Exercise: registry allow-list through ImagePolicyWebhook

Host: controlplane (root) · Time: 20 min · Domain: Supply Chain Security

Task

• Only images from registry.example.com/ may be admitted.
• Implement it with the ImagePolicyWebhook admission plugin talking to the provided webhook service.
• A Pod with nginx:1.27 must be rejected.

Acceptance criteria

• kubectl run bad --image=nginx:1.27 is denied with a message mentioning the image policy webhook.
• kubectl run good --image=registry.example.com/ok:1.0 is accepted.
• The API server is healthy after the change.

Solution

# /etc/kubernetes/admission/admission-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: ImagePolicyWebhook
  configuration:
    imagePolicy:
      kubeConfigFile: /etc/kubernetes/admission/imagepolicy.kubeconfig
      allowTTL: 50
      denyTTL: 50
      retryBackoff: 500
      defaultAllow: false

# kube-apiserver.yaml
    - --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook
    - --admission-control-config-file=/etc/kubernetes/admission/admission-config.yaml
    volumeMounts:
    - {name: admission, mountPath: /etc/kubernetes/admission, readOnly: true}
  volumes:
  - {name: admission, hostPath: {path: /etc/kubernetes/admission, type: DirectoryOrCreate}}

The kubeconfig must point at the webhook with a client certificate the webhook
trusts, and the webhook must be reachable from the node's network, not just
from inside a Pod.

defaultAllow: false = fail closed. If the webhook is down, everything is denied —
which is the correct security posture and a deliberate exam point.