Introduction to dynamic admission controllers

An admission controller is a specialized webhook in Kubernetes that runs when an object is created, updated, or deleted. When one of these three events happens, the API server sends information about the object and operation to the webhook. Admission controllers can be used to either determine if an operation should happen or give the cluster operator a chance to change the object definition before it’s processed by the API server. We’re going to look at using this mechanism to both enforce security and extend the functionality of Kubernetes.

There are two ways to extend Kubernetes:

• Build a custom resource definition so that you can define your own objects and APIs.
• Implement a webhook that listens for requests from the API server and responds with the necessary information. You may recall that in Chapter 6, Integrating Authentication into Your Cluster, we explained that a custom webhook could be used...