gophercon-2021-hands-on-validatingwebhook-demo

demo.sh

# Define cluster name
$ export GKE_DEMO_CLUSTER_NAME=gophercon-turkiye-2021-hands-on

# Creating GKE Cluster
$ gcloud container clusters create $GKE_DEMO_CLUSTER_NAME --num-nodes=2

# Fetch cluster credentials
$ gcloud container clusters get-credentials $GKE_DEMO_CLUSTER_NAME

# Verify if everything is working
$ kubectl get nodes -o wide

# Deploy Cloud Functions
$ gcloud deploy functions Validate --runtime go113 --trigger-http --allow-unauthenticated

# Get URL of the Cloud Functions
$ CLOUD_FUNCTION_URL=$(gcloud functions describe --format=json Validate | jq -r '.httpsTrigger.url')

# Apply ValidatingWebhookConfiguration manifest
$ cat <<EOF | k apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
 name: validatelabel
webhooks:
- name: us-central1-developerguy-311909.cloudfunctions.net
  clientConfig:
    url: $CLOUD_FUNCTION_URL
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations: ["CREATE"]
    scope: Namespaced
  namespaceSelector:
    matchLabels:
      gophercon.turkiye/validation: enabled
  admissionReviewVersions: ["v1"]
  sideEffects: None
  failurePolicy: Fail
EOF

# Apply invalid Pod manifest
$ kubectl apply -f invalid-pod.yaml

# Apply valid Pod Manifest
$ kubectl apply -f valid-pod.yaml