justindavies / registryadmissioncontroller

Kubernetes Admission Controller for Registry whitelisting

Setting up Registry Admission Controller

Make sure you are using the current context for your Kubernetes cluster.

Create certificate authority and certificates on the cluster

./create-cert.sh

creating certs in certs/
Generating RSA private key, 2048 bit long modulus
.........+++
..........................................+++
e is 65537 (0x10001)
certificatesigningrequest.certificates.k8s.io/registry-admission-service.default created
NAME                                 AGE   REQUESTOR      CONDITION
registry-admission-service.default   0s    masterclient   Pending
certificatesigningrequest.certificates.k8s.io/registry-admission-service.default approved
secret/registry-admission-certs created

Inject CA bundle

This will inject the Certificate Authority bundle (Base64 encoded) into the WebHook definition.

./inject_ca_bundle.sh

LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV5RENDQXJDZ0F3SUJBZ0lSQU5NYVBSRDMrdVlwN2RpTVZ5SGxVQjB3RFFZSktvWklodmNOQVFFTEJRQXcKRFRFTE1Ba0dBMVVFQXhNQ1kyRXdIaGNOTVRrd016STRNVFV5T1RFMVdoY05NakV3TXpJM01UVXlPVEUxV2pBTgpNUXN3Q1FZRFZRUURFd0pqWVRDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdn-{snip}-1anNwZVU5dkNkcFcwemc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==

NOTE: This will automatically edit the denyreg-admission-webhook.yaml definition.

Create Controller Service

kubectl apply -f controller_svc.yaml

Configure the Admission Controller

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: registry-admission
  labels:
    app: registry-admission
spec:
  template:
    metadata:
      labels:
        app: registry-admission
    spec:
      containers:
      - name: registry-admission
        image: "inklin/controller:latest"
        env:
        - name: CONTAINER_REGISTRY
          value: "inklin"
        ports:
        - name: admission-port
          containerPort: 3000

Within the controller definition, set the prefix for the container registry (e.g. myregistry.azurecr.io), this will be the only allowed registry to use.

Deploy the controller

kubectl -f controller.yaml

Test a normal deployment

cd tests
kubectl apply -f invalid.yml

Check that the dployment is succesful, and then remove it...

kubectl delete -f invalid.yml

Deploy the Webhook

The webhook is the definition within the API server to hand off requests to the controller deployed earlier.

kubectl apply -f denyreg-admission-webhook.yaml

Retest the deployment

kubectl apply -f invalid.yml