lachie83 / internallb-webhook-admission-controller

Kubernetes Internal LoadBalancer Admission Webhook

Kubernetes Internal LoadBalancer Admission Webhook

This Kubernetes Admission controller only admits the creation of v1/service resources containing the correct cloud provider annotations to create Internal LoadBalancers.

See upstream k8s docs for details on these annotations

CircleCI Build Status

Project State

Experimental

Attribution

This projects uses the upstream examples found in the following repos:

• https://github.com/caesarxuchao/example-webhook-admission-controller
• https://github.com/kubernetes/kubernetes/tree/release-1.9/test/images/webhook

Massive thanks for all the work that went into crafting reusable examples.

Usage

Supported Kubernetes versions

• 1.9
• 1.10

Supported Clouds

• Supports any cloud provider that provisions an internal LoadBalancer based on Kubernetes service annotation. See upstream docs.
• Cloud support include:
  • Azure
  • Google Cloud
  • AWS

Prerequisites

Please enable the admission webhook feature doc.

Build

make docker_build

Deploy

There are two types of Webhook Admission controllers in Kubernetes 1.9.

• ValidatingAdmissionWebhook
• MutatingAdmissionWebhook

Enable the relevant Kubernetes Admission controller by adding to following --admission-control and restarting kube-apiserver. See the relevant docs.

ValidatingAdmissionWebhook,MutatingAdmissionWebhook

Here is an example minikube command to build a cluster with the Admission Controller flags already present on the API server.

minikube start --kubernetes-version v1.9.3 --bootstrapper kubeadm --logtostderr --vm-driver=virtualbox --extra-config=apiserver.admission-control="NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,ValidatingAdmissionWebhook,MutatingAdmissionWebhook,PodPreset"

Once the cluster has been configured you can deploy the admission webhook to using Helm. The default installation configures a MutatingWebhookConfiguration.

helm install --name admission-webhook charts/internallb-webhook-admission-controller

To install a ValidatingWebhookConfiguration please use the following command

helm install --name admission-webhook charts/internallb-webhook-admission-controller --set admissionRegistration.kind=ValidatingWebhookConfiguration

For a full list of configurable values in the helm chart please, run the following command

helm inspect charts/internallb-webhook-admission-controller

internallb-webhook-admission-controller's Issues

Add /healthz endpoint for readiness/liveliness checks

This would help control stability

Create mutation version of this admission controller

in k8s 1.9 you can mutate resource. This might provide a better UX and should be investigated.

Update to support Kubernetes 1.9

We can take a look at https://github.com/kubernetes/kubernetes/tree/release-1.9/test/images/webhook. The API version has been bumped to beta.

Add unit tests

Add some sanity checking around the adminLB function

Add circle-ci

Build and publish container to docker repo using circle CI

Add deployment steps

I would like to remove the current certificate "magic" and move this to a Helm chart. Here is a reference that uses certs -- https://github.com/kubernetes-incubator/service-catalog/tree/master/charts/catalog

Re-enable mTLS from API server to admission-controller

Client cert checking from the api-server to the admission controller is currently disable. Once we figure out what's happening upstream then we can re-enable

Support configurable service annotations

In order to make this more reusable, we can support configurable kv pairs in annotations enabling this to be used on other clouds