Integrating Webhooks for Resource Validation

In this lesson, you will learn how to enforce business logic on your Custom Resources by implementing validating and mutating admission webhooks.

While Custom Resource Definitions (CRDs) define the structure of your data, they are sometimes limited in their ability to enforce complex constraints. For instance, you might need to ensure that a replicas field never exceeds a specific number or that a databaseUrl follows a strict internal naming convention. Admission webhooks act as a gatekeeper, intercepting requests to the Kubernetes API server before an object is persisted in etcd.

Validating vs. Mutating

There are two primary types of webhooks you should implement:

1. Validating Webhooks: These check the incoming resource against your rules. If the resource violates the policy, the webhook returns a 403 Forbidden response, effectively rejecting the request.
2. Mutating Webhooks: These modify the resource before it is stored. This is ideal for injecting default values (like setting a default imagePullPolicy or adding common labels) when the user provides an incomplete specification.

Implementation Concept

To implement these, your controller must expose an HTTP endpoint that accepts an AdmissionReview object. When the API server receives a request, it sends a JSON payload to your webhook. Your logic evaluates the object and returns a response indicating success or failure.

If you are using the Operator SDK, you can easily scaffold these using the operator-sdk create webhook command. Here is a conceptual example of a validation check:

func (r *MyCustomResource) ValidateCreate() error {
    if r.Spec.Replicas > 10 {
        return fmt.Errorf("replicas cannot exceed 10")
    }
    return nil
}

By integrating these webhooks, you shift your validation logic out of the controller's reconciliation loop and directly into the API entry point. This ensures that the state of your cluster remains consistent and prevents invalid configurations from ever being saved to the database. This pattern is essential for maintaining strict compliance and operational standards in multi-user environments.

Key Takeaway: Admission webhooks act as a programmatic security and consistency layer, allowing you to reject invalid resource configurations or automatically inject default values before they reach your controller.