当前位置：首页 > java >正文

k8s开发webhook使用certmanager生成证书

java 2025/6/28 0:11:40

1.创建 Issuer

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:name: selfsigned-issuernamespace: default
spec:selfSigned: {}

2.Certificate（自动生成 TLS 证书）

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:name: webhook-certnamespace: default
spec:secretName: webhook-server-certduration: 8760h # 1 yearrenewBefore: 360hsubject:organizations:- example.comcommonName: webhook-service.default.svcdnsNames:- webhook-service.default.svc- webhook-service.default.svc.cluster.localissuerRef:name: selfsigned-issuerkind: Issuer

3. 对以上yaml执行apply,然后查看生成的证书

kubectl get webhook-server-cert

4. 在deploy中挂载证书

volumeMounts:- name: tlsmountPath: /tlsreadOnly: true
volumes:- name: tlssecret:secretName: webhook-server-cert

4.根据证书获取ca

kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}'

或者

kubectl get secret webhook-server-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

然后把这个值粘贴进 MutatingWebhookConfiguration 的 caBundle 字段中。

本地开发时，可以导出tls.crt和tls.key

# 导出 tls.crt
kubectl get secret webhook-server-cert  -n default -o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt# 导出 tls.key
kubectl get secret webhook-server-cert  -n default -o jsonpath='{.data.tls\.key}' | base64 -d > tls.key

5. 创建MutatingWebhookConfiguration webhook（设置 caBundle）

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:name: pod-mutator
webhooks:- name: mpod.kb.ioclientConfig:service:name: webhook-servicenamespace: defaultpath: /mutateport: 443caBundle: <填入 webhook-server-cert 中的 ca.crt 内容（Base64）>rules:- apiGroups: [""]apiVersions: ["v1"]operations: ["CREATE"]resources: ["pods"]admissionReviewVersions: ["v1"]sideEffects: None

6.创建deploy

apiVersion: apps/v1
kind: Deployment
metadata:name: webhook-servernamespace: defaultlabels:app: webhook-server
spec:replicas: 1selector:matchLabels:app: webhook-servertemplate:metadata:labels:app: webhook-serverspec:containers:- name: webhook-serverimage: mesh-webhook:v0.0.1imagePullPolicy: Alwaysports:- containerPort: 8443name: httpsvolumeMounts:- name: webhook-tlsmountPath: /tlsreadOnly: trueargs:- "--tls-cert=/tls/tls.crt"- "--tls-key=/tls/tls.key"volumes:- name: webhook-tlssecret:secretName: webhook-server-cert  # cert-manager 生成的 Secret 名称
---
apiVersion: v1
kind: Service
metadata:name: webhook-servicenamespace: default
spec:selector:app: webhook-serverports:- port: 443targetPort: 8443protocol: TCPname: https