Senior LevelDocker & Deployment
How do Mutating and Validating Admission Webhooks intercept and transform API server objects?
❓ Interview Prompt: Explain the Kubernetes admission control pipeline, mutating vs validating webhooks, webhook server implementation, and common use cases.
Admission Controllers intercept every API server request (create, update, delete) after authentication/authorization but before the object is persisted to etcd. There are two types:
Admission Pipeline:
kubectl apply → Authentication → Authorization → Mutating Webhooks → Schema Validation → Validating Webhooks → etcd
Mutating Admission Webhooks:
•
Modify the incoming API object before it's saved.
•
Called first — can change any field of the resource.
•
Common uses:
•
Inject sidecar containers (Istio Envoy proxy, Linkerd, logging agents).
•
Set default resource limits/requests on pods missing them.
•
Add labels/annotations automatically.
•
Rotate/inject secrets from Vault.
Validating Admission Webhooks:
•
Accept or reject the object without modifying it.
•
Called after mutating webhooks.
•
Common uses:
•
Enforce organizational policies (no latest image tags, required labels).
•
OPA Gatekeeper/Kyverno policy enforcement.
•
Validate custom resource schemas beyond JSON Schema.
Webhook Server Requirements:
•
Must serve HTTPS with a TLS certificate trusted by the API server.
•
Must respond within a configurable timeout (default 10s).
•
Can be deployed in-cluster (Service) or externally.
Code Implementation Example
typescript
// Express.js Mutating Admission Webhook — inject default resource limits
import express from 'express';
import https from 'https';
import fs from 'fs';
const app = express();
app.use(express.json());
app.post('/mutate-pods', (req, res) => {
const admissionReview = req.body;
const pod = admissionReview.request.object;
// Build JSONPatch operations to inject resource limits
const patches = [];
pod.spec.containers.forEach((container: any, i: number) => {
if (!container.resources?.limits) {
patches.push(
{ op: 'add', path: `/spec/containers/${i}/resources`, value: {} },
{
op: 'add',
path: `/spec/containers/${i}/resources/limits`,
value: { memory: '512Mi', cpu: '500m' } // default limits
}
);
}
});
const patchBase64 = Buffer.from(JSON.stringify(patches)).toString('base64');
res.json({
apiVersion: 'admission.k8s.io/v1',
kind: 'AdmissionReview',
response: {
uid: admissionReview.request.uid,
allowed: true,
patch: patchBase64,
patchType: 'JSONPatch'
}
});
});
https.createServer({
key: fs.readFileSync('/tls/tls.key'),
cert: fs.readFileSync('/tls/tls.crt')
}, app).listen(8443);💡Mutating webhook injects default resource limits/requests for containers missing them — patches pod spec via JSONPatch.
🎯 Interview Key Takeaway
Mutating webhooks modify objects (sidecar injection, default limits); Validating webhooks reject non-compliant objects. Both intercept all API operations before etcd persistence.
#Kubernetes#Admission Webhooks#Mutating#Validating#Policy Enforcement#Senior
Back to all Docker & Deployment Questions→