Open Policy Agent (OPA) Gatekeeper provides a powerful policy management tool that extends Kubernetes with customizable admission controllers and audits. Its mutating webhook capability in particular enables the automatic modification of Kubernetes resources to enforce consistency, security, or compliance requirements before resources are persisted in the cluster. One technique within mutating webhooks involves the annotation or label set with a slash (`/`). In this article, we'll delve into this feature, with technical explanations and examples to illustrate its use.

Understanding Annotations and Labels in Kubernetes

Annotations and labels are both key-value pairs associated with Kubernetes objects, but they serve different purposes. Labels are often used for selection and grouping, while annotations provide additional metadata and are not queryable.

• Labels: Attach identifying metadata; used for operational functions like grouping and selecting resources.
• Annotations: Apply non-identifying metadata. Examples include build info, contact details, release notes, etc.

The Role of Mutating Webhooks

Mutating webhooks play a critical role in modifying or adding to the incoming requests within the Kubernetes API. MutatingWebhookConfiguration resources specify the configuration of these webhooks, allowing dynamic changes to be enforced during the admission phase.

Gatekeeper lets you use these mutations to apply annotations or labels automatically to requests. This involves setting up rules that, when matched, execute specified mutations on incoming resources. An example use case might be auto-adding the date and user responsible for resource creation.

Using Slashes in Annotation/Label Keys

Annotations and labels formatted with slash (e.g., `example.com/version`) help organize metadata under a logical namespace, avoiding conflicts with future Kubernetes fields and helping with clarity. It also signifies a convention of organizing or grouping related key-value pairs.

Example: Applying Annotations with a Slash

Let’s go through a practical example of using a mutating webhook to apply an annotation with a slash.

• target: admission.k8s.gatekeeper.sh
• We define whether the annotation `example.com/version` is present.
• If not, a violation message is presented, indicating this requirement.
  • groups: [""]
• Namespace Convention: Indicates controlled namespaces (e.g., `company.com/resource`).
• Collision Avoidance: Reduces risks related to key collision with native Kubernetes attributes.
• Portability: Helps in structuring annotations, allowing them to be easily understood across systems.