Validating webhook

As explained in Effective Platform Engineering

A validating webhook is an HTTP callback that examines a requested resource operation and accepts or rejects it before the operation proceeds.

A validating webhook is an HTTP callback used by a Kubernetes admission controller to inspect a requested deployment operation and accept or reject it before the change proceeds. section 4.1.1

Use it to separate compliance work from compliance verification. Rather than rescanning an image, the webhook can compare its commit SHA with an authoritative vulnerability-scan record. It can also enforce required deployment labels directly. section 4.1.1

Deployment admission check

A reusable pipeline performs the vulnerability scan, while a validating webhook blocks deployment when the image lacks a successful scan record or the deployment omits required labels. Gatekeeper can provide the admission-control implementation. section 4.1.1

Figure 4.3 Kubernetes admission controller

Inspect the Kubernetes admission-controller flow that intercepts deployments for verification. section 4.1.1

Figure 4.4 Admission controller built using Gatekeeper (https://github.com/open-policy-agent/gatekeeper), which checks for labels on the deployment

Inspect a Gatekeeper-based admission controller enforcing deployment labels. section 4.1.1

How Effective Platform Engineering covers it

How deep it goes

Explains admission-time checks, authoritative scan evidence, and label enforcement, but does not detail webhook implementation code.

Examples

Uses image commit SHAs, vulnerability-scan logs, required deployment labels, and Gatekeeper as concrete enforcement examples.

What it assumes

Assumes familiarity with deployments, environments, compliance work, and reusable delivery pipelines.

What you can do after

Operate/configure Kubernetes admission controls that verify deployment evidence and required resource configuration.

How it connects

Connects admission controllers with compliance verification, vulnerability scanning, deployment labels, and reusable pipeline code.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Related concepts

• admission controllerused by · A Kubernetes admission controller intercepts API requests after authentication and authorization, validating or mutating them before they are persisted.
• runAsNonRootaddresses · runAsNonRoot is a Kubernetes security-context setting that requires a container process to run as a non-root user.
• webhookkind of · A webhook is an HTTP callback mechanism that sends event-related information to a configured endpoint when a specified event occurs.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.