k8s mutating and validation webhook
The flow for k8s mutation and validation webhook can be illustrated here:
Key points of interest are :-
- Mutations happen first and may change the object
- Validations happen after all mutations, working on the final mutated object
-All webhooks in each phase are executed in defined order
1. User/API Client sends a request (e.g., create Pod)
│
▼
2. API Server handles:
- Authentication
- Authorization
│
▼
3. Admission Phase Begins
│
▼
4. MUTATING Webhooks (in order)
┌──────────────────────────────┐
│ MutatingWebhook #1 │◄─── Can modify object
└──────────────────────────────┘
│
▼
┌──────────────────────────────┐
│ MutatingWebhook #2 │◄─── Can modify further
└──────────────────────────────┘
│
▼
(Object now fully mutated)
│
▼
5. VALIDATING Webhooks (in order)
┌──────────────────────────────┐
│ ValidatingWebhook #1 │◄─── Can approve/reject
└──────────────────────────────┘
│
▼
┌──────────────────────────────┐
│ ValidatingWebhook #2 │◄─── Can approve/reject
└──────────────────────────────┘
│
▼
6. If All Validating Webhooks Approve:
┌──────────────────────────────┐
│ Persist object in etcd │
└──────────────────────────────┘
│
▼
7. Return success to API client
Comments