<p>k8s webhook requires tls verification, <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly" rel="nofollow noreferrer">the official document</a> says that the server certificate requires <strong>&lt;svc_name&gt;.&lt;svc_namespace&gt;.svc</strong>.</p>
<p>But when I deploy with <code>helm</code>, I may not know which namespace will be deployed in. The <code>svc_name</code> generally does not change, so is there some way to match any namespace. such as <strong>&lt;svc_name&gt;.&lt;any_namespace&gt;.svc</strong>.</p>
<p>Is there a method implementation that works for arbitrary namespaces?</p>
<p>I really appreciate any help with this</p>
<blockquote>
<p>k8s version is 1.18</p>
</blockquote>
<p>Attach a sample of my self-signed certificate</p>
<pre><code>[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
prompt = no
[req_distinguished_name]
CN = webhook.kube-system.svc
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = webhook.kube-system.svc

</code></pre>

moluzhui
<p>Posted community wiki answer for better visibility. Feel free to expand it.</p>
<hr />
<p><strong>EDIT:</strong>
The workaround presented by the original poster (@moluzhui):</p>
<blockquote>
<p>At present, I provide ValidatingWebhookConfiguration in <code>chart/template</code> in advance and write it through <code>.Files.Get</code></p>
</blockquote>
<p>As stated in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly" rel="nofollow noreferrer">official documentation</a>:</p>
<blockquote>
<p><strong>Note:</strong> When using <code>clientConfig.service</code>, the server cert must be valid for <code>&lt;svc_name&gt;.&lt;svc_namespace&gt;.svc</code>.</p>
</blockquote>
<p>The namespace name is required - this is how <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#namespaces-of-services" rel="nofollow noreferrer">DNS in Kubernetes works</a> - by using service and namespace name.</p>
<p>However, there is a good article which presents best practices of managing TLS certificates for Kubernetes Admission Webhooks - <a href="https://medium.com/trendyol-tech/5-ways-of-managing-tls-certificates-for-your-kubernetes-admission-webhooks-b2ca971c065#be41" rel="nofollow noreferrer">5 Ways of Managing TLS Certificates for your Kubernetes Admission Webhooks</a>. Maybe some of them will be useful to you and will be solution for your issue:</p>
<ul>
<li>for helm - use Certificator project and Helm Hooks - it automatically patches <code>caBundle</code> field</li>
<li>setup <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">init container</a> to create a certificate and provide CA bundle to the API server</li>
<li>generate certificate with cert-manager CA Injector and inject them to WebhookConfiguration</li>
</ul>
<p>You can also <a href="https://stackoverflow.com/questions/70472703/can-k8s-webhook-self-sign-pan-domain-certificate">set up URL with a location of the webhook</a>, where you don't have to use <code>caBundle</code>:</p>
<blockquote>
<p>Expects the TLS certificate to be verified using system trust roots, so does not specify a caBundle.</p>
</blockquote>
<p>Answering your comment:</p>
<blockquote>
<p>Well, then I can only use multiple DNS(1,2,3...) to preset the name space that may be deployed. Does this affect efficiency?</p>
</blockquote>
<p>Probably depends how many namespaces you want to deploy, but for sure it is not good practice.</p>
<p>Another solution from the comment (thanks to @JWhy user):</p>
<blockquote>
<p>You may create another service at a predictable location (i.e. in a specific namespace) and link that to your actual service in the less predictable namespace. See <a href="https://stackoverflow.com/a/44329470/763875">stackoverflow.com/a/44329470/763875</a></p>
</blockquote>
