diff --git a/doc/webhook/webhook.md b/doc/webhook/webhook.md new file mode 100644 index 000000000..8c89ad9bc --- /dev/null +++ b/doc/webhook/webhook.md @@ -0,0 +1,105 @@ +# Validating admission webhook + +## Building Docker image + +From the root directory of Multus execute: +``` +cd webhook +./build +``` + +## Deploying webhook application + +Change working directory. From the root directory of Multus execute: +``` +cd deployment/webhook +``` + +Create key and certificate pair and patch configuration-template.yaml file with base64-encoded certificate file. Run: +``` +./certs.sh +``` +*Note: Script generates private key and certificate signing request, which is then pushed to the Kubernetes API server. Next, script approves that CSR and API server issues the certificate. Certificate is obtained from the API server and used to create a secret. Script also patches `configuration-template.yaml` file with base64-encoded certificate and creates `configuration.yaml` file containing Validating Webhook Configuration specification, which is deployed in the next steps. +Certificates API needs to be enabled in order to generate certificate signed by cluster CA. More information available [here](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/).* + +Create service: +``` +kubectl create -f service.yaml +``` + +Run pod: +``` +kubectl create -f pod.yaml +``` + +Create Validating Webhook Configuration: +``` +kubectl create -f configuration.yaml +``` + +## Verifying installation + +Try to create invalid Network Attachment Definition resource: +``` +cat <