr.conf
</code></pre>
<p>Create a kubernetes tls secret for the webhook</p>
<pre><code>kubectl create secret tls webhook-tls --cert=server.crt --key=server.key
</code></pre>
<p>Set the <code>CA_BUNDLE</code></p>
<pre><code>export CA_BUNDLE=$(cat ca.crt | base64 | tr -d '\n')
</code></pre>
<p>Remove all generated files</p>
<pre><code>rm ca.crt 
rm ca.key 
rm server.key
rm server.csr
rm server.crt

</code></pre>
<p>In my webhhok, I have a <code>volume</code> <code>volumeMount</code>:</p>
<p>volume:</p>
<pre><code>volumes:
- name: tls-vol
    secret:
      secretName: webhook-tls
</code></pre>
<p>volumeMount:</p>
<pre><code>volumeMounts:
- name: tls-vol
  mountPath: /etc/webhook/certs
  readOnly: true
</code></pre>
<p>And the comantainer <code>args</code></p>
<pre><code>args:
- -tlsCertFile=/etc/webhook/certs/tls.crt
- -tlsKeyFile=/etc/webhook/certs/tls.key
</code></pre>
