This document discusses mutating admission webhooks in Kubernetes. It provides context on PNFs, VNFs, and CNFs. It then describes how a mutating admission webhook can be implemented to inject a generic NSE sidecar into pods. It outlines the prerequisites and provides links to example implementations of generating certificates, deploying webhook resources, and creating a MutatingWebhookConfiguration to deploy the webhook.

1. Mutating Admission
Webhook creation
Victor Morales

2. Victor Morales
• +15 yrs as a Software Engineer
• .NET, Java, python, Go programmer
• OpenStack, OPNFV, ONAP and CNCF
contributor.
https://about.me/electrocucaracha

3. Agenda
• Context
• PNFs, VNFs and CNFs
• GW Tester - Proposal
• CNF Challenges
• Portability – Multus, DANM and NSM
• NSM gaps
• NSE Generic sidecar
• Admission Webhooks
• Mutating Admission Webhook
• Implementation
• Deployment

4. PNFs, VNFs and CNFs (TBD)
• Physical Network Function (PNF): Refers to the legacy network appliances on proprietary hardware.
• Virtualized Network Function (VNF): A software application that deliver network functions such as
directory services, routers, firewalls, load balancers, and
more. https://www.redhat.com/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference
• Cloud Native Network Function (CNF): A cloud native application that provides network
functionality and is developed using cloud native principles. https://github.com/cncf/cnf-
wg/blob/main/doc/glossary.md#community-definitions
https://networking.cloud-native-principles.org/cloud-native-principles
https://github.com/cncf/cnf-wg/pull/171

5. CNF Reference – GW Tester
https://github.com/gw-tester/

6. Kubernetes – Multiple Networks
https://codilime.com/kubernetes-workloads-using-multiple-networks/

7. Multiple NICs Solutions
Multus and DANM
annotations can coexist
in a Pod/Deployment
definition

8. Multiple NICs
Solutions (cont.)
NSM requires different
approach

9. Portability?

10. Multiple NICs – Goal Annotations can help
to make CNFs portable

11. NSM challenges

12. NSE Generic sidecar
https://github.com/gw-tester/nse
A NSE sidecar implementation
that uses:
• Multiple services per one
endpoint
• DownwardAPI feature

13. Admission Webhooks
Admission webhooks are HTTP callbacks that receive admission requests and do something
with them. You can define two types of admission webhooks, validating admission
webhook and mutating admission webhook. Mutating admission webhooks are invoked
first, and can modify objects sent to the API server to enforce custom defaults…
https://kubernetes.io/docs/reference/access-
authn-authz/extensible-admission-controllers/
https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/

14. Mutating Admission
Webhook in details
https://medium.com/ibm-cloud/diving-into-
kubernetes-mutatingadmissionwebhook-
6ef3c5695f74

15. Webhook Admission Server
It is just plain http server that adhere to Kubernetes API. For
each request to the apiserver, the
MutatingAdmissionWebhook sends an admissionReview(API
for reference) to the relevant webhook admission server.
Prerequisites:
• Kubernetes +1.9
• admissionregistration.k8s.io/v1 API enabled
$ kubectl api-versions | grep admissionregistration.k8s.io/v1
NSE injector webhook
admissionReview
Request
/mutate
ns.networkservicemesh.io/status == injected ?
createPatch
json.Marshal(admissionReview)
admissionReview
Response
Yes
No

16. Webhook Admission
Implementation

17. https://github.com/gw-tester/nse-injector-
webhook/blob/master/internal/routers/webhookrouter/
webhook.go#L48
https://github.com/gw-tester/nse-injector-
webhook/blob/master/internal/handlers/webhookhld/mutator.go#L102

18. https://github.com/gw-tester/nse-injector-webhook/blob/master/internal/core/domain/mutator.go#L196
https://github.com/gw-tester/nse-injector-
webhook/blob/master/internal/core/domain/mutator.go#L116

19. Webhook Admission Deployment

20. Overview
1. Generate a certificate signed by Kubernetes CA
2. Deploy NSE injector webhook resources
3. Create a MutatingWebhookConfiguration resource
4. Add nse-sidecar-injection namespace’s label
https://github.com/gw-tester/nse-injector-webhook/blob/master/Makefile#L43-L47

21. Generate a certificate
https://github.com/gw-tester/nse-injector-
webhook/blob/master/scripts/webhook-create-signed-
cert.sh

22. Deploy K8s
resources
https://github.com/gw-tester/nse-injector-webhook/blob/master/deployments/k8s.yml

23. Dockerfile
https://github.com/gw-tester/nse-injector-
webhook/blob/master/Dockerfile

24. Create a MutatingWebhookConfiguration
https://github.com/gw-tester/nse-injector-
webhook/blob/master/deployments/mutatingwebho
ok.yaml

25. Putting all
together
$ git clone --depth=1 https://github.com/gw-tester/infra
$ cd infra/
$ vagrant ssh nsm -- git clone --depth=1 https://github.com/gw-tester/helm-charts
$ vagrant ssh nsm -- "cd helm-charts; ./check.sh"

26. Q&A
https://medium.com/ibm-cloud/diving-into-kubernetes-
mutatingadmissionwebhook-6ef3c5695f74