When do I need to enable admission webhook?

[jeonggoo]

I've been looking into the webhook and K8s operator. It seems kubebuilder disables the webhook by default. Even the webhook is disabled, K8s operator's reconcile loop is still invoked. Can you please explain (or point out a document) what is the role (add-on) of webhook to K8s operator? Does the webhook add only Defaulter and (or) the Validator?

How does K8s operator reconcile loop is invoked in general (w/o the webhook)? I like to avoid the webhook and cert-manager if it's possible.

[camilamacedo86]

Hi jeonggoo,

Webhooks allow you to sort out some problems such as to validate/mutate when the resources are admitted, see: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/

Also, you can check out the Kubebuilder tutorial: https://book.kubebuilder.io/cronjob-tutorial/webhook-implementation.html

Therefore, you do not use them by default at all or to address any scenario/use case. You can create an API and do the reconciliation without them.

I'd like to recommend you check out both following links and I hope that they help you out getting started and better understand how things work( I am assuming here that you are getting started and we are overwhelmed to know what/how to accomplish the goals.). I hope that they will help out skill up faster.

• https://dev4devs.com/2020/08/16/how-to-getting-started-develop-go-operators-from-scratch-with-sdk-1-0/
• https://sdk.operatorframework.io/docs/best-practices/common-recommendation/.

[camilamacedo86]

Closing since it is answered.