Add `cacerts` file to all pods in a Kubernetes cluster

Question

Well, my question is really short and hopefully simple? Is it possible to add a cacerts file automatically in every pod in a specific Kubernetes cluster?

According to this article it's possible by creating a ConfigMap and add this to the path /etc/ssl/certs/. But is it possible to achieve this on a higher level so that all pods in a Kubernetes cluster have this cacerts file?

Answer 1

You can add a MutatingAdmissionWebhook for a pod, which adds the folder by default as a volume to each pod. Check out the docs about MutatingAdmissionWebhooks and writing an admission webhook.

This way you add a "service", which mutates the pod config before the scheduler handles it. Check out this for a quick example.