Generate a CA certificate and use the certificate to sign the server certificate used by your webhook server.

The communication between the admission controller and the webhook server needs to be secured using TLS. If there is an error encountered when calling a webhook, that request is either denied or the webhook is ignored. If more than one webhook denies the admission request, only the first will be returned to the user. If any of the webhooks deny the request, the admission request is denied, and the reason for doing so is based on the first webhook denial reason. If all of the webhooks approve the request, the admission chain continues. When the API request comes in, the mutating or validating admission controller uses the list of external webhooks in the configuration and calls them in parallel: If the validation passes, OKD schedules the object as configured. At the end of the admissions process, a validating admission controller can invoke webhooks to make sure the object is configured properly, such as verifying affinity labels. During the admission process, a mutating admission controller can invoke webhooks to perform tasks, such as injecting affinity labels.

When an object is instantiated, OKD makes an API call to admit the object. However, the webhooks must adhere to an interface in order to work properly with OKD.Īdmission webhooks is a Technology Preview feature only. Validating admission webhooks allow for the use of validating webhooks to enforce custom admission policies.Ĭonfiguring the webhooks and external webhook servers is beyond the scope of this document. Mutating admission webhooks allow for the use of mutating webhooks to modify resource content before it is persisted. There are two types of admission webhook objects you can configure: In OKD you can use admission webhook objects that call webhook servers during the API admission chain. In addition to the default admission controllers, you can use admission webhooks as part of the admission chain.Īdmission webhooks call webhook servers to either mutate pods upon creation, such as to inject labels, or to validate specific aspects of the pod configuration during the admission process.Īdmission webhooks intercept requests to the master API prior to the persistence of a resource, but after the request is authenticated and authorized.

Webook honors lisy