<p>I have a wehook running in my cluster.</p>
<p>I created a certificate and signed it successfully.</p>
<p>certificate configuration:</p>
<pre><code>cat &gt; csr.conf &lt;&lt;EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = s-controller.ns-controller
DNS.2 = s-controller.ns-controller.svc
EOF
</code></pre>
<p>I them create the certificate as following:</p>
<pre><code>openssl genrsa -out server-key.pem 2048
openssl req -new -key server-key.pem -subj &quot;/CN=s-controller.ns-controller.svc&quot; -out server.csr -config csr.conf

</code></pre>
<p>certificate signing request (<code>v1beta1</code>)</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
    name: csr-controller
spec:
    groups:
    - system:authenticated
    request: $(cat server.csr | base64 | tr -d '\n')
    usages:
    - digital signature
    - key encipherment
    - server auth
EOF
</code></pre>
<p>This worked just fine!</p>
<p>Since I updated my kubernetes version, I get the following warning: <code>Warning: certificates.k8s.io/v1beta1 CertificateSigningRequest is deprecated in v1.19+, unavailable in v1.22+; use certificates.k8s.io/v1</code>, I updated the <code>CertificateSigningRequest</code> so now it is as following:</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
    name: csr-controller
spec:
    groups:
    - system:authenticated
    request: $(cat server.csr | base64 | tr -d '\n')
    signerName: kubernetes.io/kube-apiserver-client
    usages:
    - digital signature
    - key encipherment
    - client auth
EOF
</code></pre>
<p>And now the api server fails to connect to my webhook: <code>Post &quot;https://s-controller.ns-controller.svc:443/mutate?timeout=30s&quot;: x509: certificate specifies an incompatible key usage</code></p>
<p>I tried updateding the certificate configuration to <code>extendedKeyUsage = clientAuth</code> but it didnt help.</p>
<p>Any idea what is the correct <code>signerName</code> and configuration to the <code>certificates.k8s.io/v1</code> apiVersion</p>

David Wer
<p>In your old CertificateSigningRequest yaml you were using <em>server auth</em> as one of the key usages but, in latest one you changed it to <em>client auth</em> . the cert needed by webhook need to be signed with server auth key and signerName should be kubernetes.io/kubelet-serving . So update your files as follows to avoid the issue :</p>
<p>csr.conf</p>
<pre><code> cat &gt; csr.conf &lt;&lt;EOF
 [req]
 req_extensions = v3_req
 distinguished_name = req_distinguished_name
 prompt = no
 [req_distinguished_name]
 CN = s-controller.ns-controller.svc
 [ v3_req ]
 basicConstraints = CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 extendedKeyUsage = clientAuth, serverAuth
 subjectAltName = @alt_names
 [alt_names]
 DNS.1 = s-controller.ns-controller
 DNS.2 = s-controller.ns-controller.svc
 EOF 
</code></pre>
<p>Generate csr with subject.organization as &quot;system:nodes&quot;</p>
<pre><code>openssl genrsa -out server.key 2048
openssl req -new -key server.key -subj &quot;/CN=system:node:s-contoller.ns-controller.svc /OU=&quot;system:nodes&quot; /O=system:nodes&quot; -out $server.csr -config csr.conf
</code></pre>
<p>csr-for-webhook.yaml</p>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: csr-controller
spec:
    groups:
    - system:authenticated
    request: $(cat server.csr | base64 | tr -d '\n')
    signerName: kubernetes.io/kubelet-serving
    usages:
    - digital signature
    - key encipherment
    - server auth
EOF
</code></pre>
<p>source : <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/</a></p>
<p>PS: I have tested it with Kubernetes version 1.21.3</p>
