►
Description
Join Cora Iberkleid and Paul Czarkowski in creating a ValidatingAdmissionWebhook controller to understand the basics of using Kubernetes webhooks and custom admission controllers to improve governance over the resources in your cluster.
Admission controllers act as gatekeepers that intercept requests to the Kubernetes API. They can accept, reject, or change a request, thereby ensuring that resources meet any criteria you need to enforce. Want to make sure containers have the right resource limits? The LimitRanger admission controller is your friend. Need to inject config into pods? Look no further than the PodPreset admission controller. Want to do something entirely customized? The MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers are here for you. We'll play with this last one in the next session of TGI Kubernetes.
- 00:00:00 - Welcome to TGIK!
- 00:04:27 - Week in Review
- 00:19:50 - What are Admission Controllers?
- 00:30:57 - Validating Admission Controller webhook
- 01:14:29 - Mutating Admission Controller webhook
Episode GitHub URL: https://github.com/vmware-tanzu/tgik/tree/master/episodes/131
B
B
B
A
A
A
A
Rex
roof
is
from
ann
arbor
michigan,
that's
a
that's
a
long
way
we
got
mathias
from
stuttgard
yogi
from
singapore.
Oh
we're
all
over
the
place.
What's
I
wonder
what
the
time
is
in
singapore,
it
should
be
like
really
early
morning
or
yeah
rex.
My
microphone
is
playing
up.
We
tried
to
fix
it
and
we
didn't
have
good
luck.
So
when
I'm
not
talking
I'll
mute
and
so
at
least
cora
is
pretty
clean.
B
A
It's
actually
a
bit
weird
because
cora
hears
me:
okay,
so
there's
something
between
my
microphone
and
obs.
That
is
happening.
That's
different
between
my
microphone
and
where
cora
is
so
technology
right
and
we
have
elon
musk.
I
don't
think
that's
the
real
elon
musk
he's
from
pune
india.
I
learned
recently
that
elon
musk
is
actually
short
for
elongated
muskrat.
It's
actually
his.
B
A
B
A
A
A
I
hope
you've
all
seen
this
background.
I
have
up,
which
is
probably
one
of
the
best
zoom
backgrounds,
slash
memes,
I've
seen
in
a
long
time,
so
I
thought
I
would
add
that
up
as
my
background
as
it's
kind
of
fitting,
so
I
guess
that's
we've
done
some
hellos
and
some
welcomes
steve
says:
I'm
hilarious,
I'm
not
sure.
If
that
is
entirely
accurate,
but
I'll
take
it.
I
will
definitely
take
it.
A
A
A
Yeah,
as
tasha
just
said,
we
need
him
all
right,
so
I
guess
we
should
probably
share
up
our
our
notes,
and
so
let
me
hit
some
buttons
and
make
sure
I
do
this
right.
So
hopefully
there
it
is
so
the
people
on
the
stream
should
see
my
notes
and
cora
won't.
So
I
need
to
double
share
things
because
that's
how.
A
B
B
A
A
A
A
A
B
B
A
B
B
B
B
So
an
update
on
the
sitting
on
the
steering
committee
election
timeline.
The
final
candidate
list
is
available
formalized
and
closed
on
september,
8th,
so
a
few
resources,
if
you
have
any
questions
election
officers
just
go
around,
are
josh
burkus
and
e
hort
for
etsky.
I
hope
I
am
saying
that
right.
A
Yeah,
do
you
wanna,
try
it?
I
think
we're
good.
Now.
I've
just
changed
a
few
settings
added
some
noise
suppression
to
my
gate,
to
my
obs
settings.
So
hopefully
we're
better
now
and
I
switched
microphones,
I'm
still
staticking.
Why,
but
a
little
bit
better
all
right!
Well,
I'm
sorry,
folks,
we'll
have
to
live
with
the
live
with
the
microphones.
We
have.
A
So
I
was
gonna
quickly
mention
something
I
saw
on
the
the
warnings
so
I'll
pop
back
to
that
for
a
second
I'll
kind
of
make
it
bigger,
make
it
a
little
bit
bigger.
So
one
thing
I
thought
was
interesting:
was
we
they
added
a
feature
so
that
sends
the
warnings
to
the
api
clients,
but
it
does
it
using
the
standard
like
http
header,
for
warnings,
and
so
it's
not
actually
part
of
the
api
payload,
which
means
that
it's
much
easier
well.
A
A
So
I
think
that's
pretty
cool,
and
then
I
saw
with
the
the
crds
there's
now
an
option.
Where
was
it
to
provide
a
deprecation
message
here?
We
go
yeah,
so
deprecation
warning
here,
so
deprecate
a
true
deprecation
warning
and
that
warning
will
make
its
way
back
through
the
hp
headers
from
the
kubernetes
api
itself
and
goog
cuddle
or
whatever
kubernetes
client
you're
using
should
be
able
to
see
those
and
interpret
them
appropriately.
A
B
A
A
One
one
thing
that
I
always
get
tripped
up
on
is
this
search
bar
up
here
is
for
searching
all
of
youtube,
not
searching
the
playlist
or
the
channel
you're
in,
and
I
don't
know
how
to
actually
search
the
play.
Oh
no,
I
don't
want
to
do
that.
I
guess
you
can
always
just
do
a
like
a
word
search
for
helm
or
whatever
and
find
the
stuff
you're
interested
in.
So
I've
always
found
that
a
little
bit
frustrating
in
youtube,
but
we've
got
the
videos
up,
which
is
cool.
A
Yeah
tiffany,
it's
not
actually
skype.
That's
the
problem,
it's
something
to
do
with
obs.
Unfortunately,
so
we
just
have
to
live
with
it.
Unfortunately,
where
were
we
jet
stack?
I
thought
this
was
really
interesting.
So
a
live
cni
migration
so
ripping
out
the
network
from
underneath
the
kubernetes
cluster
and
jamming
a
new
one
in
in
this
case
they
went
from
canal
to
celium
and
so
they're,
not
even
similar
right
like
if
you
went
from
you
know,
flannel
to
calico.
A
A
Hopefully
we
don't
kicked
off
the
air
for
saying
openstack,
but
I
remember
at
blue
box,
we
had
to
write
a
live
upgrade
to
go
from
nova
network
to
neutron
network,
and
that
was
like
a
ridiculously
painful
thing
to
do,
and
so
I
would
imagine
it's
just
as
painful
in
kubernetes,
but
it's
cool
that
they've
written
it
up.
So,
if
you're
interested
in
how
this
works,
I
would
go
and
have
a
look
and
what
else
have
we
got?
That's
happening:
oh
yeah,
the
kubernetes
storage
performance.
A
A
A
Service,
I
think
so
that's
cool
that
you
can
tie
it
into
whatever
cloud
provider
you're
using
and
use
a
different
storage
provider
and
he
has
a
bunch
of
stuff.
I
think
he
has
some
results
here.
We
go.
Here's
our
random
read,
write
bandwidth,
so
you
get
to
see.
Look
at
the
look
at
the
port
works
compared
to
everything
else
on
the
random
read:
that's
orders
of
magnitude
faster
than
south.
A
B
A
A
A
What
do
they
support?
That's
good?
They
support
tls,
always
good
to
see
tls
in
things,
especially
for
things
like
backups
scheduled
backups.
I
mean
there's
a
lot
of
features
bolded
there.
So
that
looks
super
useful.
So
if
you
are
running
lots
of
databases
in
your
kubernetes
operators
like
this
are
super
useful
and
then
the
other
thing
that
I
saw
is
this.
A
A
A
Do
ports
in
your
containers,
affinities,
pod
security
context,
so
all
the
things
you
can
and
should
be
doing
so
we
want
bob
to
run
it,
and
so
there
we
go
service
account
name
bob
pops
up
down
here.
So
this
is
actually
really
cool.
I
haven't
seen
anyone
do
something
like
this
before
and
so
that's
definitely
going
to
become
a
bookmark
for
me,
because
this
is
a
kind
of
really
useful
thing
that
I
would
find
myself
using
a
lot.
A
I'm
gonna
do
that,
so
that
is
really
cool
and
I
think
the
last
of
our
we
can
review.
So
we
should
now
start
talking
about
our.
What
are
we
talking
about
admission
controller
web
hooks,
validating
admission
controller
web
hooks
and
if
we,
if
all
goes
well,
we
might
even
look
at
a
mutating
admission
controller
web
hook.
So
I'm
going
to
mute
myself
for
a
while
chorus
and
people
get
a
break
from
my
noise
and
if
you
want
to
take
it
away.
B
All
right
thanks
paul
thanks
for
going
through
all
that
weekend
review
thanks,
george,
for
putting
all
that
together,
so
yeah.
So
here
in
the
notes,
we
thought
to
do
an
admission
controller,
specifically
starting
with
a
validating
admission
controller.
But
as
paul
mentioned,
there
are
also
mutating
emission
controllers,
so,
but
just
to
start
at
the
beginning.
What
are
admission
controllers?
B
So
I
think
this
picture
is
really
helpful.
This
is
just
in
the
in
the
kubernetes
documentation,
as
you
can
see,
but
an
api
request
comes
in
to
kubernetes
and,
of
course
it's
authenticated
as
usual,
as
any
api
request
would
be,
and
after
that,
there's
a
couple
of
opportunities
to
intercept
that
request
before
it
gets
persisted
into
scd
and
hence
trigger
some
action
in
the
background.
B
So
there's
an
opportunity
to
to
look
at
it
and
say,
for
example,
if
it's
a
deployment
coming
in,
do
I
want
to
change
anything
about
this
deployment
based
on
any
condition,
for
example,
if
it's
this
image
then
always
set,
you
know
the
replicas
to
this
or
make
sure
that
there's
certain
labels
etc
and
then
a
validating
one
can
also
just
maybe
just
look
at
it
and
accept
it
or
reject
it.
So
you
can
change
it,
accept
it
or
reject
it.
B
Basically,
and
so
that's
there
are
actually
admission
controllers
that
are
that
are
built
in
that
are
available.
Things
like
limit
rangers
to
set
resource
limits,
but
what's
interesting
about
the
mutating
and
the
validating
admission
controllers
is
that
they
really
give
you
this
way
to
hook
in
and
do
anything
custom
that
you
want
to
do
so
very
powerful
and
very
flexible
and
in
fact,
as
I
was
looking
into
this
a
little
bit,
there's
a
talk.
I
I
can
look.
B
Ensuring
certain
policies
that
you
need
to
enforce
are
done.
So,
regardless
of
you
know,
taking
the
burden
away
from
developers
to
ensure
that
you're
enforcing
policies
at
the
at
the
at
the
entry
point
of
your
cluster
governance,
of
course,
managing
configuration
managing,
maybe
resource
utilization
and
things
like
that.
B
The
request
can
can
take
action
at
the
point
that
it
notices
that
you
want
to,
for
example,
declare
that
when
like,
for
example,
if
you
only
want
to
react
to
when
like
deployments,
are
done
or
only
want
to
react
to
like
when
certain
types
of
resources
are
created,
then
you
would
trigger
a
web
hook
and
then
that
would
call
execute
a
code
that
you
have
deployed
inside
some
pod
and
then
inside
that
pod.
You
can
really
do
whatever
you
want.
A
A
B
A
That's
what
I'm
here
for
that's
what
we're
here
for
all
right.
So
I
think
that's
all
I
wanted
to
mention
just
a
weird
chicken
and
egg
issue.
I
saw
and
of
course
the
other
thing
with
that
chicken
and
egg
issue
is:
if
you
set
this
up
with
a
bad
ca,
then,
and
your
admission
controller
web
hook
is
looking
at
pods
or
deployments.
A
A
B
So
then,
the
other
thing
to
mention
is
that
you
have
to
actually
enable
admission
these
admission
plugins
when
you
start
up
your
cluster,
so
you
need
to
make
sure
that's
part
of
your
configuration
for
your
cluster,
so
we'll
get
to
that.
I
guess
so.
Let's
start
with
this,
so
we're
going
to
follow
this
blog
post
from
eric
shanks.
So,
first
of
all,
huge
thanks
to
eric
shanks
for
putting
this
together
and
essentially
so.
B
B
There's
let
me
actually
go
down
to
what
this
particular
example
is
doing.
I
think
the
use
case
here
is
just
to
make
sure
that
there
is
a
billing
label
that
exists
and
if
the
billing
label,
if
the
deployment
that's
being
the
pod
that's
been
created,
doesn't
have
a
billing
label,
then
it
would
just
be
rejected.
If
it
does,
then
it
would
be
accepted,
so
I'm
gonna
actually
just
get
the
code
and
we'll
start
from
there.
A
A
You
probably
could
use
the
like
the
ca
root
in
kubernetes
to
sign
the
web
hooks,
but
you
don't
always
necessarily
have
access
to
that
ca.
To
do
so,
I
think
kubernetes
does
have
some
certificate
resources,
but
I've
never
had
a
ton
of
luck
using
them,
which
is
why
I
usually
reach
for
cert
manager,
cert
manager,
lets
you
create
a
a
ca
and
then
create
certificates.
Of
that
you
create
a
issuer,
a
self-signed
issuer.
A
B
B
I
didn't
clone
that
instead,
I
know
that
paul
has
a
clone
because,
as
he
was
saying
so
the
map,
so
the
master
branch
here
is
going
to
have.
I
don't
think
you
made
any
changes
right
yeah
four
months
ago,
okay,
so
the
master
branch
has
eric's
original
code
and
then
paul
created
a
tgik
branch
in
which
he
does
the
work
that
he
mentioned
for
the
certs
and
also
we've
included
here,
the
this
yaml
file,
which
I'll
just
actually
copy
from
here
to
create
a
kind
cluster.
B
And
so
you
can
see
that
this
cluster
has
already
the
enable
admission
plugins,
including
the
validating
admission
web
hook
and
the
mutating
admission
webhook.
So,
for
example,
like
the
first
time
I
tried
to
do
this,
I
did
it.
I
was
doing
on
a
like
a
default
kubernetes,
a
default
google
cluster
which
doesn't
have
these
things
enabled,
and
so
I
ran
into
an
error
there
and
it
was
just
a
little
easier
to
use
kind.
B
B
B
All
right
and
so
right
now
we're
in
the
so
we're
within
the
default
directory
using
starts
in
a
more
straightforward
way,
and
then
we
can
switch
over
to
paul's
modifications
and
try
that.
But
essentially,
if
you're
going
to
build
your
own
admission
controller,
you
can't
you
first
create
your
custom
logic.
B
B
A
And
load
up
objects
from
those
trucks
you
can
just
kind
of
like
yolo,
a
bunch
of
like
hdp
requests
and
just
like
look
at
the
object,
you
get
back
and
traverse
it
as
an
object,
and
so
I
think,
from
like
operations.
Point
of
view
like
this
is
that's.
This
is
more
where
our
comfort
levels
are
like.
I
get
lost
in,
go
pretty
easy,
trying
to
deal
with
the
typing.
Obviously,
there's
a
lot
of
safety
that
comes
with
that
typing,
but
often
for
like
really
simple
stuff.
A
Like
this
I
mean
this
is
27
lines
of
code.
So
that's
that's
pretty
impressive.
For
for
what
it
does,
I
mean
obviously
there's
some
http
libraries
and
stuff
in
the
backend
or
whatever,
but
I
I
just
wanted
to
say,
I
think
the
idea
of
using
python
this
stuff
is
really
appealing
to
people
like
myself
that
are
maybe
not
traditionally
or
consider
themselves
to
be
programmers.
B
A
A
But
sometimes
opa
itself
is
a
larger
pill
to
swallow,
and
people
don't
want
to
necessarily
take
it
on
right
away
and
they
may
have
some
much
simpler
use
cases
that
to
be
solved,
and
so
I
think,
and
also
the
re.
The
regio
language
is
like
completely
melts
my
brain.
So
I've
always
struggled
doing
the
regio
language
stuff
to
drive
the
opa
stuff.
B
Yeah
I
mean,
I
think
one
of
the
great
things
about
this
particular
example
is
just
how
simple
it
is.
It's
a
it's
really
really
cause.
I
guess
you
can
also
use
I'm
qbuilder
to
kind
of
get.
You
part
way
there
right
and
give
you
the
scaffolding
and
then
fill
in
the
code.
So
there's
a
couple
of
ways
to
go
about
it,
but
this
is
yeah.
This
is
incredibly
simple,
so
there's
our
code.
So
basically,
when
that,
when
the
container
starts
up,
the
container
is
going
to
run
this
code
right.
This
is
our.
B
B
A
Like
the
workflow
of
so
you
can
see
it
receives
a
request
and
then
it
then
gives
a
response
right.
So
it's
getting
a
request.
It's
checking
for
the
label
and
giving
that
kate's
response,
and
that
kate's
response
is
just
that
jsonified
like
admission
review
response,
so
it's
getting
an
admission
review
request
and
then
it's
responding
with
that
admission,
review
response,
and
so
that's
certainly
another
thing
I
stumbled
across.
I
I
stumbled
with
a
bit
when
I
was
writing.
A
A
mutating
web
hook
is
keeping
in
in
my
head
the
difference
between
the
like
the
response
and
the
request
and
sending
the
right
one
receiving
the
right
one,
but
once
you
figure
it
out
it's,
it
is
fairly
simple,
but
certainly
looking
at
the
python
version
of
it.
I'm
like
blown
away
as
I
was
just
mentioning
how
much
simpler
it
is
and
easier.
It
is
to
understand.
B
Cool
okay,
so
then,
so
so
so
we
have
a
dockerfile
in
order
to
containerize
that
which
really
is
just
going
to
copy
all
of
the
files
in
this
directory
into
the
container,
which
was
when
we
create
the
search
we'll
realize
that
the
search
are
actually
created
in
a
I
guess.
We
have
to
we'll
create
a
search
directory
so
that
it
matches
up
with
with
this
expected
path,
and
then
it
just
sets
the
command
to
start
up
the
the
python
application.
B
A
A
So
if,
if
I
remember
that
correctly,
that's
because
like
we
used
to
use,
add
and
add
sort
of
would
always
negate
the
cache,
whereas
if
I'm
right
copy
actually
looks
to
see
if
the
file
changed
and
if
it
doesn't,
it
doesn't
negate
negate
the
cache.
And
that
means
that
until
you
get
to
that
final
copy
of
the
entire
app,
everything
above
will
be
cached
unless
you
change
your
requirements
right.
A
So
I
think
that's
a
good
reminder
for
people
when
they're
building
their
docker
files
is
always
try
and
be
cognizant
of
your
order
of
operations,
even
if
it
looks
a
bit
weird
because,
like
every
time
I
see
copying
the
requirements
and
then
copying
the
entire
direction.
My
brain
like
immediately
goes.
Oh,
we
can
optimize
this.
We
don't
need
to
copy
twice,
but
the
reality
is
it's
actually
optimizing
for
the
cache
not
for
kind
of
copying
a
file
up
twice
and
and.
B
This
is
going
to
be
our
yaml
file
to
deploy
this
container,
and
so
you
can
see
first
of
all,
it
creates
a
namespace
called
validation
and
then
it
deploys
just
the
pod
called
warden
that's
going
to
have.
I
will
have
to
edit
this
to
my
account
and
and
then
it
creates
a
corresponding
service
for
that.
So
I
think
that's
pretty
straightforward
and
then
so
the
last
now
so
after
we
would
we're
going
to
take
this
code,
build
it
as
an
image.
B
It'll
get
uploaded,
we'll
push
it
to
docker
hub
and
then
we'll
deploy
it
using
this
yaml
file.
And
so
then
we've
got
this
pause
sitting
out
there,
and
so
now
the
last
piece
is
to
deploy
the
web
hook
such
that
that
pod
is
actually
handed
the
request
so
that
it
can
evaluate
them.
Whenever
somebody
tries
to
deploy
a
pod,
and
so
that's
what
the
web
hook
is
for,
and
I
think
there
was
a
question
in
the
chat:
are
the
web
hooks.
B
Yeah
so
I
mean
the
well
if
I
wasn't
sure
what
the
the
question
was.
Is
the
web
hook
a
type
of
resource
or
for
specific
types
of
resources,
but
the
there's
a
there
is
a
type
of
resource
called
validating,
webhook
configuration
or
mutating
webhook
configuration
and
then
there's
also
rules
that
determine
for
what?
What?
For
what
other
types
of
resources
this
web
hook
is
triggered.
A
A
You
know
for
crds,
it's
kind
of
the
same
thing
they
just
have
like
your
api
group
will
be
whatever
your
crd
is,
and
then
your
resources
will
be
the
actual
crd
resources,
so
kubernetes
doesn't
necessarily
care
if
it's
a
kubernetes
originated
resource
or
a
crd
resource,
because
it
still
ends
up.
As
you
know,
an
api
group
plus
resource.
B
Cool
all
right
so
and
then,
when
the
web
hook
is
triggered,
what
it's
going
to
do
is
call
our
pod,
which
we
know
we've
named
word
in
and
it's
in
the
validation
namespace
and
it
as
we
saw
in
the
code.
The
path
is
slash
validate,
so
this
is
exactly
how
it's
going
to
call
and
then
we're
going
to
fill
in
this
value
in
a
second,
so
go
back
to
the
readme
and
kind
of
just
keep
track
of
where
we
are
so
we're
gonna.
B
So
this
so
it
says,
create
your
custom
logic,
so
that's
been
done
for
us
in
the
word
in
dot
python
there's.
So
that's
the
example
that
we
have
that's
gonna.
Look
to
see
if
the
pod
has
a
billing
label
on
it,
so
step
two
would
be
to
update
our
search
end.sh
to
match
our
admission
controller.
You
may
need
to
update
the
service
and
namespace
where
the
controller
lives.
B
B
I
tend
to
source
everything.
Okay,
so
that's
done
so
now.
We've
got
our
search
directory,
and
so
the
next
thing
we'd
want
to
do
is,
I
think,
run
the
docker
file
right.
I
think
we
can
do
that
next,
but
let's
go
back
to
the
readme
so
we're
following
it
in
order
so
run
the
search
end
script.
So
now
we've
got
our
certificates
and
we
want
okay.
So
let's
get
the
base64
value
of
this
first.
A
B
B
A
B
B
B
Work
for
it
for
validating
ones
right
because,
like
I
guess
I
mean
ideally,
you
would
probably
want
if
you
want
to
have
multiple
web
hooks.
You'd
put
them
here
in
order
right,
because
if
you
have
mutating
web
hooks
like
if
you're
gonna,
if
they,
if
they
would
go
off
in
parallel,
if
it
was
possible
to
have
multiple
mutating
ones
and
they
would
go
off
in
parallel,
then
you
would
have
multiple
mutations
of
your
resource,
which
wouldn't
really.
B
A
A
B
B
A
B
B
B
Yeah
I
tried
this
so
first
I
was
trying
this
on
gke
and
I
ran
into
the
error
where
I
realized
that
you
did
have
to
set
the
admission
controllers
and
paul,
and
I
were
chatting
about
it.
So
I
mean
I
I
didn't.
I
actually
didn't
try
it.
I
just
switched.
I
switched
to
a
different
kind
of
cluster,
but
I
guess
you
can
probably
go
into
gke
and
set
that.
But
but
since
it's
a
managed
cluster,
I
saw
some
stuff
on
google.
That
said,
I
just
just
on
the
internet.
B
A
B
Okay,
so
we've
got
our
container
up
on
docker
hub
and
we've
got
our
cluster
running,
so
we
can
go
ahead
and
do
the
next
step,
which
is
to
apply
the
warding
ktml
file
to
deploy
the
actual
pod.
So
let's
do
okay,
apply
minus
f,
yeah.
First,
let's
do,
let's
just
make
sure
and
we're
on
the
right
cluster.
Okay,
so
we're
on
the
kind
tgik
cluster
which
is
good,
and
so
now
we
can
do
okay
apply
with
our
warden
file.
B
B
B
B
A
A
B
B
B
A
B
B
A
B
B
B
B
B
A
B
Okay,
yeah
so
yeah
actually
yeah.
This
is
I
had.
I
got
this
error
at
some
point
because
I
wasn't
I
you
know
when
I
was
working
on
this.
I
wasn't
initially
when
I
was
trying
to
figure
out
the
errors
on
google
and
then
on
mini
cube.
I
wasn't
at
one
point
properly
cleaning
everything
up
and
I
did
run
across
this
air,
but
I
didn't
immediately
realize
it
was
because
the
pod
wasn't
there
but
yeah
it's
trying
to
send
basically
the
request
to
now.
What
would
be
interesting
also.
B
B
B
A
B
B
Okay,
so
let's
give
that
a
shot,
oh
cool,
all
right!
So,
okay,
so
we're
missing
the
pod.
So
when
the
when
the
failure
policy
is
fail,
we
get
this
error
here.
That
says
I
tried
calling
the
pod,
but
the
pod
wasn't
there
and
then,
when
the
ignore
policy,
when
the
failure
policy
is
ignore,
it
doesn't
care
that
the
pod
wasn't
there
nice,
that's
pretty
cool
okay.
So
now.
B
B
B
A
B
B
B
A
So
you
can
see
I
added
the
I
added
two
files
from
a
secret
as
volumes
and
so
cert
manager
creates
the
file
names
tls
tls
key.
So
I
have
to
make
sure
they're
named
correctly
for
warden,
so
I
don't
have
to
mess
with
the
warden
source,
and
so
the
easiest
way
to
do.
That
was
to
name
them
out
like
this,
and
so
that
will
ensure
if
I
have
a
secret
called
warden
server.
Tls
it'll
get
mounted
into
the
pod
and
then,
if
you
click
on
the
certs.yaml,
we'll
see
how
we're
calling
the
certs.
A
So
we
start
with
creating
a
self-signed
issuer
and
we
use
that
self
sign.
You
can
see
the
spec
is
self
signed.
We
use
that
spec
to
create
a
validation,
ca.
You
can
see.
I've
got
is
ca
set
to
true,
and
then
we
create
a
second
issuer
that
uses
the
ca
from
the
secret
that
that
seek
that
that
certificate
creates
right.
A
So
now
we
have
an
issuer,
that's
going
to
use
our
own
ca
and
then
finally,
we
have
a
certificate
that
we're
going
to
use
for
warden,
which
is,
is
ca
false,
but
it
has
the
the
three
expected
dns
names.
So
if
whether
you
call
it
directly
with
just
warden
the
full
and
I
think
from
a
performance
issue,
I
think
like
in
the
web
hook,
you're
always
better
off
using
the
full
dns
and
that
way
it
doesn't
have
to
iterate
through
a
bunch
of
failures
in
the
like
the
dns
search
suffix.
A
B
A
B
B
B
B
Okay,
okay,
yeah.
Yes,
you
change
ca
bundle
for
the
environment,
variable
cool
and
then
the
rest
is
the
same
yeah
and
then
the
handy
like
clean
up
so
remember
not
only
to
delete
the
stuff
in
the
names
in
the
validation
namespace,
which
is
where
you
delete,
where
you
deployed
your
your
actual
validation
mission
controller,
but
also
the
web
hook,
which
is
in
a
different
name.
Space.
A
B
A
A
B
A
B
A
Could
you
do
it
through,
like
jq
or
white
yq
or,
like
any
even
said
you
could
do
if
you
really
wanted
to
so
I
thought
it
was
kind
of
interesting
just
to
play
with
that
concept
of
what,
if
I
want
to
really
dumb
it
down
and
take
the
logic
out
of
the
controller.
So
if
you
go
to,
I
guess
under
package,
because
this
is
kind
of
where
you
know
it
was
sort
of
written
more
like
a
traditional
go
language.
A
So
there's
like
a
cli
directory,
a
command
directory
for
the
apple
cli
and
then
a
webhook
directory
under
package.
You
can
see
we
kind
of
have
admission
response,
so
you
can
see
that's
just
gonna
of
do
what
we
did
on
the
other
one,
just
with
a
lot
more
code,
the
process
body.
I
guess
I
think
is
where
we're
maybe
running
it
through
ytt,
it's
been
a
while,
since
I
wrote
this,
so
I
can't
fully
remember
no
that
looks
like
we're
just.
A
B
A
That's
right,
yeah,
and
so
you
could
have
a
webhook
controller
that
does
both
validation
and
mutate
and
just
handle
both
endpoints,
and
you
can
see.
I
also
added
a
health
there,
so
I
could
use
a
readiness
probe
right,
yeah
and
then
so,
if
you
click
on
the
command
up
in
the
directory
structure,
so
I
used.
B
A
Which
is
kind
of
the
go-to
cli
tooling,
for
yes
serve,
is
the
right
spot.
So
if
you
run
this
with
serve,
you
then
get
a
bunch
of
command
line
arguments
you
can
fill
in
which,
if
you
scroll
further
down
you'll,
see
here's
the
flags
you
can
pass
in
so
insert
key
port
command
and
args.
Oh,
so
my
my
default
is
just
gonna
cut
it
and
then,
if
you,
if
you
then
look
at
maybe
we
look
at
my
example-
deployment
we'll
see
where
I'm
calling
the
arguments
so
you
go
through
deploy.
A
B
A
A
B
A
So
it's
templated
out,
but
if
you
look
down
for
the
the
command,
the
container
here's
my
command,
you
can
see.
My
args
are
passing
in
the
cert
key,
the
command,
ytt
and
then
pointing
at
a
directory
called
app
mutate
and
that
app
mutate
is
coming
from
a
config
map.
And
so,
if
you
click
on
the
config
map,.
B
B
B
B
A
A
B
B
B
B
B
A
A
B
B
A
A
A
A
B
B
B
A
B
A
Yeah,
so
if
you
look
at
the
nun
on
dry
run,
calling
the
web
hook
will
possibly
have
side
effects.
If
a
request
with
dry
run,
true,
was
sent
to
the
web
hook.
The
web
hook
will
suppress
the
side
effects
if
the
web
hook
is
dry,
run
aware
so
clearly,
I
would
need
to
update
the
web
hook
to
support
dealing
with
a
dry
run,
which
I'm
not
sure.
A
B
A
Well,
you
you
kind
of
want
if
you've
got
dry
run,
set
to
serve
you
kind
of
want
to
push
through
the
web
hook
yeah.
So
it
should
go
to
the
api
server.
The
api
server
should
see
that
we
have
a
validating
web
hook.
It
should
send
the
request,
it
should
get
the
response
and
then
it
should
pass
that
response
back
to
coop
cuddle.
Instead
of
acting
on
that
response
is
like
the
way
my
brain
logically
thinks
about
it,
but
clearly
there's
something
in
kubernetes
world
that
doesn't
want
to
be
that
simple
about
it.
A
A
Code,
oh
yeah,
yeah,
you're
right.
The
api
server
should
be
the
one
refusing
to
save
the
ncd,
but
because
we're
using
dry
run
mode,
it's
never
saving
the
ncd
right,
so
dry
run.
Would
server
means
that
the
server
does
all
the
processing,
but
instead
of
saving
it,
it
kicks
it
back
to
the
client,
and
so
it
would
never
have
saved
it
to
ncd
in
the
first
place,
but
I
agree
it
should
be.