Go Operator Webhook 实战admission webhook 编写到生产Webhook 让 K8s 在持久化前/后做校验与修改。这篇文章带你从原理到实现一次性完成。一、Webhook 类型Admission Webhookmutating修改、validating校验CRD Conversion Webhook版本转换ImagePolicyWebhookkubelet 启动时校验镜像二、流程kubectl → APIServer → Mutating Webhook → APIServer → Validating Webhook → ETCD三、生成 Webhookkubebuilder create webhook--groupmyapp--versionv1--kindMyApp--defaulting--programmatic-validation生成api/v1/myapp_webhook.gowebhook字段main.go注册四、Mutating Webhookfunc(r*MyAppDefaulter)Default(ctx context.Context,obj*myappv1.MyApp)error{ifobj.Spec.Replicasnil{d:int32(1)obj.Spec.Replicasd}ifobj.Spec.Image{obj.Spec.Imagedefault:latest}returnnil}五、Validating Webhookfunc(r*MyAppValidator)ValidateCreate(ctx context.Context,obj*myappv1.MyApp)error{ifobj.Spec.Image{returnerrors.New(image is required)}ifobj.Spec.Replicas!nil*obj.Spec.Replicas10{returnerrors.New(replicas should 10)}returnnil}六、注册funcmain(){mgr,_:ctrl.NewManager(ctrl.GetConfigOrDie(),ctrl.Options{Port:9443,Host:0.0.0.0,})ctrl.NewWebhookManagedBy(mgr).For(myappv1.MyApp{}).WithValidator(MyAppValidator{}).WithDefaulter(MyAppDefaulter{}).Complete()mgr.Start(ctrl.SetupSignalHandler())}七、TLS 配置# 生成本地 certmkcert localhost# 或catEOF|cfssl gencert-caca.pem -ca-key ca-key.pem-configca-config.json-hostnamewebhost -|cfssljson-barewebhookEOF八、Service ServiceMonitorkind:Servicemetadata:name:webhook-servicespec:selector:{app:my-operator}ports:-port:443targetPort:9443MutatingWebhookConfiguration:apiVersion:admissionregistration.k8s.io/v1kind:MutatingWebhookConfigurationwebhooks:-name:myapp.my.domainsideEffects:NoneclientConfig:service:{name:webhook-service,port:443,path:/mutate-myapp-v1}rules:-operations:[CREATE,UPDATE]apiGroups:[my.domain]apiVersions:[v1]resources:[myapps]九、踩坑清单WEBHOOK 必须 tls证书管理难1.16 之前需要 sa RBACWebhook 重启影响集群响应十、实战Operator Webhookerr:ctrl.NewControllerManagedBy(mgr).For(v1.MyApp{}).Owns(v1.Pod{}).Complete(r)十一、未来趋势Dynamic Admission ControlWebhook 进一步缓存化十二、总结与展望Webhook Operator 是 K8s 自定义平台的灵魂。掌握它们能写出云原生管控系统。十三、参考文献Kubebuilder 文档admissionregistration.k8s.io API