didil / k8s-hello-mutating-webhook

A Kubernetes Mutating Admission Webhook example, using Go.

K8s Hello Mutating Webhook

A Kubernetes Mutating Admission Webhook example, using Go. This is a companion repository for the Article Building a Kubernetes Mutating Admission Webhook: A “magic” way to inject a file into Pod Containers

This is proof of concept code, make sure to review carefully before using in a production system.

Run tests

$ make test

Deploy

Define shell env:

# define env vars
$ export CONTAINER_REPO=quay.io/my-user/my-repo
$ export CONTAINER_VERSION=x.y.z

Build/Push Webhook

$ make docker-build
$ make docker-push

• for this example you'll need to make the container repository public unless you'll be specifying ImagePullSecrets on the Pod

Deploy to K8s cluster

$ make k8s-deploy

Mutated pod example

$ k run busybox-1 --image=busybox  --restart=Never -l=hello=true -- sleep 3600
$ k exec busybox-1 -it -- ls /etc/config/hello.txt
# The output should be:
/etc/config/hello.txt
$ k exec busybox-1 -it -- sh -c "cat /etc/config/hello.txt"
# The output should be:
Hello from the admission controller !

We successfully mutated our pod spec and added an arbitary volume/file in there, yay !

Cleanup

Delete all k8s resources

$ make k8s-delete-all

k8s-hello-mutating-webhook's Issues

How should I deploy your example using a cluster I deployed with Kubeadm

It looks like I'm having trouble deploying your example with Kubeadm

[root@zc1 webhook]# kubectl apply -f webhookconf.yaml 
error: unable to recognize "webhookconf.yaml": no matches for kind "MutatingWebhookConfiguration" in version "admissionregistration.k8s.io/v1"

csr job failed

I am getting below error when I try to deploy the cert manager.

$ kubectl logs -f webhook-cert-setup-9pzr8 Generating RSA private key, 2048 bit long modulus (2 primes) creating certs in tmpdir /tmp/tmp.PIKoDA ...................+++++ ................................+++++ e is 65537 (0x010001) creating csr: hello-webhook-service.default NAME AGE SIGNERNAME REQUESTOR CONDITION hello-webhook-service.default 15s kubernetes.io/legacy-unknown system:serviceaccount:default:webhook-cert-sa Pending certificatesigningrequest.certificates.k8s.io "hello-webhook-service.default" deleted WARN: Previous CSR was found and removed. certificatesigningrequest.certificates.k8s.io/hello-webhook-service.default created NAME AGE SIGNERNAME REQUESTOR CONDITION hello-webhook-service.default 0s kubernetes.io/legacy-unknown system:serviceaccount:default:webhook-cert-sa Pending No resources found Error from server (Forbidden): certificatesigningrequests.certificates.k8s.io "hello-webhook-service.default" is forbidden: user not permitted to approve requests with signerName "kubernetes.io/legacy-unknown"

Kubernetes version = v1.21.0

How should I append security constraits with this web hook

There is an error when i apply the "make k8s-deploy" script command

I clone your code in my own k8s environment (instaled by kubeadm);and i replace the image repo and tag with my own,when i type
the Makefile command one by one ,i got the error output below:

[root@eb69218 k8s-hello-mutating-webhook-main]# make k8s-deploy
kustomize build k8s/other | kubectl apply -f -
configmap/hello-configmap unchanged
service/hello-webhook-service created
mutatingwebhookconfiguration.admissionregistration.k8s.io/hello-webhook.leclouddev.com created
kustomize build k8s/csr | kubectl apply -f -
serviceaccount/webhook-cert-sa unchanged
clusterrole.rbac.authorization.k8s.io/webhook-cert-cluster-role unchanged
clusterrolebinding.rbac.authorization.k8s.io/webhook-cert-cluster-role-binding configured
job.batch/webhook-cert-setup created
Waiting for cert creation ...
kubectl certificate approve hello-webhook-service.default
Error from server (NotFound): certificatesigningrequests.certificates.k8s.io "hello-webhook-service.default"
make: *** [k8s-deploy-other] Error 1

It seems that the job isnot created normally, and the certificateigningrequests didn't work.