Admission Webhookを作って遊んで、その仕組みを理解しよう（動作編）

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: "sample-validating-webhook"
webhooks:
- name: "sample-validating-webhook.hoge.fuga.local"
  namespaceSelector:
    matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: In
      values: ["admin-1", "admin-2", "admin-3"]
...

## webhook serverの秘密鍵作成
$ openssl genrsa 2048 > server.key
Generating RSA private key, 2048 bit long modulus
..+++
................+++
e is 65537 (0x10001)

## CSRの作成
$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, fully qualified host name) []:mywebook.mynamespace.svc.cluster.local
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:

% ll
total 16
-rw-r--r--  1 shinyamori  staff   968B  5 17 11:49 server.csr
-rw-r--r--  1 shinyamori  staff   1.6K  5 16 22:41 server.key

## SubjectAltNameに対応するためのファイル作成
$ echo "subjectAltName = DNS:mywebhook.mynamespace.svc, DNS:mywebhook.mynamespace.svc.cluster.local" > san.txt

$ cat san.txt
subjectAltName = DNS:mywebhook.mynamespace.svc, DNS:mywebhook.mynamespace.svc.cluster.local

## サーバ証明書の作成
$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt -extfile san.txt
Signature ok
subject=/C=JP/ST=Tokyo/CN=mywebook.mynamespace.svc.cluster.local
Getting Private key

## 証明書の中身確認
$ openssl x509 -text -noout -in server.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14353298851236901938 (0xc731294216ff7432)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=JP, ST=Tokyo, CN=mywebook.mynamespace.svc.cluster.local
        Validity
            Not Before: May 17 02:52:21 2022 GMT
            Not After : May 17 02:52:21 2023 GMT
        Subject: C=JP, ST=Tokyo, CN=mywebook.mynamespace.svc.cluster.local
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:mywebhook.mynamespace.svc, DNS:mywebhook.mynamespace.svc.cluster.local
    Signature Algorithm: sha1WithRSAEncryption
         ...

Error from server (InternalError): Internal error occurred: failed calling webhook "sample-validating-webhook.hoge.fuga.local": failed to call webhook: Post "https://mywebhook.mynamespace.svc:443/runasuser-validation?timeout=5s": x509: certificate relies on legacy Common Name field, use SANs instead

$ go run server.go -server-cert=./tmp/server.crt -server-key=./tmp/server.key -body-dump
...

$ curl -s -k -H 'Content-Type: application/json' -XPOST https://localhost:8443/runasuser-validation -d @testdata/noRunAsUserRequestTemplate.json | jq .
{
  "response": {
    "uid": "2e556680-fe1b-412d-9660-4e0574adcf47",
    "allowed": false,
    "status": {
      "metadata": {},
      "message": "runAsUser is required in user namespace.",
      "code": 403
    }
  }
}

$ kubectl create ns mynamespace
$ kubectl create secret tls mywebhook-secret --key server.key --cert server.crt -n mynamespace
secret/mywebhook-secret created

$ kubectl describe secret mywebhook-secret -n mynamespace
Name:         mywebhook-secret
Namespace:    mynamespace
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.crt:  1253 bytes
tls.key:  1675 bytes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mywebhook
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mywebhook
  template:
    metadata:
      labels:
        app: mywebhook
    spec:
      containers:
      - name: app
        args:
          - -server-cert=/tmp/tls/tls.crt
          - -server-key=/tmp/tls/tls.key
          - -body-dump
        imagePullPolicy: Always
        image: ghcr.io/mosuke5/sample-validating-admission-webhook:main
        ports:
        - containerPort: 8443
        volumeMounts:
        - name: tls
          mountPath: /tmp/tls/
      volumes:
      - name: tls
        secret:
          secretName: mywebhook-secret

$ kubectl apply -f manifests/deploy.yaml -n mynamespace
$ kubectl get pod,service -n mynamespace
NAME                             READY   STATUS    RESTARTS   AGE
pod/mywebhook-685f859975-tfd2n   1/1     Running   0          37s

NAME                TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/mywebhook   ClusterIP   172.30.26.80   <none>        443/TCP   2m6s

$ sed  "s/BASE64_ENCODED_PEM_FILE/$(base64 server.crt)/g" manifests/validatingwebhookconfiguration.yaml.template | kubectl apply -f -
validatingwebhookconfiguration.admissionregistration.k8s.io/sample-validating-webhook created

$ kubectl create ns user-foo
$ kubectl create ns admin-bar

$ kubectl run debug --rm -it --image busybox:latest -n user-foo -- /bin/sh
Error from server: admission webhook "mywebhook.mynamespace.svc.cluster.local" denied the request: runAsUser is required in user namespace.

$ kubectl run debug --rm -it --image busybox:latest -n admin-bar -- /bin/sh

If you don't see a command prompt, try pressing enter.
/ # uname -a
Linux debug 4.18.0-305.45.1.el8_4.x86_64 #1 SMP Wed Apr 6 13:48:37 EDT 2022 x86_64 GNU/Linux

$ cat <<EOF | kubectl apply -n user-foo -f -
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: debug
  name: debug
spec:
  containers:
    - image: busybox:latest
      command:
        - /bin/sh
      args:
        - -c
        - 'sleep 3600'
      name: debug
      resources: {}
  securityContext:
    runAsUser: 1001
EOF
pod/debug created