Deploying Admission Webhooks

Kind Cluster

](https://book.kubebuilder.io/cronjob-tutorial/#kind-cluster) It is recommended to develop your webhook with akind cluster for faster iteration.Why?

  • You can bring up a multi-node cluster locally within 1 minute.
  • You can tear it down in seconds.
  • You don’t need to push your images to remote registry.

Cert Manager

You need follow this to install the cert manager bundle.

Build your image

Run the following command to build your image locally.

  1. make docker-build

You don’t need to push the image to a remote container registry if you are usinga kind cluster. You can directly load your local image to your kind cluster:

  1. kind load docker-image your-image-namge:your-tag

Deploy Webhooks

You need to enable the webhook and cert manager configuration through kustomize.config/default/kustomization.yaml should now look like the following:

  1. # Adds namespace to all resources.
  2. namespace: project-system
  4. # Value of this field is prepended to the
  5. # names of all resources, e.g. a deployment named
  6. # "wordpress" becomes "alices-wordpress".
  7. # Note that it should also match with the prefix (text before '-') of the namespace
  8. # field above.
  9. namePrefix: project-
  11. # Labels to add to all resources and selectors.
  12. #commonLabels:
  13. #  someName: someValue
  15. bases:
  16. - ../crd
  17. - ../rbac
  18. - ../manager
  19. # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in crd/kustomization.yaml
  20. - ../webhook
  21. # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
  22. - ../certmanager
  24. patches:
  25. - manager_image_patch.yaml
  26.   # Protect the /metrics endpoint by putting it behind auth.
  27.   # Only one of manager_auth_proxy_patch.yaml and
  28.   # manager_prometheus_metrics_patch.yaml should be enabled.
  29. - manager_auth_proxy_patch.yaml
  30.   # If you want your controller-manager to expose the /metrics
  31.   # endpoint w/o any authn/z, uncomment the following line and
  32.   # comment manager_auth_proxy_patch.yaml.
  33.   # Only one of manager_auth_proxy_patch.yaml and
  34.   # manager_prometheus_metrics_patch.yaml should be enabled.
  35. #- manager_prometheus_metrics_patch.yaml
  37. # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in crd/kustomization.yaml
  38. - manager_webhook_patch.yaml
  40. # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
  41. # Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
  42. # 'CERTMANAGER' needs to be enabled to use ca injection
  43. - webhookcainjection_patch.yaml
  45. # the following config is for teaching kustomize how to do var substitution
  46. vars:
  47. # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
  48. - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
  49.   objref:
  50.     kind: Certificate
  51.     group: certmanager.k8s.io
  52.     version: v1alpha1
  53.     name: serving-cert # this name should match the one in certificate.yaml
  54.   fieldref:
  55.     fieldpath: metadata.namespace
  56. - name: CERTIFICATE_NAME
  57.   objref:
  58.     kind: Certificate
  59.     group: certmanager.k8s.io
  60.     version: v1alpha1
  61.     name: serving-cert # this name should match the one in certificate.yaml
  62. - name: SERVICE_NAMESPACE # namespace of the service
  63.   objref:
  64.     kind: Service
  65.     version: v1
  66.     name: webhook-service
  67.   fieldref:
  68.     fieldpath: metadata.namespace
  69. - name: SERVICE_NAME
  70.   objref:
  71.     kind: Service
  72.     version: v1
  73.     name: webhook-service

Now you can deploy it to your cluster by

  1. make deploy

Wait a while til the webhook pod comes up and the certificates are provisioned.It usually completes within 1 minute.

Now you can create a valid CronJob to test your webhooks. The creation shouldsuccessfully go through.

  1. kubectl create -f config/samples/batch_v1_cronjob.yaml

You can also try to create an invalid CronJob (e.g. use an ill-formattedschedule field). You should see a creation failure with a validation error.

Note: If you are