title: How to create a "CertificateSigningRequest" with apiVersion "certificates.k8s.io/v1" for a webhook
body: <p>I have a wehook running in my cluster.</p>
  <p>I created a certificate and signed it successfully.</p>
  <p>certificate configuration:</p>
  <pre><code>cat &gt; csr.conf &lt;&lt;EOF
  [req]
  req_extensions = v3_req
  distinguished_name = req_distinguished_name
  [req_distinguished_name]
  [ v3_req ]
  basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = s-controller.ns-controller
  DNS.2 = s-controller.ns-controller.svc
  EOF
  </code></pre>
  <p>I them create the certificate as following:</p>
  <pre><code>openssl genrsa -out server-key.pem 2048
  openssl req -new -key server-key.pem -subj &quot;/CN=s-controller.ns-controller.svc&quot; -out server.csr -config csr.conf
  
  </code></pre>
  <p>certificate signing request (<code>v1beta1</code>)</p>
  <pre><code>cat &lt;&lt;EOF | kubectl create -f -
  apiVersion: certificates.k8s.io/v1beta1
  kind: CertificateSigningRequest
  metadata:
      name: csr-controller
  spec:
      groups:
      - system:authenticated
      request: $(cat server.csr | base64 | tr -d '\n')
      usages:
      - digital signature
      - key encipherment
      - server auth
  EOF
  </code></pre>
  <p>This worked just fine!</p>
  <p>Since I updated my kubernetes version, I get the following warning: <code>Warning: certificates.k8s.io/v1beta1 CertificateSigningRequest is deprecated in v1.19+, unavailable in v1.22+; use certificates.k8s.io/v1</code>, I updated the <code>CertificateSigningRequest</code> so now it is as following:</p>
  <pre><code>cat &lt;&lt;EOF | kubectl create -f -
  apiVersion: certificates.k8s.io/v1
  kind: CertificateSigningRequest
  metadata:
      name: csr-controller
  spec:
      groups:
      - system:authenticated
      request: $(cat server.csr | base64 | tr -d '\n')
      signerName: kubernetes.io/kube-apiserver-client
      usages:
      - digital signature
      - key encipherment
      - client auth
  EOF
  </code></pre>
  <p>And now the api server fails to connect to my webhook: <code>Post &quot;https://s-controller.ns-controller.svc:443/mutate?timeout=30s&quot;: x509: certificate specifies an incompatible key usage</code></p>
  <p>I tried updateding the certificate configuration to <code>extendedKeyUsage = clientAuth</code> but it didnt help.</p>
  <p>Any idea what is the correct <code>signerName</code> and configuration to the <code>certificates.k8s.io/v1</code> apiVersion</p>