关于kubernetes:kubernetes的Admission-Webhook探析

Admission Webhook是kubernetes中的准入控制器，用于在apiserver中，对API Request进行拦挡，而后对API Request进行特定的解决，解决操作包含：

• Mutating: 批改API Request中的对象；
• Validating: 校验API Request中的对象，若校验非法，则间接返回client，不再持续；

apiserver提供了Admission Webhook的扩大机制，容许用户自定义webhook，而后注册到apiserver上就能够发挥作用了。

一.Admission Webhook的架构

API Request在apiserver中的处理过程：

• 认证：通常是client端提供证书；
• 鉴权：校验client是否有操作相应资源的权限，应用rbac实现;

• MutatingAdmission:

  • 对传入的资源对象进行批改；
  • 用户能够注册自定义的webhook；
• Schema Validation: 对传入对象的schema进行校验；

• ValiatingAdmission:

  • 对传入的资源对象进行校验，若校验失败，则间接返回client；
  • 用户能够注册自定义的webhook；
• 最初，将对象存入etcd；

用户自定义的webhook通常应用deploy部署，同时部署对应的service，在将webhook注册到apiserver时，提供service的名称以及拜访的url path，这样apiserver就能够应用自定义webhook的性能逻辑了。

apiserver与webhook之间的通信接口为/api/admission/v1/AdmissionReview构造。

二.AdmissionReview的构造

apiserver与自定义webhook之间通过http通信，其Request和Response均是/api/admission/v1/AdmissionReview构造，也就是说：

• 自定义webhook在解决http申请时，须要将requestBody反序列化为AdmissionReview构造；
• 自定义webhook在发送http响应后，须要结构AdmissionReview构造，将其序列化后发送进来；

AdmissionReview构造既蕴含Request，也蕴含Response:

// AdmissionReview describes an admission review request/response.
type AdmissionReview struct {
    metav1.TypeMeta `json:",inline"`
    // Request describes the attributes for the admission request.
    // +optional
    Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
    // Response describes the attributes for the admission response.
    // +optional
    Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
}

1. 申请：AdmissionRequest

AdmissionRequest中封装了发送给apiserver的申请信息，蕴含咱们创立、更新、删除的Deploy/Service/Pod等信息，比方：

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "request": {
    # Random uid uniquely identifying this admission call
    "uid": <random uid>,
    ...
    "object": {"apiVersion":"v1","kind":"Pod",...},
    ...
    }
}

2. 响应：AdmissionResponse

AdmissionResponse封装了准入管制的后果:

• 对于Mutating: 须要返回批改对象的Patch；
• 对于Validating: 须要返回对象的校验后果，若校验失败，还要带上errMsg；

比方，Mutating的AdmissionResponse:

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": true/false,
    "status": {
      "code": <optional http status code, ex: 200/403>,
      "message": "optional message"
    },
    "patchType": "JSONPatch",
    "patch": <base64 encoded JSON patch>
  }
}

比方，Validating的AdmissionResponse:

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": true/false,
    "status": {
      "code": <optional http status code, ex: 200/403>,
      "message": "optional message"
    }
  }
}

三.注册webhook到apiserver

webhook要注册到apiserver后能力失效。

webhook注册到apiserver时，须要通知apiserver:

• webhook的svc名称、命名空间；
• webhook的URL Path；
• webhook作用的指标对象的筛选规定；
• webhook操作的指标对象及操作；

对于Mutating，注册由MutatingWebhookConfiguration资源类型形容，创立该资源对象即意味着注册，比方：

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: mutating-webhook-example-cfg
  labels:
    app: admission-webhook-example
webhooks:
  - name: mutating-example.com
    clientConfig:
      service:                                // webhook的svc
        name: admission-webhook-example-svc
        namespace: default
        path: "/mutate"                        // webhook的url path
      caBundle: ${CA_BUNDLE}
    rules:                                    // 操作的资源
      - operations: [ "CREATE" ]
        apiGroups: ["apps", ""]
        apiVersions: ["v1"]
        resources: ["deployments","services"]
    namespaceSelector:                        // 指标对象的筛选规定
      matchLabels:
        admission-webhook-example: enabled

对于Validating，注册由ValidatingWebhookConfiguration资源类型形容，创立该资源对象即意味着注册：

apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: validation-webhook-example-cfg
  labels:
    app: admission-webhook-example
webhooks:
  - name: validating-example.com
    clientConfig:
      service:                                // webhook的svc
        name: admission-webhook-example-svc
        namespace: default
        path: "/validate"                    // webhook的url path
      caBundle: ${CA_BUNDLE}
    rules:                                    // 操作的资源
      - operations: [ "CREATE" ]
        apiGroups: ["apps", ""]
        apiVersions: ["v1"]
        resources: ["deployments","services"]
    namespaceSelector:                        // 指标对象的筛选规定
      matchLabels:
        admission-webhook-example: enabled

参考：

1.https://www.qikqiak.com/post/k8s-admission-webhook/
2.AdmissionReview的构造：https://github.com/kubernetes/api/blob/master/admission/v1/types.go