This project is for setting up a basic Kubernetes validating Admission Controller using python.
Steps to build your own admission controller.
Create your custom logic. There is an example admission controller shown in the /app directory that looks for a "billing" label to be applied to pods and deployments.
Update certgen.sh to match your admission controller. You may need to update the service and namespace where the controller lives.
Update the ext.cnf to match your own localities, and change the alt_names section to match your service name. Note, if using the existing templates, the name here won't need editing.
Run the certgen.sh script to create the self-signed SAN certificates for the admission controller.
Get the base64 value of the ca.crt file created by the certgen.sh script.
cat certs/ca.crt | base64
Paste the base64 value into the caBundle location in the webhook.yaml file.
Build the container using the Dockerfile within the directory. Push the image to your image repository
Update the warden-k8s.yaml file to point to your new image.
Apply the warden-k8s.yaml file to deploy your admission controller within the cluster.
Apply the webhook.yaml file to deploy the validation configuration to the Kubernetes API server.
Test your app. If using the default warden.py included with this repository, there are three test manifests in the test-pods folder.