如何在kubernetes中获取启用的准入控制器列表？

Question

AFAIK，准入控制器是登顶数据库之前的最后一关，但是我不知道启用了哪一个，那么我们是否有办法知道哪个正在生效？

谢谢

Answer 1

没有直接暴露的admissionscontroller k8s对象kubectl。

要获取准入控制器列表，您必须使用 k8s 安装支持的正确版本直接访问 k8s master API：

kubectl get --raw /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations | jq

对于我们的环境，我们运行开放策略代理作为准入控制器，我们可以在此处看到 webhook 对象：

kubectl get --raw /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations | jq '.items[] | select(.metadata.name=="open-policy-agent-latest-helm-opa")'

输出 JSON 对象：

{
  "metadata": {
    "name": "open-policy-agent-latest-helm-opa",
    "selfLink": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/open-policy-agent-latest-helm-opa",
    "uid": "02139b9e-b282-4ef9-8017-d698bb13882c",
    "resourceVersion": "150373119",
    "generation": 93,
    "creationTimestamp": "2021-03-18T06:22:54Z",
    "labels": {
      "app": "open-policy-agent-latest-helm-opa",
      "app.kubernetes.io/managed-by": "Helm",
      "chart": "opa-1.14.6",
      "heritage": "Helm",
      "release": "open-policy-agent-latest-helm-opa"
    },
    "annotations": {
      "meta.helm.sh/release-name": "open-policy-agent-latest-helm-opa",
      "meta.helm.sh/release-namespace": "open-policy-agent-latest"
    },
    "managedFields": [
      {
        "manager": "Go-http-client",
        "operation": "Update",
        "apiVersion": "admissionregistration.k8s.io/v1beta1",
        "time": "2021-03-18T06:22:54Z",
        "fieldsType": "FieldsV1",
        "fieldsV1": {
          "f:metadata": {
            "f:annotations": {
              ".": {},
              "f:meta.helm.sh/release-name": {},
              "f:meta.helm.sh/release-namespace": {}
            },
            "f:labels": {
              ".": {},
              "f:app": {},
              "f:app.kubernetes.io/managed-by": {},
              "f:chart": {},
              "f:heritage": {},
              "f:release": {}
            }
          },
          "f:webhooks": {
            ".": {},
            "k:{\"name\":\"webhook.openpolicyagent.org\"}": {
              ".": {},
              "f:admissionReviewVersions": {},
              "f:clientConfig": {
                ".": {},
                "f:caBundle": {},
                "f:service": {
                  ".": {},
                  "f:name": {},
                  "f:namespace": {},
                  "f:port": {}
                }
              },
              "f:failurePolicy": {},
              "f:matchPolicy": {},
              "f:name": {},
              "f:namespaceSelector": {
                ".": {},
                "f:matchExpressions": {}
              },
              "f:objectSelector": {},
              "f:rules": {},
              "f:sideEffects": {},
              "f:timeoutSeconds": {}
            }
          }
        }
      }
    ]
  },
  "webhooks": [
    {
      "name": "webhook.openpolicyagent.org",
      "clientConfig": {
        "service": {
          "namespace": "open-policy-agent-latest",
          "name": "open-policy-agent-latest-helm-opa",
          "port": 443
        },
        "caBundle": "LS0BLAH="
      },
      "rules": [
        {
          "operations": [
            "*"
          ],
          "apiGroups": [
            "*"
          ],
          "apiVersions": [
            "*"
          ],
          "resources": [
            "namespaces"
          ],
          "scope": "*"
        }
      ],
      "failurePolicy": "Ignore",
      "matchPolicy": "Exact",
      "namespaceSelector": {
        "matchExpressions": [
          {
            "key": "openpolicyagent.org/webhook",
            "operator": "NotIn",
            "values": [
              "ignore"
            ]
          }
        ]
      },
      "objectSelector": {},
      "sideEffects": "Unknown",
      "timeoutSeconds": 20,
      "admissionReviewVersions": [
        "v1beta1"
      ]
    }
  ]
}

您可以从上面看到clientConfigk8s 中的端点，这是准入有效负载发送到的地方。跟踪为该端点提供服务的 Pod 日志，您将看到正在处理您的准入请求。

要获取变异的 Webhook，请再次点击感兴趣的 API 版本：

# get v1 mutating webhook configurations
kubectl get --raw /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations | jq

Answer 2

kube-apiserver 正在您的 kube-apiserver-<example.com> 容器中运行。该应用程序目前没有获取已启用的准入插件的 get 方法，但您可以从其命令行获取启动参数。

kubectl -n kube-system describe po kube-apiserver-example.com

另一种方式，查看容器中的内容：不幸的是，容器中没有“ps”命令，但您可以从 /proc 获取初始进程命令参数，如下所示：

kubectl -n kube-system exec kube-apiserver-example.com -- sed 's/--/\n/g' /proc/1/cmdline

它可能是这样的：

enable-admission-plugins=NodeRestriction