# Which annotation tells cainjector to fill a webhook configuration's caBundle from a cert-manager Certificate?

cert-manager, Hard (Expert), Integration. https://k8wiz.com/uquiz/which-annotation-tells-cainjector-to-fill-a-webhook-configurations-cabundle-from-a-cert-manager-certificate

- A. cert-manager.io/ca-bundle: <secret-name>
- B. cainjector.io/source: <issuer-name>
- C. cert-manager.io/inject-ca-from: <namespace>/<certificate-name>
- D. cert-manager.io/issuer: <namespace>/<certificate-name>

**Answer:** cert-manager.io/inject-ca-from: <namespace>/<certificate-name>

**Explanation:** cainjector watches ValidatingWebhookConfiguration, MutatingWebhookConfiguration, CustomResourceDefinition and APIService objects with this annotation. It copies the CA from the named Certificate's Secret into their caBundle fields and updates it when the certificate is renewed. cert-manager.io/inject-ca-from-secret does the same directly from a Secret.