What are the most common examples of using admission webhooks?

Extension and validation of Kubernetes objects before saving to etcd.

• Mutating webhooks: Modify request objects. Examples:
  • Automatic injection of sidecar containers (e.g., service meshes).
  • Adding standard labels and annotations.
  • Changing default security settings (e.g., adding securityContext).
  • Injecting secrets or ConfigMaps into pods.
• Validating webhooks: Check request objects and reject them if they do not comply with policies. Examples:
  • Checking container images used (e.g., only from allowed repositories).
  • Prohibiting the use of privileged containers.
  • Ensuring compliance with network policies.
  • Checking resource limits (requests and limits).
  • Auditing configurations (e.g., presence of readiness/liveness probes).

Both types of webhooks operate synchronously with the API server and can reject create, update, or delete requests for resources. The order of execution: mutating webhooks run first, followed by validating webhooks.