hyrsh/k8s-webhook-server repository overview

⁠Kubernetes Webhook Server

This is a simple webhook server for user-audit and user-denial of requests.

⁠Usage

kubectl create -f https://raw.githubusercontent.com/hyrsh/k8s-webhook-server/main/deployment/deployment-full.yml

This creates the deployment, a rolebinding for local namespace permissions, a configmap, a secret, a service and a template ValidatingWebhookConfiguration (mywebhook.template.io) in the namespce "webhook-hub".

Since the binary within the image tries to create a ValidatingWebhookConfiguration, which is cluster-scoped, the RBAC service account of your container must have the respective permissions (verb "CREATE", "UPDATE" on resource "validatingwebhookconfigurations").

After your first deployment the secret and configmap get mounted (they are optional at first) and you can enable an eternal TLS renewal.

Now you can create ValidatingWebhookConfigurations on your own. See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/⁠ for further information.

To get your caBundle value, you can always refer to the template and get it from there:

kubectl get validatingwebhookconfiguration mywebhook.template.io -o yaml | grep caBundle | awk '{print $2}'

Example config (without caBundle, you have to adjust that):

kubectl create -f https://raw.githubusercontent.com/hyrsh/k8s-webhook-server/main/deployment/example-validate-conf.yml

This will audit all users who try to DELETE or CREATE pods and the logs of the webhook-server pod will print respective output.

Enjoy :)

⁠Code

All code can be found here https://github.com/hyrsh/k8s-webhook-server⁠