init

admission/k8s/0-ns.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: webhook
+  

admission/k8s/1-svc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: admission
+  namespace: webhook
+spec:
+  selector:
+    app: admission
+  ports:
+  - port: 443
+    targetPort: 443
+    

admission/k8s/100-controlled-ns.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: controlled
+  

admission/k8s/101-pod.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: demo
+  namespace: controlled
+spec:
+  containers:
+  - name: demo
+    image: ghcr.io/trion-development/echoserver:1
+    resources: {}
+    ports:
+      - containerPort: 3000
+

admission/k8s/102-pod.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: demo-two
+  namespace: controlled
+  labels:
+    some: value
+spec:
+  containers:
+  - name: demo
+    image: ghcr.io/trion-development/echoserver:1
+    resources: {}
+    ports:
+      - containerPort: 3000
+

admission/k8s/2-deployment.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: admission
+  namespace: webhook
+spec:
+  selector:
+    matchLabels:
+      app: admission
+  template:
+    metadata:
+      labels:
+        app: admission
+    spec:
+      containers:
+      - name: app
+        image: localhost:5000/admission:latest #worst practice
+        # image: localhost:5000/admission:1
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "50m"
+        ports:
+        - containerPort: 443

admission/k8s/3-admission.yaml

@@ -0,0 +1,31 @@
+apiVersion: admissionregistration.k8s.io/v1
+# kind: ValidatingWebhookConfiguration
+kind: MutatingWebhookConfiguration
+metadata:
+  name: sample
+webhooks:
+  - name: "sample-webhook.trion.de"
+    admissionReviewVersions: [v1]
+    rules:
+      - apiGroups: [""]
+        apiVersions: ["v1"]
+        operations: ["CREATE"]
+        resources: ["pods"]
+    clientConfig:             # url OR service
+      #url: "https://outside.example.com"
+      service:
+        name: admission
+        namespace: webhook
+        path: "/mutate"
+        # path: "/validate"
+        port: 443
+      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFVENDQWZtZ0F3SUJBZ0lVWFFIM0ZkdmVYQ0ZwY2k2eE5acy83bjVXeDhrd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0lERWVNQndHQTFVRUF3d1ZZV1J0YVhOemFXOXVMbmRsWW1odmIyc3VjM1pqTUI0WERUSTFNRFV5TWpFdwpNemswTlZvWERUSTJNRFV5TWpFd016azBOVm93SURFZU1Cd0dBMVVFQXd3VllXUnRhWE56YVc5dUxuZGxZbWh2CmIyc3VjM1pqTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF2OW54VjBHMmpOSmkKbzVRemFzb1QvVkl1eTdYZityRnI3UFF6RHVnejRQVXIwakRBNmluZURvV3VSQlhXMDV3Z2tnazJzSFpiYjJNegpQYUNlZkFDUWpwOEZ5QUxMYjFOcVVjVThJajdjMEZ2Mk1HME84bXUrNXNwNUoyLyt6cWl6bGJyMFFEQnd1YU9oCmYzN28zblVFdUgyMEtJODNTMXgzOEJNNnRyOWo4ZlN2YTlselpBZTl5K25Sc1hGb1NST2xDbGRYTGJTSDBNN3IKNU96Z1JJSTQrK3JOR0N4ZTdwRndPeGxiTEJTa0VQYUJUem4wTkhnYkJ5TzJNM25FVkJwcHlsKzBBZkU1QWI2OAo0VllVM3A5U2ZrNmlSaHVRSWRCWURTTUtEQ3gwY01VWWp1YlRpZ0FadFZoaW1lQlBmZ3RIQSt5M1hvcjM3UEJLCmNHZFdXL2VXdlFJREFRQUJvME13UVRBZ0JnTlZIUkVFR1RBWGdoVmhaRzFwYzNOcGIyNHVkMlZpYUc5dmF5NXoKZG1Nd0hRWURWUjBPQkJZRUZKQlA2aU5uUDdxVkt0QVVCRTFFeEx6OVd1Y3RNQTBHQ1NxR1NJYjNEUUVCQ3dVQQpBNElCQVFCdFdLTXVYbmlVRGx2cnZVeGRHUGVPMTV5TTFRMXdnaGE5bE5laXl2NHI2NFNTWi80Q3pWV2pWVWVDCmJvU1VoeDhPV2h1VjhWbjVOM0xhemVjVmpyemdBeWM5aUoxWUMrYlVPWHpyR3RRaEhUS0liNlkwNlVRclJWOG0KVGc3RVdLM1VxV2xwcG9WcU8xYU9QYUt5T3YzK2xGOUF1dFZ6YW1MS1FjQVRMS1VmSk05dWRLRTZtS2FJQlNHVwo2eU1tRC9XWTNCeG9URi9JWWhSSjQyWmtIMGlSK2FOaStBMmN4K1ZSZUFTWEVMUVg4ZlZJSVE2M0twWmxNNHRvCnB1WFZzcG4yaktvVWlqRVJwSWNpZHlxaXVVSitNWVg0SStFUEs0aTdWZnpvaVJJRXA3TmhPUVZpaGt3dHc0Tk0KSzgrVHg0YVJsY2xPeTNBM3dqOUxmN2kxdHc3NAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    sideEffects: None # or NoneOnDryRun
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+          - controlled
+#      matchLabels:
+#        enforce-image: enabled