Label Guardian 🛡️

A Kubernetes Mutating Webhook that automatically adds missing labels to Pods.

It acts as a "helpful wizard" – instead of rejecting Pods that are missing the required allow=yes label, it patches the Pod definition to include it.

Features

• Mutating Webhook: Intercepts Pod creation requests.
• JSONPatch: Uses JSON Patch to modify Pod objects on the fly.
• Auto-Labeling: Automatically adds allow=yes if missing or incorrect.
• Secure: Runs over HTTPS with certificates managed by cert-manager.

Prerequisites

• A Kubernetes cluster (Kind, Minikube, GKE, etc.)
• kubectl installed and configured.
• cert-manager installed in the cluster (required for certificate generation).

Usage

1. Build and Test

Run unit tests:

make test

Build the binary locally:

make build

2. Deploy to Kubernetes

First, build the Docker image. If you are using Kind, you don't need to push to a registry, but you need to load the image.

make docker-build
# If using Kind: kind load docker-image label-guardian:v1

Deploy the webhook and manifests:

make deploy

This command applies deploy.yaml, which converts:

1. Issuer & Certificate: Sets up a self-signed CA and generates a certificate for the webhook.
2. Deployment:Deploys the label-guardian pod.
3. Service: Exposes the webhook within the cluster.
4. MutatingWebhookConfiguration: Registers the webhook with the API server.

3. Verification

Deploy a Pod without the label:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: nginx:alpine

kubectl apply -f test-pod.yaml

Check the labels:

kubectl get pod test-pod --show-labels

You should see allow=yes automatically added!

Structure

• cmd/label-guardian: Main entry point.
• pkg/webhook: Webhook logic and testing.
• deploy.yaml: Kubernetes manifests.
• Makefile: Build automation.