Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Admission Webhooks from Scratch

Prisma Cloud
November 18, 2019

Admission Webhooks from Scratch

Admission controller is a piece of code that intercepts requests to Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized.

Admission controller can mutate or reject specific requests based on some criteria. Admission webhooks are dynamic HTTP callbacks that receive the Kubernetes API admission requests and do something with them (e.g., modify or reject to enforce custom policies).

In this session, Liron Levin will talk through how to write and deploy a validating admission webhook from scratch in GO.

Prisma Cloud

November 18, 2019
Tweet

More Decks by Prisma Cloud

Other Decks in Technology

Transcript

  1. 1 | © 2019 Palo Alto Networks. All Rights Reserved.

    Liron Levin Chief software architect, Prisma Cloud Compute Writing dynamic admission controllers from scratch
  2. Today • Learn about admission controllers • Learn about dynamic

    admission controllers • Write and deploy a custom dynamic admission controller from scratch
  3. Admission controller • Intercepts requests to the Kubernetes API server

    after the request is authenticated and authorized but before the object is persistent.
  4. Admission controller • Intercepts requests to the Kubernetes API server

    after the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver
  5. Admission controller • Intercepts requests to the Kubernetes API server

    after the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Create Pod
  6. Admission controller • Intercepts requests to the Kubernetes API server

    after the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Authentication Authorization Create Pod
  7. Admission controller • Intercepts requests to the Kubernetes API server

    after the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Authentication Authorization Mutating admission Create Pod
  8. Admission controller • Intercepts requests to the Kubernetes API after

    the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Authentication Authorization Mutating admission Object schema validation Create Pod
  9. Admission controller • Intercepts requests to the Kubernetes API after

    the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Create Pod
  10. Admission controller • Intercepts requests to the Kubernetes API after

    the request is authenticated and authorized but before the object is persistent. • Compiled into kube-apiserver API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Persistent to etcd Create Pod
  11. Admission Controller • $ kube-apiserver -h | grep enable-admission-plugins •

    --enable-admission-plugins strings admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota)
  12. Common Admission Controllers • AlwaysPullImages - Modifies every new Pod

    to force the image pull policy to Always • LimitRanger This admission controller will observe the incoming request and ensure that it does not violate any of the constraints enumerated in the LimitRange object in a Namespace
  13. Admission controller webhooks • Admission webhooks are HTTP callbacks that

    receive admission requests and do something with them
  14. Admission controller webhooks • Admission webhooks are HTTP callbacks that

    receive admission requests and do something with them API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Persistent to etcd Create Pod
  15. Admission controller webhooks • Admission webhooks are HTTP callbacks that

    receive admission requests and do something with them API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Persistent to etcd Mutating webhooks Create Pod
  16. Admission controller webhooks • Admission webhooks are HTTP callbacks that

    receive admission requests and do something with them API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Persistent to etcd Mutating webhooks Validating webhooks Create Pod
  17. Admission controller webhooks • Admission webhooks are HTTP callbacks that

    receive admission requests and do something with them API HTTP Handler Authentication Authorization Mutating admission Object schema validation Validating admission Persistent to etcd Mutating webhooks Validating webhooks Create Pod
  18. 29 | © 2019 Palo Alto Networks. All Rights Reserved.

    1 Download dependencies and create certificates
  19. 30 | © 2019 Palo Alto Networks. All Rights Reserved.

    1 Download dependencies and create certificates 2 Write the admission controller
  20. 31 | © 2019 Palo Alto Networks. All Rights Reserved.

    1 Download dependencies and create certificates 2 Write the admission controller 3 Build the image
  21. 32 | © 2019 Palo Alto Networks. All Rights Reserved.

    1 Download dependencies and create certificates 2 Write the admission controller 3 Build the image 4 Deploy to k8s
  22. 33 | © 2019 Palo Alto Networks. All Rights Reserved.

    1 Download dependencies and create certificates 2 Write the admission controller 3 Build the image 4 Deploy to k8s 5 Configure and test
  23. Come hear our talk! Binary Authorization in Kubernetes Aysylu Greenberg,

    Google Liron Levin, Palo Alto Networks Wednesday, November 20 • 10:55am - 11:30am