diff --git a/kata-webhook/README.md b/kata-webhook/README.md index 41286530c..0b9d0f0e9 100644 --- a/kata-webhook/README.md +++ b/kata-webhook/README.md @@ -1,6 +1,6 @@ # Kata Admission controller webhook -Implement a simple admission controller webhook to annotate pods with the +Implement a simple admission controller webhook to annotate pods with the Kata runtime class. ## How to build the admission controller @@ -17,7 +17,7 @@ controller. $ docker build -t quay.io/kata-containers/kata-webhook-example:latest -f Dockerfile . ``` -> **Note:** +> **Note** > Image needs to be published for the webhook needs to work. Alternately > on a single machine cluster change the `imagePullPolicy` to use the locally > built image. @@ -30,29 +30,28 @@ by default, except for workloads we know for sure will not work with Kata, use the [admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) and sample admission controller we created by running the commands below: -> **Note:** +> **Note** > By default, the `runtimeClass` name used in this webhook is `kata`. If your > cluster is configured with another `runtimeClass`, you'll need to change the > value of the `RUNTIME_CLASS` environment variable defined in the -> [webhook file](deploy/webhook.yaml). You can manually edit the file or use -> the `yq` tool. E.g: -> `~/go/bin/yq w -i webhook.yaml spec.template.spec.containers[0].env[0].value "kata-clh"` +> [webhook file](deploy/webhook.yaml). You can manually edit the file or run: +> `export RUNTIME_CLASS=<>` +> `kubectl create cm kata-webhook --from-literal runtime_class=$RUNTIME_CLASS` ```bash -$ ./create_certs.sh -$ kubectl apply -f deploy/ +./create-certs.sh +kubectl apply -f deploy/ ``` Afterwards you can run the `webhook-check.sh` script to check the webhook was deployed correctly and is working: ```bash -$ ./webhook-check.sh +./webhook-check.sh ``` The webhook mutates pods to use the Kata runtime class for all pods except -those with +those with -* `hostNetwork: true` +* `hostNetwork: true` * namespace: `rook-ceph` and `rook-ceph-system` -