### Deploy Validating Webhook for Ingress Host Validation Source: https://github.com/slok/kubewebhook/blob/master/examples/Readme.md This example sets up a validating webhook to enforce that all ingress rules' hosts match a specific regex. It prevents admission of ingresses that do not comply. The setup includes deploying certificates, the webhook, and its registration. ```shell kubectl apply -f ./ingress-host-validator/deploy/webhook-certs.yaml ``` ```shell kubectl apply -f ./ingress-host-validator/deploy/webhook.yaml ``` ```shell kubectl apply -f ./ingress-host-validator/deploy/webhook-registration.yaml ``` ```shell kubectl apply -f ./test-ingress.yaml ``` -------------------------------- ### Deploy Mutating Webhook for Pod Annotation Source: https://github.com/slok/kubewebhook/blob/master/examples/Readme.md This example demonstrates setting up a mutating webhook to add annotations to pods. It involves deploying webhook certificates, the webhook itself, and registering it with the Kubernetes API server. A test deployment is provided to verify the functionality. ```shell kubectl apply -f ./pod-annotate/deploy/webhook-certs.yaml ``` ```shell kubectl apply -f ./pod-annotate/deploy/webhook.yaml ``` ```shell kubectl apply -f ./pod-annotate/deploy/webhook-registration.yaml ``` ```shell kubectl apply -f ./pod-annotate/deploy/test-deployment.yaml ``` ```shell kubectl get pods -o yaml ``` -------------------------------- ### Create and Serve a Mutating Admission Webhook Source: https://github.com/slok/kubewebhook/blob/master/Readme.md Demonstrates how to create a mutating webhook using Kubewebhook, define a mutator function to modify Pod annotations, and serve the webhook over HTTPS. ```go func run() error { logger := &kwhlog.Std{Debug: true} // Create our mutator mt := kwhmutating.MutatorFunc(func(_ context.Context, _ *kwhmodel.AdmissionReview, obj metav1.Object) (*kwhmutating.MutatorResult, error) { pod, ok := obj.(*corev1.Pod) if !ok { return &kwhmutating.MutatorResult{}, nil } // Mutate our object with the required annotations. if pod.Annotations == nil { pod.Annotations = make(map[string]string) } pod.Annotations["mutated"] = "true" pod.Annotations["mutator"] = "pod-annotate" return &kwhmutating.MutatorResult{MutatedObject: pod}, nil }) // Create webhook. wh, err := kwhmutating.NewWebhook(kwhmutating.WebhookConfig{ ID: "pod-annotate", Mutator: mt, Logger: logger, }) if err != nil { return fmt.Errorf("error creating webhook: %w", err) } // Get HTTP handler from webhook. whHandler, err := kwhhttp.HandlerFor(kwhhttp.HandlerConfig{Webhook: wh, Logger: logger}) if err != nil { return fmt.Errorf("error creating webhook handler: %w", err) } // Serve. logger.Infof("Listening on :8080") err = http.ListenAndServeTLS(":8080", cfg.certFile, cfg.keyFile, whHandler) if err != nil { return fmt.Errorf("error serving webhook: %w", err) } return nil } ``` -------------------------------- ### Kubewebhook Mutating Webhook Configuration Source: https://github.com/slok/kubewebhook/blob/master/Readme.md Details the configuration structure for creating mutating admission webhooks using the Kubewebhook library. This includes parameters for webhook registration and execution. ```APIDOC MutatingWebhookConfig: // WebhookConfig is the base configuration for a webhook. WebhookConfig // NamespaceSelector is a label selector which selects namespaces for which the webhook is applied. NamespaceSelector *metav1.LabelSelector // ObjectSelector is a label selector which selects objects for which the webhook is applied. ObjectSelector *metav1.LabelSelector // FailurePolicy defines how to handle webhook failures. FailurePolicy AdmissionFailurePolicy // SideEffects indicates whether the webhook is safe to run with side effects. SideEffects SideEffectClass // TimeoutSeconds is the timeout in seconds for the webhook to be called. TimeoutSeconds *int32 // ClientConfig is the configuration for the webhook client. ClientConfig WebhookClientConfig // Rules define the operations and resources the webhook applies to. Rules []RuleWithOperations // Version is the API version of the webhook. Version string // Name is the name of the webhook. Name string // Objects is a list of GVKs (Group, Version, Kind) that the webhook applies to. Objects []Object // Context is a map of context information for the webhook. Context map[string]interface{} // NamespaceSelector is a label selector which selects namespaces for which the webhook is applied. NamespaceSelector *metav1.LabelSelector // ObjectSelector is a label selector which selects objects for which the webhook is applied. ObjectSelector *metav1.LabelSelector // FailurePolicy defines how to handle webhook failures. FailurePolicy AdmissionFailurePolicy // SideEffects indicates whether the webhook is safe to run with side effects. SideEffects SideEffectClass // TimeoutSeconds is the timeout in seconds for the webhook to be called. TimeoutSeconds *int32 // ClientConfig is the configuration for the webhook client. ClientConfig WebhookClientConfig // Rules define the operations and resources the webhook applies to. Rules []RuleWithOperations // Version is the API version of the webhook. Version string // Name is the name of the webhook. Name string // Objects is a list of GVKs (Group, Version, Kind) that the webhook applies to. Objects []Object // Context is a map of context information for the webhook. Context map[string]interface{} ``` -------------------------------- ### Kubewebhook Validating Webhook Configuration Source: https://github.com/slok/kubewebhook/blob/master/Readme.md Details the configuration structure for creating validating admission webhooks using the Kubewebhook library. This includes parameters for webhook registration and execution. ```APIDOC ValidatingWebhookConfig: // WebhookConfig is the base configuration for a webhook. WebhookConfig // NamespaceSelector is a label selector which selects namespaces for which the webhook is applied. NamespaceSelector *metav1.LabelSelector // ObjectSelector is a label selector which selects objects for which the webhook is applied. ObjectSelector *metav1.LabelSelector // FailurePolicy defines how to handle webhook failures. FailurePolicy AdmissionFailurePolicy // SideEffects indicates whether the webhook is safe to run with side effects. SideEffects SideEffectClass // TimeoutSeconds is the timeout in seconds for the webhook to be called. TimeoutSeconds *int32 // ClientConfig is the configuration for the webhook client. ClientConfig WebhookClientConfig // Rules define the operations and resources the webhook applies to. Rules []RuleWithOperations // Version is the API version of the webhook. Version string // Name is the name of the webhook. Name string // Objects is a list of GVKs (Group, Version, Kind) that the webhook applies to. Objects []Object // Context is a map of context information for the webhook. Context map[string]interface{} ``` -------------------------------- ### Kubernetes Runtime Unstructured Object Source: https://github.com/slok/kubewebhook/blob/master/Readme.md Describes the Unstructured type from the Kubernetes apimachinery, used for handling arbitrary Kubernetes objects without predefined Go types. ```APIDOC Unstructured: // Object is a map of string keys to values. Any JSON value may be provided as the value of a string key. Object map[string]interface{} // SetGroupVersionKind sets the GroupVersionKind for the Unstructured object. SetGroupVersionKind(gvk schema.GroupVersionKind) // GetGroupVersionKind returns the GroupVersionKind of the Unstructured object. GetGroupVersionKind() schema.GroupVersionKind // SetNamespace sets the namespace of the Unstructured object. SetNamespace(namespace string) // GetNamespace returns the namespace of the Unstructured object. GetNamespace() string // SetName sets the name of the Unstructured object. SetName(name string) // GetName returns the name of the Unstructured object. GetName() string // SetUID sets the UID of the Unstructured object. SetUID(uid types.UID) // GetUID returns the UID of the Unstructured object. GetUID() types.UID // SetResourceVersion sets the resource version of the Unstructured object. SetResourceVersion(version string) // GetResourceVersion returns the resource version of the Unstructured object. GetResourceVersion() string // SetCreationTimestamp sets the creation timestamp of the Unstructured object. SetCreationTimestamp(t metav1.Time) // GetCreationTimestamp returns the creation timestamp of the Unstructured object. GetCreationTimestamp() metav1.Time // SetDeletionTimestamp sets the deletion timestamp of the Unstructured object. SetDeletionTimestamp(t metav1.Time) // GetDeletionTimestamp returns the deletion timestamp of the Unstructured object. GetDeletionTimestamp() metav1.Time // SetSelfLink sets the self link of the Unstructured object. SetSelfLink(selfLink string) // GetSelfLink returns the self link of the Unstructured object. GetSelfLink() string // SetUID sets the UID of the Unstructured object. SetUID(uid types.UID) // GetUID returns the UID of the Unstructured object. GetUID() types.UID // SetGeneration sets the generation of the Unstructured object. SetGeneration(generation int64) // GetGeneration returns the generation of the Unstructured object. GetGeneration() int64 // SetOwnerReferences sets the owner references of the Unstructured object. SetOwnerReferences(ownerReferences []metav1.OwnerReference) // GetOwnerReferences returns the owner references of the Unstructured object. GetOwnerReferences() []metav1.OwnerReference // SetFinalizers sets the finalizers of the Unstructured object. SetFinalizers(finalizers []string) // GetFinalizers returns the finalizers of the Unstructured object. GetFinalizers() []string // SetLabels sets the labels of the Unstructured object. SetLabels(labels map[string]string) // GetLabels returns the labels of the Unstructured object. GetLabels() map[string]string // SetAnnotations sets the annotations of the Unstructured object. SetAnnotations(annotations map[string]string) // GetAnnotations returns the annotations of the Unstructured object. GetAnnotations() map[string]string // SetClusterName sets the cluster name of the Unstructured object. SetClusterName(clusterName string) // GetClusterName returns the cluster name of the Unstructured object. GetClusterName() string // SetManagedFields sets the managed fields of the Unstructured object. SetManagedFields(managedFields []metav1.ManagedFieldsEntry) // GetManagedFields returns the managed fields of the Unstructured object. GetManagedFields() []metav1.ManagedFieldsEntry ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.