<p>The <code>caBundle</code> for <code>MutatingWebhookConfiguration</code> is defined <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#webhookclientconfig-v1-admissionregistration-k8s-io" rel="nofollow noreferrer">here</a> as:</p>

<blockquote>
  <p><code>caBundle</code> is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.</p>
</blockquote>

<p>I am getting the PEM encoded CA bundle with this command.</p>

<pre class="lang-sh prettyprint-override"><code>kubectl config view --raw --minify --flatten \ 
-o jsonpath='{.clusters[].cluster.certificate-authority-data}'
</code></pre>

<p>The resulting value is saved in a variable that is used in a <code>sed</code> command to replace the <code>CA_BUNDLE</code> string in a 'template' YAML as shown below.</p>

<pre><code>apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: WEBHOOK_APP
  labels:
    app: WEBHOOK_APP
webhooks:
  - name: com.demo.NAMESPACE.WEBHOOK_APP
    sideEffects: None
    admissionReviewVersions: ["v1", "v1beta1"]
    matchPolicy: Equivalent
    failurePolicy: Fail
    clientConfig:
      caBundle: CA_BUNDLE
      service:
        name: WEBHOOK_APP
        namespace: NAMESPACE
        path: "/mutate"
    rules:
      - operations: [ "CREATE", "UPDATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
        scope: "*"
</code></pre>

<p>What is the way in Helm chart to pass on the <code>CA_BUNDLE</code>?</p>

<p>Reading variable dirctly from env variable in your helm chart is not possible due to security reasons and this functionality was not implemented as states in <a href="https://github.com/technosophos/k8s-helm/blob/master/docs/charts_tips_and_tricks.md#know-your-template-functions" rel="nofollow noreferrer">this document</a>.</p>

<p>In helm chart you can always create a variable e.g. <code>myCAbundleVariable</code> in <code>values.yaml</code> file that will be holding your PEM encoded CA and then use value from this variable in chart like this:</p>

<pre><code>webhooks:
  - ...
    clientConfig:
      caBundle: {{ .myCAbundleVariable }}
</code></pre>

<p>If you want to pass the value 'in runtime' when running helm command you can use <code>--set</code> parameter.</p>

<p>So your helm command would look like this:</p>

<pre><code>helm install ... --set myCAbundleVariable=$(kubectl config view --raw --minify --flatten \
-o jsonpath='{.clusters[].cluster.certificate-authority-data}')`
</code></pre>

<p>Let me know if it was helpful.</p>
