Has anyone tried this admission controller with success?

[filmil]

trafficstars

The issue I'm having with it is that it installs the admission controller service with a fixed clusterIP: 10.0.0.231. In the webhook code, the address resolver will resolve the webhook to https://10.0.0.231:443. But, this IP address is not accessible to the API server, so I don't see a request to this URL succeeding. How is this supposed to work?

[caesarxuchao]

I'll update the example this week. The problem you saw is due to a recent change in the upstream: https://github.com/kubernetes/kubernetes/pull/50476.

[caesarxuchao]

Try again? You need to use it with the latest Kubernetes release (v1.8.0 or v1.9.0-alpha.1)

[patrickshan]

Just tested with this example and it works with Kubernetes v1.8.0 after some small changes for the ExternalAdmissionHookConfiguration config which I put it into a PR. My test also disabled client cert verification as described in README.

[caesarxuchao]

Merged the PR. Thanks.

[patrickshan]

@caesarxuchao will apiserver send the whole pod object to webhook admission controller in this example ? I am trying to parse some data inside pod.Annotations which seems to be always empty. I suspected it was sent through by different operation. But it behaves the same even if I turned on all operations "*" related with pods resource. Is this something expected ?

[caesarxuchao]

What annotations specifically? I have some hypothesis but need to know the specific fields.

[patrickshan]

It's just a self-defined pod annotation included inside deployment, like this one:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  namespace: kube-system
  name: toolbox
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: debian-test
      annotations:
        kitt.com/department: "INF"
    spec:
      containers:
      - name: debian-test
        image: debian
        command:
          - sleep
          - infinity

In theory it should creat a pod with kitt.com/department: INF annotation like this:

$ kubectl get pod toolbox-594df444bc-dhwkg -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    kitt.com/department: INF

[caesarxuchao]

It's caused by the mismatching object version: the apiserver encodes the pod as api.Pod, and the webhook decodes the pod as v1.Pod. The issue will be fixed by the beta version webhook, the apiserver will encode v1.pod. See https://github.com/kubernetes/kubernetes/issues/49733

For workaround, you can get the annotations by parsing the ar.Spec.Object.Raw directly, the metadata is lost later during the decoding.

[patrickshan]

Thanks @caesarxuchao for looking into this. I'll try the workaround for now.