QUESTION 43
You are running a Kubernetes cluster with a deployment for a critical application. The application uses sensitive data stored in a secret. To ensure security, you need to implement a policy that prevents the deployment of pods for this application if the secret containing the sensitive data is missing. How would you implement this using Custom Resource Definitions (CRDs) and Admission Webhooks?
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Create a CRD for Secret Validation:
– Define a Custom Resource Definition (CRD) named ‘SecretValidator’ to specify the required secret for the deployment.
– This CRD will have a ‘spec’ section containing the name of the secret.
2. Create a Validation Webhook Configuration: – Create a ValidatingWebhookConfiguration resource. – Define the ‘rules’ to match the ‘SecretValidatoo CRD and ensure that the webhook is triggered for all operations on the CRD. – Specify the ‘failurePolicy’ as ‘Fail’ to prevent pod deployment if the validation fails. – Provide the ‘admissionReviewVersions’ to indicate the supported API versions. – Set the ‘sideEffects’ to ‘None’ as the webhook only performs validation and does not modify the object.
3. Create the Secret Validation Service: – Create a Deployment for a service that will handle the validation webhook requests. – The service should have a container with a code that checks if the required secret exists in the namespace.
4. Implement the Validation Logic in the Service: – In the code of the secret validation service container, you will need to: – Receive the request from the Kubernetes API server. – Retrieve the ‘secretName’ from the ‘SecretValidator’ CRD. – Check if a secret with that name exists in the namespace. – If the secret exists, allow the pod deployment. – If the secret does not exist, deny the pod deployment and return an error message. package main import ( “context” “encoding/json” “fmt” “io/ioutil” “net/http” metavl “k8s.io/apimachinery/pkg/apis/meta/v1” “k8s.io/apimachinery/pkg/runtime” “k8s.io/apimachinery/pkg/runtime/serializer” “k8s.io/apimachinery/pkg/types” “k8s.io/client-go/kubernetes” “k8s.io/client-go/rest” func main() { // Create a Kubernetes clientset config, err := rest. InClusterConfig() if err != nil { panic(err) clientset, err := kubernetes.NewForConfig(config) if err != nil { panic(err) // Create a scheme for decoding the CRD scheme := runtime.NewScheme() codecs := serializer.NewCodecFactory(scheme) deserializer := codecs.UniversalDeserializer() // Start the HTTP server http.HandleFunc(“/validate”, func(w http.ResponseWriter, r http.Request) { // Read the admission review request body body, err := ioutil.ReadAll(r.Body) if err != nil { http.Error(w, fmt.Sprintf(“Error reading body: %v” err), http.StatuslnternalServerError) return } // Unmarshal the admission review request var admissionReview metavl .AdmissionReview , err = deserializer.Decode(body, nil, &admissionReview) if err != nil { http.Error(w, fmt.Sprintf(“Error decoding admission review: %v”, err), http.StatuslnternalServerError) return } // Unmarshal the admission review request var admissionReview metavl .AdmissionReview , err = deserializer.Decode(body, nil, &admissionReview) if err != nil { http.Error(w, fmt.Sprintf(“Error decoding admission review: %v”, err), http.StatuslnternalServerError) return } // Check if the secret exists , err = clientset.CoreV1 ().Secrets(admissionReview.Request.Namespace).Get(context.TODO(), secretValidator.Spec.SecretName, metavl .GetOptions{}) if err nil { // Secret does not exist, deny the request admissionReview.Response = &metavl .AdmissionResponse{ IJID: admissionReview.Request.UlD, Allowed: false, Result: &metavl .Status{ Status: metavl .StatusFailure, Message: fmt.Sprintf(“Secret %s not found in namespace %s”, secretValidator.Spec.SecretName, admissionReview.Request.Namespace), } } } else { // Secret exists, allow the request admissionReview.Response = &metavl .AdmissionResponse{ UID: admissionReview.Request.UlD, Allowed: true, Result: &metavl .Status{ Status: metavl .StatusSuccess, // Marshal the admission review response response, err := json.Marshal(admissionReview) if err nil { http.Error(w, fmt.Sprintf(“Error marshaling admission review: %v”, err), http.StatuslnternalServerError) return } // Write the response to the client w.WriteHeader(http.StatusOK) w.Write(response) }) // Start the HTTP server on port 8443 http.ListenAndServeTLS(“:8443”, “/path/to/cert.pem”, “/path/to/key.pem”, nil) } // Define the SecretValidator CRD type SecretValidator struct { metav1 .TypeMeta metav1 .ObjectMeta Spec SecretValidatorSpec } type SecretValidatorSpec struct {
} 5. Create a SecretValidator Resource: – Create a ‘SecretValidator’ resource in the same namespace as the deployment. – Set the ‘spec.secretName’ to the name of the required secret.
6. Deploy the Application with the Validation: – Ensure that the deployment for the application is in the same namespace as the ‘SecretValidator’ resource. – The deployment should reference the ‘SecretValidator’ resource in its annotations to trigger the validation webhook.
Note: This setup will only work for deployment creation. For other operations (e.g., updates), you need to update the ‘rules’ in the ‘ValidatingWebhookConfiguration’. You can also extend this solution to validate other resources or create more specific validation policies.]
![100% Free Real Updated CKAD Questions & Answers Pass Your Exam Easily [Q27-Q47]](https://blog.examdumpsvce.com/wp-content/uploads/2026/03/banner-DcixDoIwFAXQna-4i26atlqKI1FcXKyJgzEO79FqMAikD6L-vZ7xOLb5JhAHLnRuCnZ3Zqr_Z502K2WXz-GRaaVm2KcYcYrU4jwEGmPA9lDu4KcoY9N3gjnKTt4xCY4kgks_JVQfeqEiadovrt64hV-7W6Z-.jpg)
