k8swebhookminimal k8s admission webhook templatecaBundle in deploy.yaml is base64 encoded ca.pemserver/hook certificate dn must be hook.default.svc (if you keep service name and default namespace)