K8s Dynamic Admission Controllers in Go: A Production Deep Dive

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "request": {
    "uid": "a834d28e-db1a-428a-b4f0-dec395e59e19",
    "kind": { "group": "apps", "version": "v1", "kind": "Deployment" },
    "resource": { "group": "apps", "version": "v1", "resource": "deployments" },
    "userInfo": {
      "username": "system:serviceaccount:default:my-app",
      "groups": ["system:serviceaccounts", "system:authenticated"]
    },
    "object": {
      "apiVersion": "apps/v1",
      "kind": "Deployment",
      "metadata": { ... },
      "spec": { ... }
    },
    "oldObject": null, // Populated on UPDATE and DELETE
    "operation": "CREATE"
  }
}

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "a834d28e-db1a-428a-b4f0-dec395e59e19", // Must match the request UID
    "allowed": false,
    "status": {
      "code": 403, // Or another appropriate HTTP status code
      "message": "Deployment must include a 'team' label."
    }
  }
}

mkdir label-validator
cd label-validator
go mod init github.com/your-org/label-validator
go get k8s.io/[email protected]
go get k8s.io/[email protected]

package main

import (
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/http"

	admissionv1 "k8s.io/api/admission/v1"
	appsv1 "k8s.io/api/apps/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/serializer"
)

var (
	universalDeserializer = serializer.NewCodecFactory(runtime.NewScheme()).UniversalDeserializer()
)

// admissionResponse is a helper to create an AdmissionResponse.
func admissionResponse(uid types.UID, allowed bool, message string) *admissionv1.AdmissionReview {
	statusCode := int32(200)
	if !allowed {
		statusCode = 403 // Forbidden
	}
	return &admissionv1.AdmissionReview{
		TypeMeta: metav1.TypeMeta{
			APIVersion: "admission.k8s.io/v1",
			Kind:       "AdmissionReview",
		},
		Response: &admissionv1.AdmissionResponse{
			UID:     uid,
			Allowed: allowed,
			Result: &metav1.Status{
				Code:    statusCode,
				Message: message,
			},
		},
	}
}

// validateTeamLabel is the core validation logic.
func validateTeamLabel(ar admissionv1.AdmissionReview) *admissionv1.AdmissionReview {
	// The request object is a raw JSON blob. We need to decode it.
	raw := ar.Request.Object.Raw
	var labels map[string]string
	var kind string

	switch ar.Request.Kind.Kind {
	case "Deployment":
		var deployment appsv1.Deployment
		if _, _, err := universalDeserializer.Decode(raw, nil, &deployment); err != nil {
			return admissionResponse(ar.Request.UID, false, fmt.Sprintf("could not deserialize deployment: %v", err))
		}
		labels = deployment.ObjectMeta.Labels
		kind = "Deployment"
	case "StatefulSet":
		var statefulSet appsv1.StatefulSet
		if _, _, err := universalDeserializer.Decode(raw, nil, &statefulSet); err != nil {
			return admissionResponse(ar.Request.UID, false, fmt.Sprintf("could not deserialize statefulset: %v", err))
		}
		labels = statefulSet.ObjectMeta.Labels
		kind = "StatefulSet"
	default:
		// This should not happen if the ValidatingWebhookConfiguration is configured correctly.
		return admissionResponse(ar.Request.UID, true, "") // Allow other resources
	}

	if labels == nil {
		return admissionResponse(ar.Request.UID, false, fmt.Sprintf("%s is missing labels entirely", kind))
	}

	if _, ok := labels["team"]; !ok {
		return admissionResponse(ar.Request.UID, false, fmt.Sprintf("%s must have a 'team' label", kind))
	}

	return admissionResponse(ar.Request.UID, true, "")
}

// handleValidation is the main HTTP handler.
func handleValidation(w http.ResponseWriter, r *http.Request) {
	body, err := ioutil.ReadAll(r.Body)
	if err != nil {
		w.WriteHeader(http.StatusBadRequest)
		fmt.Fprintf(w, "could not read request body: %v", err)
		return
	}

	var admissionReviewReq admissionv1.AdmissionReview
	if _, _, err := universalDeserializer.Decode(body, nil, &admissionReviewReq); err != nil {
		w.WriteHeader(http.StatusBadRequest)
		fmt.Fprintf(w, "could not deserialize request: %v", err)
		return
	}

	if admissionReviewReq.Request == nil {
		w.WriteHeader(http.StatusBadRequest)
		fmt.Fprintf(w, "malformed admission review: request is nil")
		return
	}

	admissionReviewResp := validateTeamLabel(admissionReviewReq)

	respBytes, err := json.Marshal(admissionReviewResp)
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		fmt.Fprintf(w, "could not marshal response: %v", err)
		return
	}

	w.Header().Set("Content-Type", "application/json")
	w.Write(respBytes)
}

func main() {
	// Note: In a real deployment, you would get the TLS cert and key paths from flags or env vars.
	certPath := "/etc/webhook/certs/tls.crt"
	keyPath := "/etc/webhook/certs/tls.key"

	http.HandleFunc("/validate", handleValidation)
	fmt.Println("Server starting on port 8443...")
	if err := http.ListenAndServeTLS(":8443", certPath, keyPath, nil); err != nil {
		panic(fmt.Sprintf("failed to start server: %v", err))
	}
}

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: self-signed-issuer
spec:
  selfSigned: {}

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: label-validator-cert
  namespace: default # Or your webhook's namespace
spec:
  # The secret name where the certificate will be stored
  secretName: label-validator-tls
  
  # The DNS name must match the Kubernetes Service FQDN
  # <service-name>.<namespace>.svc
  dnsNames:
  - label-validator-svc.default.svc

  # Reference our self-signed issuer
  issuerRef:
    name: self-signed-issuer
    kind: ClusterIssuer

# Build stage
FROM golang:1.20-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o webhook .

# Final stage
FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /app
COPY --from=builder /app/webhook .

# The webhook binary will be run by a non-root user for security
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

CMD ["./webhook"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: label-validator
  labels:
    app: label-validator
spec:
  replicas: 2 # Always run at least 2 for HA
  selector:
    matchLabels:
      app: label-validator
  template:
    metadata:
      labels:
        app: label-validator
    spec:
      containers:
      - name: webhook
        image: your-registry/label-validator:v1.0.0
        ports:
        - containerPort: 8443
          name: webhook-tls
        volumeMounts:
        - name: tls-certs
          mountPath: /etc/webhook/certs
          readOnly: true
      volumes:
      - name: tls-certs
        secret:
          secretName: label-validator-tls # Mount the secret created by cert-manager
---
apiVersion: v1
kind: Service
metadata:
  name: label-validator-svc
spec:
  selector:
    app: label-validator
  ports:
  - port: 443
    targetPort: webhook-tls

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: label-validator-webhook
  annotations:
    # This annotation tells cert-manager to inject the CA bundle from our secret
    cert-manager.io/inject-ca-from: "default/label-validator-cert"
webhooks:
- name: label-validator.your-domain.com
  clientConfig:
    # The caBundle will be populated by cert-manager.
    # caBundle: LS0t....
    service:
      name: label-validator-svc
      namespace: default
      path: "/validate"
      port: 443
  rules:
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    operations: ["CREATE", "UPDATE"]
    resources: ["deployments", "statefulsets"]
    scope: "*"
  # CRITICAL: Failure policy
  failurePolicy: Fail
  # Set sideEffects to None because our webhook has no side effects on other components.
  sideEffects: None
  # The admission review versions the webhook supports.
  admissionReviewVersions: ["v1"]

# In ValidatingWebhookConfiguration
... 
  namespaceSelector:
    matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: NotIn
      values: ["kube-system", "cert-manager"]