What are admission webhooks?

Admission Webhooks in Kubernetes are HTTP callbacks that receive requests to modify or create resources. They allow intercepting requests to the Kubernetes API server before objects are stored in Etcd.

There are two main types:

• Mutating Admission Webhooks: Can modify objects before they are saved. For example, automatically adding labels or annotations to pods.
• Validating Admission Webhooks: Can reject requests if objects do not meet certain rules. For example, disallowing the creation of pods without specific securityContext fields.

Webhooks are deployed as services within the cluster and are configured using MutatingWebhookConfiguration and ValidatingWebhookConfiguration resources. These resources specify which operations (CREATE, UPDATE, DELETE) and which resources (pods, deployments, etc.) the webhook should be invoked for.

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: example-validating-webhook
webhooks:
  - name: validate.example.com # Hook name
    clientConfig:
      service:
        namespace: default # Namespace of the webhook service
        name: example-webhook-service # Name of the webhook service
    rules:
      - operations: ["CREATE", "UPDATE"] # Operations to intercept
        apiGroups: [""] # API group (for pods)
        apiVersions: ["v1"] # API version
        resources: ["pods"] # Resource type
    sideEffects: None # Indicates whether the hook has side effects (none here)

They enable implementing custom resource policies and mutation logic, complementing Kubernetes' built-in Admission Controllers.