How a Webhook Works

Webhooks are deployed as Pods in the Kubernetes cluster, and the Kubernetes API server calls them over SSL using the AdmissionReview object. This object defines the AdmissionRequest and AdmissionResponse objects. The webhook reads the request payload from the AdmissionRequest object and provides the success flag and optional changes in the AdmissionResponse object.

The following is a top-level definition of the AdmissionReview object. Note that AdmissionRequest and AdmissionResponse are both part of the AdmissionReview object. The following is an excerpt from the definition of the AdmissionReview object in the Kubernetes source code:

// AdmissionReview describes an admission review request/response.
type AdmissionReview struct {
    metav1.TypeMeta `json:",inline"`
    // Request describes the attributes for the admission request.
    // +optional
    Request *AdmissionRequest...