Dynamic Admission Webhooks Overview
Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission Webhook and mutating admission webhook. With validating admission Webhooks, you may reject requests to enforce custom admission policies. With mutating admission Webhooks, you may change requests to enforce custom defaults.
ValidatingAdmissionWebhooks for validating Istio
MutatingAdmissionWebhooks for automatically
injecting the sidecar proxy into user pods.
The webhook setup guides assuming general familiarity with Kubernetes Dynamic Admission Webhooks. Consult the Kubernetes API references for detailed documentation of the mutating and validating webhook configuration.
Verify dynamic admission webhook prerequisites
See the quick start prerequisites for Kubernetes provider specific setup instructions. Webhooks will not function properly if the cluster is misconfigured. You can follow these steps once the cluster has been configured and dynamic webhooks and dependent features are not functioning properly.
Verify you’re using the latest version of
kubectl(>= 1.10) and that the Kubernetes server version is >= 1.9.
$ kubectl version --short Client Version: v1.10.2 Server Version: v1.10.4-gke.0
admissionregistration.kubernetes.io/v1beta1should be enabled
$ kubectl api-versions |grep admissionregistration.Kubernetes.io/v1beta1 admissionregistration.Kubernetes.io/v1beta1
ValidatingAdmissionWebhookplugins are listed in the
kube-apiserver --enable-admission-plugins. Access to this flag is provider specific.
Verify the Kubernetes api-server has network connectivity to the webhook pod. e.g. incorrect
http_proxysettings can interfere api-server operation (see related issues here and here for more information).