准入控制器： Admission Webhook

Admission Webhook： 准入控制器Webhook是准入控制插件的一种，用于拦截所有向APISERVER发送的

请求，并且可以修改请求或拒绝请求。

Admission webhook为开发者提供了非常灵活的插件模式，在kubernetes资源持久化之前，管理员通过程序

可以对指定资源做校验、修改等操作。例如为资源自动打标签、pod设置默认SA，自动注入sidecar容器等。

相关Webhook准入控制器：

• MutatingAdmissionWebhook：修改资源，理论上可以监听并修改任何经过ApiServer处理的请求

• ValidatingAdmissionWebhook：验证资源

• ImagePolicyWebhook：镜像策略，主要验证镜像字段是否满足条件

 

 生成证书文件

root@k8s-master:/etc/kubernetes/image-policy# cat image-policy-certs.sh 
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

cat > webhook-csr.json <<EOF
{
  "CN": "webhook",
  "hosts": [
   "172.21.0.5" 
   ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes webhook-csr.json | cfssljson -bare webhook

cat > apiserver-client-csr.json <<EOF
{
  "CN": "apiserver",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "BeiJing",
      "ST": "BeiJing"
    }
  ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes apiserver-client-csr.json | cfssljson -bare apiserver-client

1、启用准入控制插件
--enable-admission-plugins=NodeRestriction,ImagePolicyWebhook
--admission-control-config-file=/etc/kubernetes/image-policy/admission_configuration.yaml
并使用hostpath数据卷将宿主机/etc/kubernetes/image-policy目录挂载到容器中

2、准备配置文件
# /etc/kubernetes/image-policy/admission_configuration.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: ImagePolicyWebhook
configuration:
imagePolicy:
kubeConfigFile: /etc/kubernetes/image-policy/connect_webhook.yaml # 连接镜像策略服务器配置文件
allowTTL: 50 # 控制批准请求的缓存时间，单位秒
denyTTL: 50 # 控制批准请求的缓存时间，单位秒
retryBackoff: 500 # 控制重试间隔，单位毫秒
defaultAllow: true # 确定webhook后端失效时的行为

2、准备配置文件
apiVersion: v1
kind: Config
clusters:
- cluster:
certificate-authority: /etc/kubernetes/image-policy/webhook.pem # 数字证书，用于验证远程服务
server: https://192.168.31.73:8080/image_policy # 镜像策略服务器地址，必须是https
name: webhook
contexts:
- context:
cluster: webhook
user: apiserver
name: webhook
current-context: webhook 
preferences: {}
users:
- name: apiserver
user:
client-certificate: /etc/kubernetes/image-policy/apiserver-client.pem # webhook准入控制器使用的证书
client-key: /etc/kubernetes/image-policy/apiserver-client-key.pem # 对应私钥证书

3、部署镜像服务器
自己用python开发一个简单的webhook端点服务器，作用是拒绝部署的镜像乜有指定标签（即latest）。
3.1 自签HTTPS证书
3.2 Docker容器启动镜像策略服务
docker run -d -u root --name=image-policy-webhook \ -v $PWD/webhook.pem:/data/www/webhook.pem \ -v $PWD/webhook-key.pem:/data/www/webhook-key.pem \ -e PYTHONUNBUFFERED=1 -p 8080:8080 \
lizhenliang/image-policy-webhook

4、测试
kubectl create deployment web1 --image=nginx:1.16
kubectl create deployment web2 --image=nginx