Kubernetes Admission Controller（插件）和 Admission Webhook 有什么区别？

Question

Admission Controllers (Plugins) and Admission Webhooks look very similar on the surface. What is the actual, functional difference?

Answer 1

Admission Controllers are conflated to mean both Admission Plugins and Admission Webhooks by experts and even the official documentation . I will call them Admission Plugins and Admission Webhooks to prevent confusion.

Admission Plugins are not an API resource . They can't be created by cluster administrators. They are hardcoded into the Kubernetes source code.

Specifically, Admission Plugins are a tool with limitless power. Since they are baked into kube-apiserver , they have the ability to simply request for resources without authentication. They use this power to implement the DefaultStorageClass Admission Plugin, which checks all of the StorageClass es to find one with a default annotation applied to it.

Admission Webhooks on the other hand, are actually an implementation of an Admission Plugin , with the extra power removed. Note how a Webhook.Validator does not have the ability to access any resources besides the exact object being validated at the time. Admission Webhooks are API resources , and are usually the first thing recommended when implementing a validator for a Kubernetes Operator, or a CRD in general. Despite this, signed certificates are required , which can make you abandon the whole idea.

What does this mean for the average developer?

To write a validator that relies on checking existing objects in the cluster, you need to go through extra steps by using the Kubernetes Golang Client API , which relies on having a service account token with the correct RBAC applied.

You can also update your object with a Status instead , explaining the reason validation failed. If you are writing a Kubernetes Operator, that can be written in the reconciliation loop.

If you have written a fancy UI for your custom resource, you should be able to read these statuses and expose them to the user in a nicer way. Unfortunately, OpenShift 4.X users are not able to add fancy UIs to the OpenShift Web Console, and will have to settle for exposing Route s.