Mutating Admission Webhooks

Mutating admission webhooks

Kubernetes admission controllers provide us with ways to enforce rules or restrictions on the changes to the cluster, such as updating Pod labels, limiting resource quota, preventing unexpected operations on deleting objects, etc.

Sometimes, when built-in admission plugins don’t suffice for what we need, we can use external webhooks for validating and mutating. In such an out-of-tree way, we can inject our custom logic into the Kubernetes admission control pipeline.

Configuring the mutating admission webhook

Firstly, to use the mutating admission webhook in Kubernetes, we must ensure that the default enabled admission controller plugin MutatingAdmissionWebhook is actually enabled. This should be included if we have explicit settings on the flag --enable-admission-plugins, such as:

--enable-admission-plugins=...,MutatingAdmissionWebhook,...

Secondly, we need to create a configuration containing a stanza that looks just like the one below. This ...