Query about lab "Practice Test – Validating and Mutating Admission Controllers" in CKAD course

Kubernetes
#1

Hi Team,

I have a question related to question 9 in the lab

In previous steps we have deployed demo webhook which does below

- Denies all request for pod to run as root in container if no securityContext is provided.

- If no value is set for runAsNonRoot, a default of true is applied, and the user ID defaults to 1234

- Allow to run containers as root if runAsNonRoot set explicitly to false in the securityContext

In next steps we have added some pod definitions file for each scenario. Deploy those pods with existing definitions file and validate the behaviour of our webhook

Where are these rules defined in the webserver? Are these defined in the image “stackrox/admission-controller-webhook-demo:latest” ? Kindly assist. Thanks!

apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook-server
  namespace: webhook-demo
  labels:
    app: webhook-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webhook-server
  template:
    metadata:
      labels:
        app: webhook-server
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1234
      containers:
      - name: server
        image: stackrox/admission-controller-webhook-demo:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8443
          name: webhook-api
        volumeMounts:
        - name: webhook-tls-certs
          mountPath: /run/secrets/tls
          readOnly: true
      volumes:
      - name: webhook-tls-certs
        secret:
          secretName: webhook-server-tls
#2

I would guess that you’d need to look at the implementation of the stackrox/admission-controller-webhook-demo image, which is here on github.

1 Like
#3

The rules are fixed, as this webhook is simply a demo project to show how to create a mutating webhook in Golang. The code comment here explains what it does, and the code following that comment is the implementation of the rules.

1 Like
#4

Thanks @rob_kodekloud and @Alistair_KodeKloud.

Regards,
Sakshi