Skip to content

Commit 882b388

Browse files
developer-guydeveloper-guy
committed
feature: mutating webhook post ready
Signed-off-by: Batuhan Apaydın <[email protected]>
1 parent 42dd2d5 commit 882b388

2 files changed

+300
-0
lines changed

‎_posts/2020-10-27-kubernetes-webhooks-made-easy-with-openfaas.md

+6
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,12 @@ $ cd deployment
146146
$ kubectl apply -f rbac.yaml,service.yaml,deployment.yaml
147147
```
148148

149+
* Label the default namespace to enable the webhook
150+
151+
```sh
152+
$ kubectl label namespaces default admission-webhook-example=enabled
153+
```
154+
149155
### 5. Build and Deploy OpenFaaS Function (Optional)
150156

151157
* Pull the [golang-middleware](https://github.com/openfaas-incubator/golang-http-template) template from [OpenFaaS Official Template Store](https://github.com/openfaas/store)

‎_posts/2020-11-26-kubernetes-webhooks-made-easy-with-openfaas-part-2.md

+294
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,294 @@
1+
---
2+
title: "Writing Kubernetes Admission Controllers with OpenFaaS"
3+
description: "Learn how to write your Kubernetes Admission Controllers with OpenFaaS functions"
4+
date: 2020-11-26
5+
image: /images/2020-10-27-k8s-validatingwebhook-openfaas/puzzle.jpg
6+
categories:
7+
- arkade
8+
- kubectl
9+
- faas-cli
10+
- admissionwebhooks
11+
- mutatingadmissionwebhooks
12+
- k8s extensibility
13+
author_staff_member: developer-guy
14+
dark_background: true
15+
---
16+
17+
Learn how to write your Kubernetes Admission Controllers with OpenFaaS functions
18+
19+
<p align="center">
20+
<img height="128" src="/images/openfaas/kubernetes.png">
21+
</p>
22+
23+
## Introduction to Kubernetes Admission Controllers
24+
In my last [post](https://www.openfaas.com/blog/kubernetes-webhooks-made-easy-with-openfaas/), we talked about what Kubernetes Admission Webhooks are and how can we use Validating Admission Webhook.
25+
26+
Today we will explore how to build a Kubernetes Admission Controller with a function.
27+
28+
The main difference between the two types of admission webhook is validating webhooks can reject a request, but they cannot modify the object they are receiving in the admission request, while mutating webhooks can modify objects by creating a patch that will be sent back in the admission response and can reject a request too. If a webhook rejects a request, an error is returned to the end-user.
29+
30+
Also, the other difference between the two types are validating webhooks are called in parallel and mutating webhooks are called in-sequence by the api-server.
31+
32+
## Use-cases
33+
Multi-tenant Kubernetes creates some special challenges when it comes to resource sharing and security.Multi-tenant Kubernetes is a Kubernetes deployment where multiple applications or workloads run side-by-side.When it comes to resource sharing, you must ensure that each tenant has access to the resources they need.Requests and limits are the mechanisms Kubernetes uses to control resources such as CPU and memory.So, if you forget to set a limits&requests for your application, you may affect the cluster state bad and this causes to disturb the other tenants in the platform.Because when you forget to set limits&request for the application, application is going to try to consume all the resources available on the node.To avoid that, we are going to create a Mutating Admission Webhook, this webhook will check your deployment for the resources available, if you forgot to set resources it will inject the default resources for it.
34+
35+
## The Scenario
36+
We have a deployment with no resources defined.We are going to try to create this deployment and we want to make sure that this webhook will not let us to do that.
37+
38+
There is one important thing we need to say about Mutating Admission webhook is that:
39+
40+
> Mutating Admission webhooks, mutations are performed via JSON patches. While the JSON patch standard includes a lot of intricacies that go well beyond the scope of this discussion, the Go data structure in our example as well as its usage should give the user a good initial overview of how JSON patches work:
41+
42+
```golang
43+
type patchOperation struct {
44+
Op string `json:"op"`
45+
Path string `json:"path"`
46+
Value interface{} `json:"value,omitempty"`
47+
}
48+
```
49+
50+
For setting the field .spec.securityContext.runAsNonRoot of a pod to true, we construct the following patchOperation object:
51+
52+
```golang
53+
patches = append(patches, patchOperation{
54+
Op: "add",
55+
Path: "/spec/securityContext/runAsNonRoot",
56+
Value: true,
57+
})
58+
```
59+
60+
Reminder, we will use the same workflow defined in previous post like below:
61+
62+
* Kubernetes API -> Webhook (w/TLS) -> OpenFaaS Gateway (w/HTTP) -> OpenFaaS Function
63+
64+
![Workflow](/images/2020-10-27-k8s-validatingwebhook-openfaas/admission-controller-phases.png)
65+
> Credit: [https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/](https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/)
66+
67+
### Prerequisites
68+
##### Arkade
69+
70+
* [arkade](https://get-arkade.dev) is The OpenFaaS community built tool for Kubernetes developers, with arkade you can easily install all necessary cli tools to your host and deploy apps to the cluster.
71+
72+
```sh
73+
$ curl -sLS https://dl.get-arkade.dev | sudo sh
74+
```
75+
76+
##### KinD (Kubernetes in Docker)
77+
78+
* Kubernetes is our recommendation for teams running at scale, but in this demo we will be using [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/) for the sake of simplicity.
79+
80+
```sh
81+
$ arkade get kind
82+
```
83+
84+
##### kubectl
85+
86+
* You can control your cluster using [kubectl](https://github.com/kubernetes/kubectl) CLI.
87+
88+
```sh
89+
$ arkade get kubectl
90+
```
91+
92+
##### faas-cli
93+
94+
* [faas-cli](https://github.com/openfaas/faas-cli) is an official CLI for OpenFaaS , with "faas-cli" you can build and deploy functions easily.
95+
96+
```sh
97+
$ arkade get faas-cli
98+
```
99+
100+
### Setup
101+
102+
### 1. Setup a Kubernetes Cluster with KinD
103+
104+
You can start a Kubernetes cluster with KinD if you don't have one already
105+
106+
```bash
107+
$ arkade get kind
108+
$ kind create cluster
109+
```
110+
111+
### 2. Deploy OpenFaaS to our local Kubernetes Cluster with arkade:
112+
113+
* Install a OpenFaaS
114+
115+
```sh
116+
$ arkade install openfaas
117+
```
118+
119+
Read the output from the installation and run the commands given to you.
120+
121+
```sh
122+
# Forward the gateway to your machine
123+
kubectl rollout status -n openfaas deploy/gateway
124+
kubectl port-forward -n openfaas svc/gateway 8080:8080 &
125+
126+
# If basic auth is enabled, you can now log into your gateway:
127+
PASSWORD=$(kubectl get secret -n openfaas basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode; echo)
128+
echo -n $PASSWORD | faas-cli login --username admin --password-stdin
129+
```
130+
131+
You can access them again at any time with `arkade info openfaas`
132+
133+
### 3. Clone the project
134+
135+
* Clone the sample from GitHub
136+
137+
```sh
138+
$ git clone https://github.com/developer-guy/admission-webhook-example-with-openfaas
139+
$ cd admission-webhook-example-with-openfaas
140+
$ git checkout feature/mutating
141+
```
142+
143+
* Let's explore the structure of the project.
144+
145+
```
146+
deployment/ --> includes necessary manifests and scripts for the deployment of the project
147+
functions/ --> includes templates and the requiredlabel function itself
148+
Dockerfile --> includes instructions to build an image of the project
149+
build --> automated way to build and push an image of the project
150+
```
151+
152+
### 4. Deploy MutatingAdmissionWebhook
153+
154+
* We will generate the TLS certificates required for the ValidatingAdmissionWebhook using the following: [Kubernetes TLS Certificates Management](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/)
155+
156+
```sh
157+
$ cd deployment
158+
$ sh webhook-create-signed-cert.sh
159+
```
160+
161+
* Get the Certificate Authority (CA) from the local cluster
162+
163+
```sh
164+
$ export CA_BUNDLE=$(kubectl config view --minify --flatten -o json | jq -r '.clusters[] | select(.name == "'$(kubectl config current-context)'") | .cluster."certificate-authority-data"')
165+
$ sed -e "s|\${CA_BUNDLE}|${CA_BUNDLE}|g" mutatingwebhook.yaml | kubectl apply -f -
166+
$ cd ..
167+
```
168+
169+
* Build the project
170+
171+
```sh
172+
$ export DOCKER_USER="docker-hub-username"
173+
$ ./build
174+
```
175+
176+
Now edit `deployment.yaml` and set 'DOCKER_USER' to the above.
177+
178+
* Deploy it project
179+
180+
```sh
181+
$ cd deployment
182+
$ kubectl apply -f rbac.yaml,service.yaml,deployment.yaml
183+
# Label the default namespace to enable the webhook
184+
$ kubectl label namespaces default admission-webhook-example=enabled
185+
```
186+
187+
* This time we are using "fileinjector" as a FUNCTION_NAME environment variable in the deployment.yaml file
188+
189+
```yaml
190+
env:
191+
- name: FUNCTION_NAME
192+
value: fileinjector
193+
```
194+
195+
### 5. Build and Deploy OpenFaaS Function (Optional)
196+
197+
* Pull the [golang-middleware](https://github.com/openfaas-incubator/golang-http-template) template from [OpenFaaS Official Template Store](https://github.com/openfaas/store)
198+
199+
```sh
200+
$ faas-cli template store list # check available templates in store
201+
$ faas-cli template store describe golang-middleware # describe the specific template
202+
$ faas-cli template store pull golang-middleware
203+
```
204+
205+
* Create the function
206+
207+
```sh
208+
$ export OPENFAAS_PREFIX=$DOCKER_USER
209+
$ faas-cli new fileinjector --lang go-middleware
210+
$ cd fileinjector
211+
$ go mod init fileinjector
212+
$ # fill the handler.go with the corresponding code: [functions/fileinjector/handler.go](https://github.com/developer-guy/admission-webhook-example-with-openfaas/blob/feature/mutating/functions/fileinjector/handler.go)
213+
$ go get
214+
```
215+
216+
* Deploy the function
217+
218+
```sh
219+
$ cd functions
220+
$ faas-cli up -f fileinjector.yml --build-arg GO111MODULE=on # (build-push-deploy) make sure you are using your docker hub username. i.e: devopps
221+
```
222+
223+
* Verify the functions that are working in `openfaas-fn` namespace
224+
225+
```sh
226+
$ kubectl get pods --namespace openfaas-fn
227+
```
228+
229+
### 6. Testing the whole workflow
230+
231+
* First, check the [deployment](https://github.com/developer-guy/admission-webhook-example-with-openfaas/blob/feature/mutating/deployment/busybox.yaml) manifest and see there is no resources defined for the container.
232+
233+
```sh
234+
apiersion: apps/v1
235+
kind: Deployment
236+
metadata:
237+
name: busybox
238+
namespace: default
239+
labels:
240+
app: busybox
241+
spec:
242+
selector:
243+
matchLabels:
244+
app: busybox
245+
replicas: 1
246+
template:
247+
metadata:
248+
labels:
249+
app: busybox
250+
spec:
251+
containers:
252+
- name: busybox
253+
image: busybox
254+
command: [ "/bin/sh" ]
255+
args: [ "-c", "while true; do cat /etc/config/hello-openfaas.txt; sleep 2; done" ]
256+
```
257+
258+
* Then, you can create the deployment by applying this manifest file. After doing this, you will notice that container resources are injected automatically by the mutating webhook with the default values defined by the mutating webhook.
259+
260+
## 7. What can you do with it ?
261+
262+
As it stands, the demo is not ready for production environment but it gives you an overview about how you can create a mutating webhook , how you can enforce some kind of best practices(inject default resources in this case) for your cluster with the few lines of code.You can extend this demo for your organizational needs as you wish.
263+
264+
```sh
265+
$ kubectl apply -f busybox.yaml
266+
```
267+
268+
* Check the YAML of the Deployment, you will see the default resources.
269+
270+
```sh
271+
$ kubectl get deployments busybox -ojsonpath='{.spec.template.spec.containers[?(@.name=="busybox")].resources}'
272+
{"limits":{"cpu":"125Mi","memory":"75Mi"},"requests":{"cpu":"100Mi","memory":"50Mi"}}
273+
```
274+
275+
### Join the community
276+
277+
Have you got questions, comments, or suggestions? Join the community on [Slack](https://slack.openfaas.io).
278+
279+
Would you like help to set up your OpenFaaS installation, or someone to call when things don't quite go to plan? [Our Premium Subscription plan](https://www.openfaas.com/support/) gives you a say in the project roadmap, a support contact, and access to Enterprise-grade authentication with OIDC.
280+
281+
### Acknowledgements
282+
283+
* Special Thanks to [Alex Ellis](https://twitter.com/alexellisuk) for all guidance and for merging changes into OpenFaaS to better support this workflow.
284+
285+
* Special Thanks to [Furkan Türkal](https://twitter.com/furkanturkaI) for all the support.
286+
287+
### References
288+
* [https://banzaicloud.com/blog/k8s-admission-webhooks](https://banzaicloud.com/blog/k8s-admission-webhooks)
289+
* [https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/](https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/)
290+
* [https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74](https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74)
291+
* [https://blog.alexellis.io/get-started-with-openfaas-and-kind/](https://blog.alexellis.io/get-started-with-openfaas-and-kind/)
292+
* [https://github.com/morvencao/kube-mutating-webhook-tutorial](https://github.com/morvencao/kube-mutating-webhook-tutorial)
293+
* [https://github.com/developer-guy/admission-webhook-example-with-openfaas](https://github.com/developer-guy/admission-webhook-example-with-openfaas)
294+
* [https://platform9.com/blog/kubernetes-multi-tenancy-best-practices/](https://platform9.com/blog/kubernetes-multi-tenancy-best-practices/)

0 commit comments

Comments
 (0)