介绍

Webhook就是一种HTTP回调，用于在某种情况下执行某些动作，Webhook不是K8S独有的，很多场景下都可以进行Webhook，比如在提交完代码后调用一个Webhook自动构建docker镜像

准入 Webhook 是一种用于接收准入请求并对其进行处理的 HTTP 回调机制。 可以定义两种类型的准入 Webhook， 即验证性质的准入 Webhook 和变更性质的准入 Webhook。 变更性质的准入 Webhook 会先被调用。它们可以修改发送到 API 服务器的对象以执行自定义的设置默认值操作。

在完成了所有对象修改并且 API 服务器也验证了所传入的对象之后， 验证性质的 Webhook 会被调用，并通过拒绝请求的方式来强制实施自定义的策略。

Admission Webhook使用较多的场景如下

在资源持久化到ETCD之前进行修改（Mutating Webhook），比如增加init Container或者sidecar Container在资源持久化到ETCD之前进行校验（Validating Webhook），不满足条件的资源直接拒绝并给出相应信息

组成

webhook 服务webhook 配置webhook 证书

创建核心组件Pod的Webhook

使用kubebuilder新建webhook项目

<code>kubebuilder init --domain test.com --repo gitlab.qima-inc.com/test-operator

(base) (⎈ |kubernetes-admin@qa-u03:qa)➜ test-operator kubebuilder init --domain test.com --repo gitlab.qima-inc.com/test-operator

INFO Writing kustomize manifests for you to edit...

INFO Writing scaffold for you to edit...

INFO Get controller runtime:

$ go get sigs.k8s.io/controller-runtime@v0.17.2

INFO Update dependencies:

$ go mod tidy

go: go.mod file indicates go 1.21, but maximum version supported by tidy is 1.19

Error: failed to initialize project: unable to run post-scaffold tasks of "base.go.kubebuilder.io/v4": exit status 1

因为我默认是是go1.19所以版本达不到要求，这里两种处理方式

指定 --plugins go/v3 --project-version 3切换高版本golang 这里我切换了go1.22

(base) (⎈ |kubernetes-admin@qa-u03:qa)➜ test-operator kubebuilder init --domain test.com --repo gitlab.qima-inc.com/test-operator

INFO Writing kustomize manifests for you to edit...

INFO Writing scaffold for you to edit...

INFO Get controller runtime:

$ go get sigs.k8s.io/controller-runtime@v0.17.2

INFO Update dependencies:

$ go mod tidy

Next: define a resource with:

$ kubebuilder create api

生成核心组件Pod的API

(base) (⎈ |kubernetes-admin@qa-u03:qa)➜ test-operator kubebuilder create api --group core --version v1 --kind Pod

INFO Create Resource [y/n]

n

INFO Create Controller [y/n]

n

INFO Writing kustomize manifests for you to edit...

INFO Writing scaffold for you to edit...

INFO Update dependencies:

$ go mod tidy

这里有两个选项，创建资源和创建控制器 因为是内置资源Pod所以不需要创建资源，也不需要控制器 假如是自定义资源，需要创建资源，创建控制器

创建webhook

(base) (⎈ |kubernetes-admin@qa-u03:qa)➜ test-operator kubebuilder create webhook --group core --version v1 --kind Pod --defaulting --programmatic-validation

INFO Writing kustomize manifests for you to edit...

ERRO Unable to find the target(s) #- path: patches/webhook/* to uncomment in the file config/crd/kustomization.yaml.

ERRO Unable to find the target(s) #configurations:

#- kustomizeconfig.yaml to uncomment in the file config/crd/kustomization.yaml.

INFO Writing scaffold for you to edit...

INFO api/v1/pod_webhook.go

INFO api/v1/pod_webhook_test.go

INFO api/v1/webhook_suite_test.go

INFO Update dependencies:

$ go mod tidy

INFO Running make:

$ make generate

mkdir -p /Users/xxxx/test-operator/bin

Downloading sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0

/Users/xxxx/test-operator/bin/controller-gen-v0.14.0 object:headerFile="hack/boilerplate.go.txt" paths="./..."code>

Next: implement your new Webhook and generate the manifests with:

$ make manifests

代码结构

.

├── Dockerfile

├── Makefile

├── PROJECT

├── README.md

├── api

│   └── v1

│   ├── pod_webhook.go

│   ├── pod_webhook_test.go

│   └── webhook_suite_test.go

├── bin

│   └── controller-gen-v0.14.0

├── cmd

│   └── main.go

├── config

│   ├── certmanager

│   │   ├── certificate.yaml

│   │   ├── kustomization.yaml

│   │   └── kustomizeconfig.yaml

│   ├── crd

│   │   └── patches

│   │   ├── cainjection_in_pods.yaml

│   │   └── webhook_in_pods.yaml

│   ├── default

│   │   ├── kustomization.yaml

│   │   ├── manager_auth_proxy_patch.yaml

│   │   ├── manager_config_patch.yaml

│   │   ├── manager_webhook_patch.yaml

│   │   └── webhookcainjection_patch.yaml

│   ├── manager

│   │   ├── kustomization.yaml

│   │   └── manager.yaml

│   ├── prometheus

│   │   ├── kustomization.yaml

│   │   └── monitor.yaml

│   ├── rbac

│   │   ├── auth_proxy_client_clusterrole.yaml

│   │   ├── auth_proxy_role.yaml

│   │   ├── auth_proxy_role_binding.yaml

│   │   ├── auth_proxy_service.yaml

│   │   ├── kustomization.yaml

│   │   ├── leader_election_role.yaml

│   │   ├── leader_election_role_binding.yaml

│   │   ├── role.yaml

│   │   ├── role_binding.yaml

│   │   └── service_account.yaml

│   └── webhook

│   ├── kustomization.yaml

│   ├── kustomizeconfig.yaml

│   ├── manifests.yaml

│   └── service.yaml

├── go.mod

├── go.sum

├── hack

│   └── boilerplate.go.txt

└── test

├── e2e

│   ├── e2e_suite_test.go

│   └── e2e_test.go

└── utils

└── utils.go

实现Webhook相关代码