Create a Mutating Admission Controller Webhook with Terraform

1.25 hours
  • 4 Learning Objectives

About this Hands-on Lab

In this lab, you will create and deploy a mutating webhook, along with its configuration. First, you will create the webhook Docker image from the provided code. Then, you will update the webhook deployment Terraform code with the image and deploy the mutating webhook. Next, you will apply the webhook registration code to finish up the deployment. Finally, you will create a couple of test Pods to confirm your mutating webhook is working as expected.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Lab Setup
  1. Move to the mutating-admission-webhook directory.

  2. Create an access key in the AWS Management Console. (You need to copy the Access key and Secret access key and keep them somewhere safe and accessible for the next step).

  3. Make the script executable.

  4. Run the script. (Note: This script will run for about 10–15 minutes.)

Create the Webhook Docker Image

Note: Make sure you have set up your Docker Hub account before doing this objective.

  1. Move into the mutating-webhook directory.

  2. Log in to Docker Hub from the command line.

  3. Update the Makefile with your Docker Hub username.

  4. Build the mutating webhook. (Note: This can take between 5–10 minutes.)

  5. Build the Docker image.

  6. Push the Docker image to Docker Hub.

  7. Deploy the required certificates.

Deploy the Mutating Webhook Configuration and Webhook
  1. Update the deployment configuration with your Docker Hub username.

  2. Initialize the working directory.

  3. Apply the configuration.

Test the Mutating Admission Webhook
  1. Create a directory called test-pods.

  2. Move into to test-pods directory.

  3. Use the sample Terraform code to create two test Pods called test-app-1 and test-app-2, and add a label called hello = "universe" to test-app-2.

  4. Initialize your working directory.

  5. Apply the webhook configuration.

  6. Confirm that your mutating webhook is working:

    • test-app-1 should have a hello=world label, even though one was not provided in the configuration.
    • test-app-2 should have a hello=universe label, as you defined in the configuration.

Additional Resources

You will first need to set up the lab, which involves the deployment of an EKS cluster. First, you will build the mutating webhook from the supplied code that is written in Go. Once the Docker image has been built, you will need to push your image to Docker Hub. (Note: If you don't already have one, you will need to create a free Docker Hub account before you start the lab.) You will then update the supplied Terraform configuration with your image and apply the Terraform code to deploy your mutating webhook. You will finish up the lab by creating two test Pods: test-app-1 without a label and test-app-2 with the label hello = "universe". If all goes well, your webhook should add a label to test-app-1 and honor the label set in test-app-2.

Lab Resources

Test Pods Code

Use the following code to help you create the test Pods, modifying it as needed to create test-app-1 and test-app-2 as described above:

terraform {
  required_providers {
    kubernetes = {
      source = "hashicorp/kubernetes"

provider "kubernetes" {
  config_path = "~/.kube/config"

resource "kubernetes_pod" "test_app" {
  metadata {
    name = "test-app"

  spec {
    container {
      name    = "test-app
      image   = "ubuntu:focal"
      command = ["/bin/bash"]
      args    = ["-c", "sleep infinity"]

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started
Who’s going to be learning?