hook.yaml

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: webhook-cert
  namespace: default
spec:
  dnsNames:
  - your-svc.default.svc
  - your-svc.default.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: selfsigned-issuer
  secretName: webhook-cert
---
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: selfsigned-issuer
  namespace: default
spec:
  selfSigned: {}
---

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: default/webhook-cert
  name: pod-mutating-webhook-configuration
webhooks:
- clientConfig:
    caBundle: Cg==
    service:
      name: pod-webhook-service
      namespace: default
      path: /
  failurePolicy: Fail
  name: mpod.kb.io
  namespaceSelector:
    matchLabels:
      custom-injection: enabled
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - pods