.jpg?raw=true)
使用k8s插件的webhook功能，部署ValidatingWebhookConfiguration资源对象。
支持白名单与黑名单校验镜像的两种方式(选其一)。
(在yaml/deploy.yaml的环境变量WhITE_OR_BLOCK中设置"white" or "black"。)
-
白名单：只有列表中的镜像前缀同意创建。
-
黑名单：只有列表中的镜像前缀拒绝创建。
注：当部署一个deployment时，只能两者选用其一功能。
使用k8s插件的webhook功能，部署MutatingWebhookConfiguration资源对象。
- 支持替换(replace)pod image模式 或 边车(sidecar)pod image模式
- 预计支持sidecar模式的Pod image功能
- 增加自定义annotation功能
注：当部署一个deployment时，只能三者选用其一功能。
(在yaml/deploy.yaml的环境变量ANNOTATION_OR_IMAGE中设置"image" or "annotation" or "label"。)
-
进入目录
-
编译镜像
docker run --rm -it -v /root/k8sWebhookPractice:/app -w /app -e GOPROXY=https://goproxy.cn -e CGO_ENABLED=0 golang:1.18.7-alpine3.15 go build -o ./webhookPractice .
- 使用cfssl 建立证书 a.下载CA证书软件
# Linux
➜ wget -q --show-progress --https-only --timestamping \
https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 \
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
➜ chmod +x cfssl_linux-amd64 cfssljson_linux-amd64
➜ sudo mv cfssl_linux-amd64 /usr/local/bin/cfssl
➜ sudo mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
b. 创建 CA 证书
➜ cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"server": {
"usages": ["signing", "key encipherment", "server auth", "client auth"],
"expiry": "8760h"
}
}
}
}
EOF
➜ cat > ca-csr.json <<EOF
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF
➜ cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2021/01/23 16:59:51 [INFO] generating a new CA key and certificate from CSR
2021/01/23 16:59:51 [INFO] generate received request
2021/01/23 16:59:51 [INFO] received CSR
2021/01/23 16:59:51 [INFO] generating key: rsa-2048
2021/01/23 16:59:51 [INFO] encoded CSR
2021/01/23 16:59:51 [INFO] signed certificate with serial number 502715407096434913295607470541422244575186494509
➜ ls -la *.pem
-rw------- 1 ych staff 1675 Jan 23 17:05 ca-key.pem
-rw-r--r-- 1 ych staff 1310 Jan 23 17:05 ca.pem
c.
➜ cat > server-csr.json <<EOF
{
"CN": "admission",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF
➜ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json \
-hostname=admission-registry.default.svc -profile=server server-csr.json | cfssljson -bare server
2021/01/23 17:08:37 [INFO] generate received request
2021/01/23 17:08:37 [INFO] received CSR
2021/01/23 17:08:37 [INFO] generating key: rsa-2048
2021/01/23 17:08:37 [INFO] encoded CSR
2021/01/23 17:08:37 [INFO] signed certificate with serial number 701199816701013791180179639053450980282079712724
➜ ls -la *.pem
-rw------- 1 ych staff 1675 Jan 23 17:05 ca-key.pem
-rw-r--r-- 1 ych staff 1310 Jan 23 17:05 ca.pem
-rw------- 1 ych staff 1675 Jan 23 17:08 server-key.pem
-rw-r--r-- 1 ych staff 1452 Jan 23 17:08 server.pem
4.使用生成的 server 证书和私钥创建一个 Secret 对象
# 创建Secret
➜ kubectl create secret tls admission-registry-tls \
--key=server-key.pem \
--cert=server.pem
secret/admission-registry-tls created
- 启动项目(目前支援两个其中一个部署，如果同时部署会报错)
# 如果使用validate webhook
kubectl apply -f deploy.yaml
kubectl apply -f validatewebhook.yaml
# 如果使用 mutate webhook
kubectl apply -f configmaps.yaml
kubectl apply -f nginx-configmap.yaml
kubectl apply -f deploy.yaml
kubectl apply -f mutatewebhook.yaml
[root@vm-0-12-centos yaml]# kubectl apply -f .
deployment.apps/admission-registry created
service/admission-registry created
validatingwebhookconfiguration.admissionregistration.k8s.io/admission-registry created
- 测试
test.yaml : 主要测试validate webhook 通过白名单的前缀
test1.yaml：主要测试validate webhook 非白名单的前缀 会报错，也可以测试mutate webhook 更换镜像后不会报错。
test3.yaml：主要测试mutate webhook 新增annotation
kubectl apply -f test.yaml
kubectl apply -f test1.yaml
kubectl apply -f test3.yaml
- deployment配置
重点
目录：yaml/deploy.yaml，主要说明配置文件的环境变量
apiVersion: apps/v1
kind: Deployment
metadata:
name: admission-registry
labels:
app: admission-registry
spec:
replicas: 1
selector:
matchLabels:
app: admission-registry
template:
metadata:
labels:
app: admission-registry
spec:
containers:
- name: validate
image: alpine:3.12
imagePullPolicy: IfNotPresent
command: ["/app/webhookPractice"]
env: # 环境变量
# validate 相关
- name: WhITE_OR_BLOCK # 使用白名单还是黑名单功能
value: "white"
- name: WHITELIST_REGISTRIES # 白名单列表：可自己选填
value: "docker.io,gcr.io"
- name: BLACKLIST_REGISTRIES # 黑名单列表：可自己选填
value: ""
- name: PORT # 端口
value: "443"
# mutate 相关
- name: MUTATE_OBJECT # 判断mutate是patch镜像功能还是补全annotation
value: "image" # "image" 或 "annotation" "label"
- name: ANNOTATION_KEY_VALUE # 可以自定义annotation
value: "customizeAnnotation:my.practice.admission"
- name: LABEL_KEY_VALUE # 可以自定义label
value: "customizeLabel:my.practice.admission"
- name: MUTATE_PATCH_IMAGE # replace模式的image
value: "nginx:1.19-alpine"
- name: MUTATE_PATCH_IMAGE_REPLACE # 区分是replace模式还是sidecar模式
value: "false"
ports:
- containerPort: 443
volumeMounts:
- name: webhook-certs
mountPath: /etc/webhook/certs # 写死的路径
readOnly: true
- name: app
mountPath: /app
- name: sidecarfile
mountPath: /etc/webhook/config # 写死的路径
volumes:
- name: webhook-certs
secret: # 把secret 映射到volumes。 最终会转为tls.crt tls.key
secretName: admission-registry-tls
- name: app
hostPath:
path: /root/k8sWebhookPractice
- name: sidecarfile # 如果使用sidecar模式，一定要配置此文件
configMap:
name: sidecar-injector
---
apiVersion: v1
kind: Service
metadata:
name: admission-registry
labels:
app: admission-registry
spec:
ports:
- port: 443
targetPort: 443
selector:
app: admission-registry