A small k8s-webhook, designed to mount a specific configuration in the Pod. Currently supported:
- Labels
- Affinity
- NodeSelector
- Tolerations
For a review, visit this page: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/
Step 1: Pre-install
Install on a working machine with Windows Golang, Docker Desktop, make.
https://www.docker.com/products/docker-desktop
http://gnuwin32.sourceforge.net/packages/make.htm
Step 2: Build
Run: make docker
Step 3: Deploy
Save the docker image to tar file, distribute to nodes and upload:
docker save -o webhook.tar k8s-webhook:v1
docker load -i webhook.tar
Create a deploy directory and place the following files on the node:
gen-certificates.sh
ca-bundle.sh
deployment.yaml
service.yaml
mutationwebhook.yaml
config.yaml
Make * .sh files executable:
chmod +x
Next, we need to generate certificates that will be used for work. To do this, run the gen-certifictes.sh script.
The mutatingwebhook.yaml file contains a CA_BUNDLE stub, instead of which we need to put the caBundle of k8s cluster. To do this, we will perform transformations using the ca-bundle.sh script:
cat mutatingwebhook.yaml | ./ca-bundle.sh > mutatingwebhook-ca.yaml
Check the new file that caBundle has been added successfully. We are almost ready to deploy webhook, let's look at the deployment files.
Pay attention to volumeMounts and volumes. Here we are mount our secrets and two ConfigsMap's, which describe the logic of which pods and how we will change.
Let's take a closer look at part of the config. As I pointed out in the beginning, this is just an example of how we can manage the webhook based on configuration. In aacc-webhook-coreconfig, we create a mapconfigs.yaml file (hardcoded name), in which we describe which pods need to be changed, the parameters are as follows:
labelKey - the label that the webhook will look for in labels
value - the key value that the webhook will look for. If key and value are the same, a decision is made that the pod will be patched.
file - filename from ConfigMap k8s-webhook-configs containing content to be added.
types - list of configuration types, the webhook can add several types at once if they are supported in the code and content has been created for them. At the moment, the demo version supports Affinity, nodeSelector, toleration.