A small k8s-webhook, designed to mount a specific configuration in the Pod. Currently supported:

• Labels
• Affinity
• NodeSelector
• Tolerations

For a review, visit this page: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/

Step 1: Pre-install

Install on a working machine with Windows Golang, Docker Desktop, make.

https://golang.org/

https://www.docker.com/products/docker-desktop

http://gnuwin32.sourceforge.net/packages/make.htm

Step 2: Build

Run: make docker

Step 3: Deploy

Save the docker image to tar file, distribute to nodes and upload:

docker save -o webhook.tar k8s-webhook:v1

docker load -i webhook.tar

Create a deploy directory and place the following files on the node:

gen-certificates.sh
ca-bundle.sh
deployment.yaml
service.yaml
mutationwebhook.yaml
config.yaml

Make * .sh files executable:

chmod +x

Next, we need to generate certificates that will be used for work. To do this, run the gen-certifictes.sh script.

The mutatingwebhook.yaml file contains a CA_BUNDLE stub, instead of which we need to put the caBundle of k8s cluster. To do this, we will perform transformations using the ca-bundle.sh script:

cat mutatingwebhook.yaml | ./ca-bundle.sh > mutatingwebhook-ca.yaml

Check the new file that caBundle has been added successfully. We are almost ready to deploy webhook, let's look at the deployment files.

Pay attention to volumeMounts and volumes. Here we are mount our secrets and two ConfigsMap's, which describe the logic of which pods and how we will change.

Let's take a closer look at part of the config. As I pointed out in the beginning, this is just an example of how we can manage the webhook based on configuration. In aacc-webhook-coreconfig, we create a mapconfigs.yaml file (hardcoded name), in which we describe which pods need to be changed, the parameters are as follows:

labelKey - the label that the webhook will look for in labels

value - the key value that the webhook will look for. If key and value are the same, a decision is made that the pod will be patched.

file - filename from ConfigMap k8s-webhook-configs containing content to be added.

types - list of configuration types, the webhook can add several types at once if they are supported in the code and content has been created for them. At the moment, the demo version supports Affinity, nodeSelector, toleration.