🧠 Kubernetes Admission Controller – Webhooks

A hands-on demonstration of a Mutating Admission Webhook that enforces and modifies Pod security settings in real-time.

This webhook:

• 🔒 Denies Pods that attempt to run as root without explicit permission.
• 🧩 Defaults to runAsNonRoot: true and assigns runAsUser: 1234 if no securityContext is defined.
• ⚙️ Allows explicit root access only if runAsNonRoot: false is set.

---

📜 Step 1 – Creating a Secret for the Webhook Server

We begin by creating a Secret that stores the TLS certificate and key for secure communication between the API server and the webhook.

---

🚀 Step 2 – Deploying the Webhook Server

We deploy the Admission Webhook Server as a Pod, referencing the Secret we created.

This webhook automatically injects or validates security context configurations based on defined logic.

---

🧩 Step 3 – Creating the Webhook Service

Next, we expose the webhook via a Kubernetes Service to allow the API server to communicate securely with it.

---

⚙️ Step 4 – Creating the MutatingWebhookConfiguration

We define a MutatingWebhookConfiguration that registers our webhook with the Kubernetes API server.

The webhook will trigger only on Pod creation requests.

---

🧪 Step 5 – Validating the Webhook Behavior

✅ Test 1 – Default Values Injection

We create a Pod without specifying a securityContext.
The webhook automatically adds runAsNonRoot: true and sets runAsUser: 1234.

✅ It worked! Default values were successfully applied.

---

✅ Test 2 – Explicit runAsNonRoot: false

We test if the webhook respects explicit root permission (runAsNonRoot: false).

✅ It works! The webhook allowed explicitly configured root containers.

---

🚫 Test 3 – Conflict Detection (Denied)

We attempt to create a Pod with conflicting security settings.
The webhook correctly denies the request.

🧠 Magnificent! The webhook enforcement logic works perfectly.

---

🧠 Key Takeaways

• MutatingAdmissionWebhooks dynamically modify or validate resources before creation.
• Webhooks must use TLS for secure communication with the API server.
• You can use them to enforce custom security policies like disallowing root containers.
• Each webhook is defined via a MutatingWebhookConfiguration or ValidatingWebhookConfiguration.

---

Admission Webhooks give you dynamic, policy-driven control over every Kubernetes resource — before it even exists.