<p>I am developing a <a href="https://medium.com/ovni/writing-a-very-basic-kubernetes-mutating-admission-webhook-398dbbcb63ec" rel="noreferrer">mutating webhook</a> with <a href="https://kind.sigs.k8s.io/docs/user/quick-start" rel="noreferrer">kind</a> and as I understand, the API end-point should be <code>https</code>. The certificate and key of the API server should be signed with the CA of the cluster itself so as to get around issue of self-signed certificates. And, for that, the following are the recommended steps:</p>

<ol>
<li>Create key - <code>openssl genrsa -out app.key 2048</code></li>
<li>Create CSR - <code>openssl req -new -key app.key -subj "/CN=${CSR_NAME}" -out app.csr -config csr.conf</code></li>
<li>Create CSR object in kubernetes - <code>kubectl create -f csr.yaml</code></li>
<li>Approve CSR - <code>kubectl certificate approve csr_name</code></li>
<li>Extract PEM - <code>kubectl get csr app.csr -o jsonpath='{.status.certificate}' | openssl base64 -d -A -out app.pem</code></li>
</ol>

<p><strong>Notes</strong><br>
1. The <code>csr.conf</code> has details to set-up the CSR successfully.<br>
2. The <code>csr.yaml</code> is written for the kuberenetes kind <code>CertificateSigningRequest</code>.<br>
3. The <code>csr_name</code> is defined in <code>CertificateSigningRequest</code>.<br>
4. The <code>spec.request</code> in <code>csr.yaml</code> is set to <code>cat app.csr | base64 | tr -d '\n'</code>.
5. The <code>app.pem</code> and <code>app.key</code> are used to set-up the <code>https</code> end-point.</p>

<p>The end-point is definitely reachable but errors out as:</p>

<pre class="lang-sh prettyprint-override"><code>Internal error occurred: failed calling webhook "com.me.webhooks.demo": Post https://webhook.sidecars.svc:443/mutate?timeout=10s: x509: certificate signed by unknown authority
</code></pre>

<p>How do I get around the <code>certificate signed by unknown authority</code> issue?</p>

<p>References:<br>
1. <a href="https://medium.com/ovni/writing-a-very-basic-kubernetes-mutating-admission-webhook-398dbbcb63ec" rel="noreferrer">Writing a very basic kubernetes mutating admission webhook</a><br>
2. <a href="https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74" rel="noreferrer">Diving into Kubernetes MutatingAdmissionWebhook</a></p>

cogitoergosum
<p>It doesn't need to be signed with the cluster's CA root. It just needs to match the CA bundle in the webhook configuration.</p>
