Introduction to dynamic admission controllers
There are two ways to extend Kubernetes:
- Build a custom resource definition so that you can define your own objects and APIs.
- Implement a webhook that listens for requests from the API server and responds with the necessary information. You may recall that in Chapter 5, Integrating Authentication into Your Cluster, we explained that a custom webhook could be used to validate tokens.
Starting in Kubernetes 1.9, a webhook can be defined as a dynamic admission controller, and in 1.16, the dynamic admission controller API became Generally Available (GA).
There are two types of dynamic admission controllers, validating and mutating. Validating admission controllers verify that a new object, update, or delete can move forward. Mutation allows a webhook to change the payload of an object's creation, deletion, or update. This section will focus on the details of admission controllers. We'll talk more...