https://github.com/yankeguo-deprecated/admission-bootstrapper
a tool to bootstrap k8s-autoops admission webhooks
https://github.com/yankeguo-deprecated/admission-bootstrapper
Last synced: about 2 months ago
JSON representation
a tool to bootstrap k8s-autoops admission webhooks
- Host: GitHub
- URL: https://github.com/yankeguo-deprecated/admission-bootstrapper
- Owner: yankeguo-deprecated
- License: mit
- Created: 2020-10-19T06:49:06.000Z (over 4 years ago)
- Default Branch: latest
- Last Pushed: 2021-07-02T04:19:12.000Z (almost 4 years ago)
- Last Synced: 2025-02-14T16:58:27.082Z (3 months ago)
- Language: Go
- Size: 3.36 MB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# admission-bootstrapper
A tool to deploy admission webhooks in kubernetes, no need to concern any certificate signing issues.
## Usage
### Initialization
* Create namespace `autoops`
* Apply resources as described below
```yaml
# create serviceaccount
apiVersion: v1
kind: ServiceAccount
metadata:
name: admission-bootstrapper
namespace: autoops
---
# create clusterrole
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: admission-bootstrapper
rules:
- apiGroups: [""]
resources: ["secrets", "services"]
verbs: ["get", "create"]
- apiGroups: ["apps"]
resources: ["statefulsets"]
verbs: ["get", "create"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
verbs: ["get", "create"]
---
# create clusterrolebinding
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: admission-bootstrapper
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: admission-bootstrapper
subjects:
- kind: ServiceAccount
name: admission-bootstrapper
namespace: autoops
```
### Deploy an Admission Webhook
**Image Requirements**
* Listens at `:443`
* Use certificates from `/autoops-data/tls/tls.crt` and `/autoops-data/tls/tls.key`
**Example**
See https://github.com/k8s-autoops/admission-httpscat
Here is an example to deploy `admission-httpscat` to validate any `CREATE` operations of `ConfigMap`
```yaml
# create job
apiVersion: batch/v1
kind: Job
metadata:
# !!!CHANGE ME!!!
name: admission-bootstrapper-httpscat
namespace: autoops
spec:
template:
spec:
serviceAccount: admission-bootstrapper
containers:
- name: admission-bootstrapper
image: autoops/admission-bootstrapper
env:
- name: ADMISSION_NAME
value: admission-httpscat
- name: ADMISSION_IMAGE
value: autoops/admission-httpscat
- name: ADMISSION_ENVS
value: "AAAA=BBBB;CCCC=DDDD"
- name: ADMISSION_MUTATING
value: "false"
- name: ADMISSION_SERVICE_ACCOUNT
value: ""
- name: ADMISSION_IGNORE_FAILURE
value: "true"
- name: ADMISSION_SIDE_EFFECT
value: "None"
- name: ADMISSION_RULES
value: '[{"operations":["CREATE"],"apiGroups":[""], "apiVersions":["*"], "resources":["configmaps"]}]'
restartPolicy: OnFailure
```
## Credits
Guo Y.K., MIT License