Collaboration is Important for Admission Webhooks in Service Meshes
summary
Explains that before Kubernetes 1.15 mutating webhooks and in-tree plugins like LimitRanger run in a single pass and can miss sidecars, causing ResourceQuota or PodSecurityPolicy validation to fail; Linkerd works around this with flags and by copying limits into the proxy. Kubernetes 1.15 adds reinvocation and marking a webhook IfNeeded lets it run a second time so LimitRanger can touch injected sidecars. Builds a custom webhook to add a preStop lifecycle hook as a working workaround and verifies it on a 1.15 cluster.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:11Admission Webhooks are Great
- 1:01Resource Admission Workflow
- 2:18Admission Workflow Before 115
- 4:09Admission Workflow After 115
- 4:42Sidecars Lifecycle Issue
- 5:52Sidecar Lifecycle Admission Webhook
related talks
14mEverything Worked Before Kubernetes
33mReducing Boilerplate With Kubernetes Custom Resource Definitions
36mTaming the Beast: Advanced Resource Management With Kubernetes
20mTop new CNCF projects to look out for
26mAvoid Spikes: Unexpected Kubernetes Behaviors
44mInner Development Loop with Java on Kubernetes
26mTop new CNCF projects to look out for
22mSpreading Apps, Controlling Traffic & Managing Costs in Kubernetes