Create a ClusterTrustBundle containing a CA certificate you control.
Nothing trusts it on creation.
Only pods that project it through a clusterTrustBundle volume read the bundle at all.
Those pods then accept certificates signed by that CA, so the TLS connections they make can be intercepted.
Workloads using the container image's own CA store, which is the common case, are unaffected.
Note:
Requires the ClusterTrustBundle feature to be enabled and, separately, workloads that project the bundle.
Check with kubectl api-resources | grep trustbundle.
Inert on a cluster where nothing projects it.