Mutating Admission Webhook creation
•Download as PPTX, PDF•
0 likes•164 views
This document discusses mutating admission webhooks in Kubernetes. It provides context on PNFs, VNFs, and CNFs. It then describes how a mutating admission webhook can be implemented to inject a generic NSE sidecar into pods. It outlines the prerequisites and provides links to example implementations of generating certificates, deploying webhook resources, and creating a MutatingWebhookConfiguration to deploy the webhook.
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to Mutating Admission Webhook creation
Similar to Mutating Admission Webhook creation (20)
More from Victor Morales
More from Victor Morales (20)
Recently uploaded
Recently uploaded (20)
Mutating Admission Webhook creation
- 1. Mutating Admission Webhook creation Victor Morales
- 2. Victor Morales • +15 yrs as a Software Engineer • .NET, Java, python, Go programmer • OpenStack, OPNFV, ONAP and CNCF contributor. https://about.me/electrocucaracha
- 3. Agenda • Context • PNFs, VNFs and CNFs • GW Tester - Proposal • CNF Challenges • Portability – Multus, DANM and NSM • NSM gaps • NSE Generic sidecar • Admission Webhooks • Mutating Admission Webhook • Implementation • Deployment
- 4. PNFs, VNFs and CNFs (TBD) • Physical Network Function (PNF): Refers to the legacy network appliances on proprietary hardware. • Virtualized Network Function (VNF): A software application that deliver network functions such as directory services, routers, firewalls, load balancers, and more. https://www.redhat.com/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference • Cloud Native Network Function (CNF): A cloud native application that provides network functionality and is developed using cloud native principles. https://github.com/cncf/cnf- wg/blob/main/doc/glossary.md#community-definitions https://networking.cloud-native-principles.org/cloud-native-principles https://github.com/cncf/cnf-wg/pull/171
- 5. CNF Reference – GW Tester https://github.com/gw-tester/
- 6. Kubernetes – Multiple Networks https://codilime.com/kubernetes-workloads-using-multiple-networks/
- 7. Multiple NICs Solutions Multus and DANM annotations can coexist in a Pod/Deployment definition
- 8. Multiple NICs Solutions (cont.) NSM requires different approach
- 9. Portability?
- 10. Multiple NICs – Goal Annotations can help to make CNFs portable
- 11. NSM challenges
- 12. NSE Generic sidecar https://github.com/gw-tester/nse A NSE sidecar implementation that uses: • Multiple services per one endpoint • DownwardAPI feature
- 13. Admission Webhooks Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission webhook and mutating admission webhook. Mutating admission webhooks are invoked first, and can modify objects sent to the API server to enforce custom defaults… https://kubernetes.io/docs/reference/access- authn-authz/extensible-admission-controllers/ https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/
- 14. Mutating Admission Webhook in details https://medium.com/ibm-cloud/diving-into- kubernetes-mutatingadmissionwebhook- 6ef3c5695f74
- 15. Webhook Admission Server It is just plain http server that adhere to Kubernetes API. For each request to the apiserver, the MutatingAdmissionWebhook sends an admissionReview(API for reference) to the relevant webhook admission server. Prerequisites: • Kubernetes +1.9 • admissionregistration.k8s.io/v1 API enabled $ kubectl api-versions | grep admissionregistration.k8s.io/v1 NSE injector webhook admissionReview Request /mutate ns.networkservicemesh.io/status == injected ? createPatch json.Marshal(admissionReview) admissionReview Response Yes No
- 20. Overview 1. Generate a certificate signed by Kubernetes CA 2. Deploy NSE injector webhook resources 3. Create a MutatingWebhookConfiguration resource 4. Add nse-sidecar-injection namespace’s label https://github.com/gw-tester/nse-injector-webhook/blob/master/Makefile#L43-L47
- 25. Putting all together $ git clone --depth=1 https://github.com/gw-tester/infra $ cd infra/ $ vagrant ssh nsm -- git clone --depth=1 https://github.com/gw-tester/helm-charts $ vagrant ssh nsm -- "cd helm-charts; ./check.sh"
Editor's Notes
- Network Service Mesh (NSM) es un proyecto de la CNCF que simplifica la conectividad entre cargas de trabajo independientes. Dicha conectividad es solo creada entre aquellas cargas de trabajo que lo necesiten, lo cual ofrece un modelo mas flexible en el desarrollo de Cloud-Native Network Functions (CNFs). Durante esta platica se mencionara algunas de las limitantes enfrentadas por desarrolladores de CNFs y se ofrecerá la creación de un Kubernetes Mutating Admission Webhook como componente necesario para la portabilidad requerida por CNFs que utilizan NSM.
- Define it once use it anywhere - Portability
- Take aways Webhook Admission Development is easy