Dynamic Admission Webhooks Overview

    Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission webhook and mutating admission webhook. With validating admission webhooks, you may reject requests to enforce custom admission policies. With mutating admission webhooks, you may change requests to enforce custom defaults.

    Istio uses for validating Istio configuration and MutatingAdmissionWebhooks for automatically injecting the sidecar proxy into user pods.

    See the platform setup instructions for Kubernetes provider specific setup instructions. Webhooks will not function properly if the cluster is misconfigured. You can follow these steps once the cluster has been configured and dynamic webhooks and dependent features are not functioning properly.

    1. Verify you’re using a (1.19, 1.20, 1.21, 1.22) of kubectl and of the Kubernetes server:

    2. Verify MutatingAdmissionWebhook and ValidatingAdmissionWebhook plugins are listed in the . Access to this flag is .

    3. Verify the Kubernetes api-server has network connectivity to the webhook pod. e.g. incorrect http_proxy settings can interfere api-server operation (see related issues here and for more information).