amp

README

Kubernetes Admission Mutation Proxy (amp)

amp is a Kubernetes Dynamic Admission Control mutating webhook proxy for Pods.

Motivation

The amp project focuses on simplifying the process of modifying Kubernetes Pods on creation through custom endpoints, adding, removing, and modifying init containers, volumes, environment variables, or any other component of the Pod specification. The amp project originally stemmed from the need to add custom volumes and environment variables to Pods created by JupyterHub; however, amp is useful for extending any system that creates Pods that should be interrogated and mutated with external resources and values. In the JupyterHub use case, JupyterHub spawns a Pod for a user into a Namespace, Kubernetes notifies amp and amp send the Pod specification to a custom endpoint. The custom endpoint retrieves a username from a Pod annotation and sends patch operations back to amp, modifying the Pod with user-specific environment variables and volume mounts.

Overview

amp receives Kubernetes Admission Review requests for Pod creation events from any Namespace labeled amp.txn2.com/enabled=true and forwards the Pod definition as a JSON POST to a custom HTTP endpoint defined through the value of the Namespace annotation amp.txn2.com/ep. The custom HTTP endpoint receives a Pod definition for evaluation and returns an array of JSONPatch operations to amp (see example).

The following depiction illustrates a high-level view of an example endpoint named some-app-b mutating a Pod:

1. Kubernetes receives a Pod creation event.

2. Kubernetes MutatingWebhookConfiguration for amp matches any Namespace labeled amp.txn2.com/enabled: true.

3. Kubernetes sends an AdmissionReview object to amp.

4. amp extracts the corev1.Pod object from the AdmissionReview, looks up the custom endpoint annotated in the Pod's Namespace and sends an HTTP POST of the corev1.Pod as JSON to the endpoint.

5. amp receives a JSON encoded array of PatchOperations for the corev1.Pod.

6. amp responds to Kubernetes AdmissionReview with the received PatchOperations as a response.

7. Kubernetes creates the new mutated Pod.

Example patch operations

po := []PatchOperation{
    // add initContainer
    {
        Op:   "add",
        Path: "/spec/initContainers/-",
        Value: corev1.Container{
            Name:  "new-init-container",
            Image: "alpine:3.12.0",
        },
    },
    // add environment variable to container 0 first-existing-container
    {
        Op:   "add",
        Path: "/spec/containers/0/env/-",
        Value: corev1.EnvVar{
            Name:  "ADDED_VAR",
            Value: "something important",
        },
    },
}

Example Implementation

Refer to the example implementation at txn2/amp-wh-example.

Install

see k8s/README.md

Development

Release

goreleaser --skip-publish --rm-dist --skip-validate

GITHUB_TOKEN=$GITHUB_TOKEN goreleaser --rm-dist

Documentation

Index

• type AdmissionReview
• type Api
  • func NewApi(cfg *Config) (*Api, error)
  • func (a *Api) AdmissionReviewHandler(admissionReview AdmissionReview) gin.HandlerFunc
  • func (a *Api) OkHandler(version string, mode string, service string) gin.HandlerFunc
• type Config
• type KeypairReloader
  • func NewKeypairReloader(certPath, keyPath string, logger *zap.Logger) (*KeypairReloader, error)
  • func (kpr *KeypairReloader) GetCertificateFunc() func(*tls.ClientHelloInfo) (*tls.Certificate, error)
• type PatchOperation

Types

type AdmissionReview

type AdmissionReview string

const (
	AdmissionReviewValidate AdmissionReview = "validate"
	AdmissionReviewMutate   AdmissionReview = "mutate"
)

type Api

type Api struct {
	*Config
}

func NewApi

func NewApi(cfg *Config) (*Api, error)

func (*Api) AdmissionReviewHandler

func (a *Api) AdmissionReviewHandler(admissionReview AdmissionReview) gin.HandlerFunc

func (*Api) OkHandler

func (a *Api) OkHandler(version string, mode string, service string) gin.HandlerFunc

type Config

type Config struct {
	Log                    *zap.Logger
	HttpClient             *http.Client
	Cs                     *kubernetes.Clientset
	MutationEpAnnotation   string
	ValidationEpAnnotation string
}

Config configures the API

type KeypairReloader

type KeypairReloader struct {
	// contains filtered or unexported fields
}

func NewKeypairReloader

func NewKeypairReloader(certPath, keyPath string, logger *zap.Logger) (*KeypairReloader, error)

func (*KeypairReloader) GetCertificateFunc

func (kpr *KeypairReloader) GetCertificateFunc() func(*tls.ClientHelloInfo) (*tls.Certificate, error)

type PatchOperation

type PatchOperation struct {
	Op    string      `json:"op"`
	Path  string      `json:"path"`
	Value interface{} `json:"value,omitempty"`
}

PatchOperation see: http://jsonpatch.com/