diff --git a/kata-webhook/README.md b/kata-webhook/README.md index 41286530c..7797dad4d 100644 --- a/kata-webhook/README.md +++ b/kata-webhook/README.md @@ -1,6 +1,6 @@ # Kata Admission controller webhook -Implement a simple admission controller webhook to annotate pods with the +Implement a simple admission controller webhook to annotate pods with the Kata runtime class. ## How to build the admission controller @@ -17,7 +17,7 @@ controller. $ docker build -t quay.io/kata-containers/kata-webhook-example:latest -f Dockerfile . ``` -> **Note:** +> **Note** > Image needs to be published for the webhook needs to work. Alternately > on a single machine cluster change the `imagePullPolicy` to use the locally > built image. @@ -30,16 +30,19 @@ by default, except for workloads we know for sure will not work with Kata, use the [admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) and sample admission controller we created by running the commands below: -> **Note:** +> **Note** +> > By default, the `runtimeClass` name used in this webhook is `kata`. If your > cluster is configured with another `runtimeClass`, you'll need to change the > value of the `RUNTIME_CLASS` environment variable defined in the -> [webhook file](deploy/webhook.yaml). You can manually edit the file or use -> the `yq` tool. E.g: -> `~/go/bin/yq w -i webhook.yaml spec.template.spec.containers[0].env[0].value "kata-clh"` +> [webhook file](deploy/webhook.yaml). You can manually edit the file or run: +> +> `export RUNTIME_CLASS=<>` +> +> `kubectl create cm kata-webhook --from-literal runtime_class=$RUNTIME_CLASS` ```bash -$ ./create_certs.sh +$ ./create-certs.sh $ kubectl apply -f deploy/ ``` @@ -51,8 +54,7 @@ $ ./webhook-check.sh ``` The webhook mutates pods to use the Kata runtime class for all pods except -those with +those with -* `hostNetwork: true` +* `hostNetwork: true` * namespace: `rook-ceph` and `rook-ceph-system` -