- Webhook Admission 101 - Webhook Admission callback - Apply dynamic Webhook Admission - Demo

1. Kubernetes
Webhook Admission
Bao Huynh - DevOps Engineer
04/Oct/2021

2. You once already saw this....

3. Agenda
1. Webhook Admission 101
2. Webhook Admission callback
3. Apply dynamic Webhook Admission
4. Demo

4. Webhook Admission 101
Are HTTP callbacks that:
● Receive admission request & intercept them
● Intercept = Mutate/Validate or Both
● Dynamic injection with WebhookConfiguration CRD

5. Webhook Admission 101

6. Webhook Admission 101
Why ?
It give helps to existential questions in the life of DevOps:
● Is the pod requesting too many resources?
● Are the base images used to spawn the microservice pods secure?
● Which privileges are currently granted to the service account linked to
these pods/deployments? Do they adhere to the principle of least privilege?

7. Webhook Admission 101
(kube-api plugins)
Kube-api server
CertificateApproval
controller
DefaultIngressClass
controller
Validating
AdmissionWebhook
controller
…………..
Mutating
AdmissionWebhook
controller

8. Webhook Admission 101
● Enable Webhook Admission Controller
● Enable Webhook Admission Controller

9. Agenda
1. Webhook Admission 101
2. Webhook Admission callback
3. Apply dynamic Webhook Admission
4. Demo

10. Webhook Admission callback

11. Webhook Admission callback (REQUEST)
● HTTP Method: POST
● Content-Type: application/json
● API Object (API: AdmissionReview)

12. Webhook Admission callback (REQUEST)

13. Webhook Admission callback (RESPOND)
● HTTP Method: POST
● Content-Type: application/json
● API Object (API: AdmissionReview)
● Body:
+ uid : copied for request.uid
+ allowed : true/false
+ patchType: JSONPatch
+ patch : <base64_of_JsonPatch_operation>

14. Webhook Admission callback (RESPOND)
Respond simple (allow/forbidden)
Respond with Patching
Respond with Warning (code 299)
Webhook Server
(intercept Request)
API Server
Respond
Callback
Intercept
request
equest

15. Webhook Admission callback
(contacting webhook server)
Once the API server has determined a request should be sent to a webhook,
it needs to know how to contact the webhook
- URL
- Service reference

16. Webhook Admission callback
(contacting webhook server)
URL Service Reference
Endpoint
Type
Endpoint outside K8S Endpoint within K8S (deployment/service)
Endpoint
Format
scheme://host:port/path <svc_name>.<svc_ns>.svc.cluster.local
caBundle Require
(but automatically using
“system trust roots”)
Require
(use K8S cluster caBundle)

17. Webhook Admission callback
(contacting webhook server)

18. Webhook Admission callback
(contacting webhook server)
Acquiring “K8S cluster caBundle”:
$ kubectl config view --raw --minify --flatten -o
jsonpath='{.clusters[].cluster.certificate-authority-data}'
$ kubectl get secrets -o
jsonpath="{.items[?(@.metadata.annotations['kubernetes.io/service-
account.name']=='default')].data.ca.crt}"

19. Agenda
1. Webhook Admission 101
2. Webhook Admission callback
3. Apply dynamic Webhook Admission
4. Demo

20. Apply dynamic Webhook Admission
Let’s recall
● Mutating Webhook Admission: patch/modify the request
● Validating Webhook Admission: validate the request
● Mutate first, then validate later.

21. Apply dynamic Webhook Admission

22. Apply dynamic Webhook Admission
Kube-api server
Mutating
sidecar-Injection
Configuration
Validating
AdmissionWebhook
controller
Mutating
AdmissionWebhook
controller
Mutating
Image
Configuration
Validate
Image
Configuration
Dynamic = Apply with
configuration

23. Apply dynamic Webhook Admission
Webhook Configuration
- API object (kind):
/ ValidatingWebhookConfiguration
/ MutatingWebhookConfiguration
- Name: must be K8S valid DNS subdomain name

24. Apply dynamic Webhook Admission
Webhook Configuration
Example

25. Apply dynamic Webhook Admission
Webhook Configuration (Request Matching Rules)
Define which requests will be processed/ignored by Webhook Admission
- Matching request: rules
- Matching request: objectSelector
- Matching requests: matchPolicy
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-
controllers/#webhook-configuration

26. Apply dynamic Webhook Admission
Webhook Configuration (Request Matching examples)

27. Demo

28. Demo
- Company X has ECR as registry for all
container image activities
(i.e: registry.company.com)
- To cut down cost, DevOps team must
setup internal “pull-through-caching”
registry
(i.e: registry-cache.company.com)
- Best way to adapt new “registry-cache”
without changing “ci-cd/helm-chart/” so
much ?

29. Beyond story: Hardening your cluster

30. Beyond story: Hardening your cluster

31. Thanks for your attention