messing with webhooks

webhook-notes.md

example of invoking the api-server from a pod

• kubectl run -n example-node-helm --rm -it api-test --image=ubuntu -- /bin/bash
• wget --debug --header="Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" --ca-certificate=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt -O - https://kubernetes.default.svc/api/v1/namespaces/example-node-helm/pods

references

• https://github.com/newrelic/k8s-webhook-cert-manager
• https://github.com/kelseyhightower/certificate-init-container/blob/master/deployments/tls-app.yaml
• https://github.com/helm/charts/blob/master/stable/cockroachdb/templates/job.init.yaml

other notes

https://github.com/newrelic/k8s-webhook/blob/master/cert/generate_certificate.sh shows how to:

1. extract the cert after the CSR was approved
2. pem encode the cert and store it in a secret
3. get the cluster ca bundle and patch that into the webhook, which is a required attribute of a admission webhook config

Need to look at: https://github.com/helm/charts/blob/master/stable/stash/templates/mutating-webhook-configuration.yaml