准入控制深度：Validating/Mutating Webhook 与策略执行

kubectl apply
  -> [认证 Authentication]   你是谁
  -> [鉴权 Authorization]    RBAC / Node / Webhook 鉴权
  -> [变更准入 Mutating]     可 patch 对象（注入 sidecar、补默认值）
  -> [对象 Schema 校验]      OpenAPI schema validation
  -> [校验准入 Validating]   只返回 allow / deny / warn
  -> [etcd 持久化]

kubectl api-versions | grep admissionregistration.k8s.io
kubectl api-resources | grep admissionregistration

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pod-policy.example.com
webhooks:
  - name: pod-policy.example.com
    admissionReviewVersions: ["v1"]
    sideEffects: None
    failurePolicy: Fail
    timeoutSeconds: 5
    clientConfig:
      service:
        name: policy-webhook
        namespace: policy-system
        path: /validate-pods
        port: 443
      caBundle: <base64 编码的 CA 证书>
    rules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
        scope: Namespaced
    namespaceSelector:
      matchExpressions:
        - key: policy.example.com/exempt
          operator: DoesNotExist

kubectl label ns kube-system policy.example.com/exempt=true

{
  "response": {
    "uid": "<与请求一致>",
    "allowed": true,
    "patchType": "JSONPatch",
    "patch": "W3sib3AiOiJhZGQiLCJwYXRoIjoiL21ldGFkYXRhL2xhYmVscy9pbmplY3RlZCJ9XQ=="
  }
}

// 伪代码：先判断再注入，保证幂等
for _, c := range pod.Spec.Containers {
    if c.Name == "sidecar" {
        return allowWithoutPatch()
    }
}
patches = append(patches, addSidecarPatch())

openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
  -keyout ca.key -out ca.crt -subj "/CN=policy-ca"
openssl req -newkey rsa:2048 -nodes -keyout tls.key -out tls.csr \
  -subj "/CN=policy-webhook.policy-system.svc"
openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out tls.crt -days 3650 \
  -extfile <(printf "subjectAltName=DNS:policy-webhook.policy-system.svc")

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: policy-webhook-cert
  namespace: policy-system
spec:
  secretName: policy-webhook-tls
  dnsNames:
    - policy-webhook.policy-system.svc
    - policy-webhook.policy-system.svc.cluster.local
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    var review admissionv1.AdmissionReview
    if err := json.Unmarshal(body, &review); err != nil {
        http.Error(w, "bad request", http.StatusBadRequest)
        return
    }
    resp := &admissionv1.AdmissionResponse{UID: review.Request.UID, Allowed: true}
    resp.Result = validate(review.Request)
    json.NewEncoder(w).Encode(admissionv1.AdmissionReview{TypeMeta: review.TypeMeta, Response: resp})
}

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          provided := {l | input.review.object.metadata.labels[l]}
          required := {l | l := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("缺少必需标签: %v", [missing])
        }

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged
spec:
  validationFailureAction: Enforce
  rules:
    - name: no-privileged
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "禁止特权容器"
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "false"

□ 补丁是否可能重复追加数组元素
□ 补丁是否覆盖了其他 Webhook 刚写入的字段
□ reinvocationPolicy=IfNeeded 时逻辑是否仍正确
□ 对已存在对象执行 UPDATE 时是否重复注入

spec:
  replicas: 3
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  app: policy-webhook

admission_webhook_request_total{webhook, allowed}   请求量与放行率
admission_webhook_latency_seconds                   准入耗时分布
admission_webhook_rejection_total{reason}           拒绝原因分布
apiserver_admission_webhook_fail_open_count         fail-open 次数

kubectl -n kube-system logs -l component=kube-apiserver --tail=200 | grep -i admission
kubectl -n policy-system port-forward svc/policy-webhook 8443:443
curl -k https://localhost:8443/validate-pods
kubectl get validatingwebhookconfiguration pod-policy.example.com \
  -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | wc -c

□ 所有 Webhook 有明确的 namespaceSelector 豁免（至少 kube-system）
□ 证书由 cert-manager 自动轮换，caBundle 不手工维护
□ 安全强约束用 failurePolicy=Fail，审计类用 Ignore
□ Webhook 服务 3 副本 + 反亲和 + PDB + 就绪探针
□ timeoutSeconds 控制在 5 秒内
□ 变更补丁幂等，可安全重入
□ 策略纳入 Git，走 GitOps 评审后发布
□ 监控 fail-open 计数与准入延迟 P99