kubewebhook

Kubewebhook supports two modes of operation depending on how you configure the resource type:

Static Webhooks

Used when a webhook is dedicated to a single resource type.

• For mutating webhooks, configure the resource type using mutating.WebhookConfig.Obj.
• For validating webhooks, configure the resource type using validating.WebhookConfig.Obj.
• This is the recommended approach when working with Custom Resource Definitions (CRDs).

Dynamic Webhooks

Used when a single webhook needs to act on multiple types, unknown types, or generic metadata (like labels and annotations).

• How to use: Do not set the type in the configuration (set it to nil).
• Behavior: If a request arrives for a type not explicitly known by the library, it falls back to using a runtime.Unstructured object.
• Use cases: Manipulating metadata (labels, annotations) across various resources like Deployments and Statefulsets simultaneously.

To create a mutating webhook using Kubewebhook v2, import github.com/slok/kubewebhook/v2. You need to define a mutator function, create a webhook instance, and then wrap it in an HTTP handler to serve it over TLS.

Key steps:

1. Define a mutator using kwhmutating.MutatorFunc.
2. Initialize the webhook with kwhmutating.NewWebhook using a kwhmutating.WebhookConfig.
3. Generate an HTTP handler using kwhhttp.HandlerFor with kwhhttp.HandlerConfig.
4. Serve the handler using http.ListenAndServeTLS.

func run() error {
    logger := &kwhlog.Std{Debug: true}

    // Create our mutator
    mt := kwhmutating.MutatorFunc(func(_ context.Context, _ *kwhmodel.AdmissionReview, obj metav1.Object) (*kwhmutating.MutatorResult, error) {
        pod, ok := obj.(*corev1.Pod)
        if !ok {
            return &kwhmutating.MutatorResult{}, nil
        }

        // Mutate our object with the required annotations.
        if pod.Annotations == nil {
            pod.Annotations = make(map[string]string)
        }
        pod.Annotations["mutated"] = "true"
        pod.Annotations["mutator"] = "pod-annotate"

        return &kwhmutating.MutatorResult{MutatedObject: pod}, nil
    })

    // Create webhook.
    wh, err := kwhmutating.NewWebhook(kwhmutating.WebhookConfig{
        ID:      "pod-annotate",
        Mutator: mt,
        Logger:  logger,
    })
    if err != nil {
        return fmt.Errorf("error creating webhook: %w", err)
    }

    // Get HTTP handler from webhook.
    whHandler, err := kwhhttp.HandlerFor(kwhhttp.HandlerConfig{Webhook: wh, Logger: logger})
    if err != nil {
        return fmt.Errorf("error creating webhook handler: %w", err)
    }

    // Serve.
    logger.Infof("Listening on :8080")
    err = http.ListenAndServeTLS(":8080", cfg.certFile, cfg.keyFile, whHandler)
    if err != nil {
        return fmt.Errorf("error serving webhook: %w", err)
    }

    return nil
}

This example demonstrates a validating webhook that ensures all Ingress rule hosts match a specific regular expression. If a host does not match the regex, the Ingress resource is denied admission.

Setup Steps:

1. Deploy certificates: Apply the validating webhook certificates.

   kubectl apply -f ./ingress-host-validator/deploy/webhook-certs.yaml

2. Deploy the webhook: Deploy the validating webhook server.

   kubectl apply -f ./ingress-host-validator/deploy/webhook.yaml

3. Register the webhook: Register the validating webhook with the Kubernetes API server.

   kubectl apply -f ./ingress-host-validator/deploy/webhook-registration.yaml

Verification: Deploy a test Ingress resource and observe whether the API server accepts or denies the resource based on the host matching the regex:

kubectl apply -f ./test-ingress.yaml

Check the compatibility between Kubewebhook versions and Kubernetes versions.