Validating Admission Webhooks

Validating admission webhooks

Kubernetes provides advanced dynamic mechanisms to gate and govern changes on the configurations and workloads. With admission controllers, we can have granular control over things such as vulnerable container images, containers injections, labels checking, etc. Kubernetes provides not only built-in admission plugins, but also supports external webhooks, such as ImagePolicyWebhook, Validating AdmissionWebhook, and MutatingAdmissionWebhook.

With these pluggable webhooks, we can easily hook our own business logic into the admission control phase in the kube-apiserver. In this lesson, we’re going to dive into the validating admission webhooks.

Configuration

First, to use the validating admission webhook in Kubernetes, we must ensure that the default enabled admission controller plugin ValidatingAdmissionWebhook is in fact enabled, which should be included if we have explicit settings on the flag --enable-admission-plugins, such as:

...