ALB Ingress Controller Webhook校验方案-容器服务 Kubernetes 版 ACK(ACK)-阿里云帮助中心

在ALB Ingress Controller 2.15.0版本中，我们引入了Webhook校验服务，通过Admission Webhooks在API层面验证配置，提前拦截错误或不合规配置并提供明确的错误提示，从而防止因格式错误导致的调谐失败不能及时发现。本文将为您介绍Webhook校验服务的原理及常见报错示例。

实现原理

动态准入控制器 (Admission Webhooks)

自Kubernetes 1.9版本开始，支持动态准入控制器功能中的Admission Webhooks。您可以通过组件的形式对API Server的请求进行访问控制。API Server在请求通过认证和授权后、对象被持久化之前，会拦截该请求并调用Webhook服务进行准入控制。
Webhook校验的优势
- 尽早拦截：通过Webhook在API层面早期拦截错误或不合规的配置，减少不必要的资源创建尝试和潜在的集群状态混乱，避免资源调度、网络配置等后续步骤的浪费。
- 解耦逻辑：将验证逻辑放在Webhook中，使Controller的逻辑更加专注于资源的实际部署和管理，遵循单一职责原则，使系统各部分更加模块化，易于维护和扩展。
- 增强安全性：将YAML验证逻辑放在独立的Webhook服务中，允许对进入集群的资源请求进行集中管理和控制，减少恶意或错误配置的风险。
- 错误配置感知：在参数错误时，Webhook校验服务能够早期拦截并为您提供清晰的错误提示，便于快速定位和修正问题。
Webhook主要组件
- ValidatingAdmissionWebhook：定义在API Server接收到Ingress资源创建或更新请求时调用的Webhook URL，指定哪些操作和资源会触发Webhook校验。在ALB Ingress Controller部署时一同部署。
- TLS证书：确保API Server与Webhook服务之间的通信通过TLS加密。
- Webhook Service：解析传入的AdmissionReview请求，对Ingress资源定义进行校验并生成一个AdmissionResponse。

Webhook拦截提示

Webhook拦截提示示例

以下是一个Ingress YAML错误配置示例。由于listen-ports注解存在格式错误，Webhook校验服务会识别该错误并返回具体的报错信息，以便您及时修正。
- 错误提示为当前请求未通过准入控制校验，详细信息为 admission webhook "ingress.alb.validate.k8s.io" denied the request: webhook validate ingress test: failed to parse listen-ports configuration: '[{"HTTP": 80},{"HTTPS": 443}]': invalid character ']' after object key:value pair，错误码为 APISERVER.403。
- 黑屏报错信息：
```
[root@iZxxxZ test]# kubectl apply -f test-ingress.yaml
Error from server (webhook validate ingress alb-ingress: failed to parse listen-ports configuration: `[{"HTTP": 80},{"HTTPS": 443}]`: invalid character ']' after object key:value pair): error when creating "test-ingress.yaml": admission webhook "ingress.alb.validate.k8s.io" denied the request: webhook validate ingress alb-ingress: failed to parse listen-ports configuration: `[{"HTTP": 80},{"HTTPS": 443}]`: invalid character ']' after object key:value pair
```
请求没有通过准入控制验证。admission webhook "ingress.alb.validate.k8s.io"拒绝了请求，错误原因是监听端口配置中的数组元素后有不合法字符"]"。

以下是更多AlbConfig和Ingress校验报错提示。

资源类型	报错类型	报错提示
AlbConfig	albconfig unmarsh失败	webhook validate albconfig alb: Unmarshal error : %v Please check the format of albconfig yaml
	监听端口错误	webhook validate albconfig alb: listener port number mustbetween [1:65535], or you should set listen port explicitly in listener config. Error listen port : 0
	监听协议错误	webhook validate albconfig alb: listener protocol is invalid : HTTPP, or you should set listen protocol explicitly in listener config. Please set protocol value HTTP or HTTPS or QUIC
	日志logstore格式校验	webhook validate albconfig alb: logstore name should start with alb_
	tag格式校验	webhook validate albconfig alb: empty tag key/value is invalid
	IP地址类型校验	the value Interne is invalid. Please set the value as one of: [Internet Intranet]
	IPv6地址类型校验	the value Interne is invalid. Please set the value as one of: [Internet Intranet]
	IP地址模式类型校验	the value Dynamicc is invalid. Please set the value as one of: [Dynamic Fixed]
	实例规格类型校验	the value Standardd is invalid. Please set the value as one of: [Basic Standard StandardWithWaf]
	访问控制	webhook validate albconfig alb: aclEntry and aclIds cannot use together in listener
Ingress	backend-scheduler	the value of alb.ingress.kubernetes.io/backend-scheduler annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [wrr wlc sch uch]
	backend-protocol	the value of alb.ingress.kubernetes.io/backend-protocol annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [HTTP HTTPS gRPC]
	healthcheck-protocol	the value of alb.ingress.kubernetes.io/healthcheck-protocol annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [HTTP HTTPS TCP gRPC]
	healthcheck-method	the value of alb.ingress.kubernetes.io/healthcheck-method annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [GET HEAD POST]
	healthcheck-httpcode	the value of alb.ingress.kubernetes.io/healthcheck-httpcode annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [http_2xx http_3xx http_4xx http_5xx]
	healthcheck-httpversion	the value of alb.ingress.kubernetes.io/healthcheck-httpversion annotation is invalid : test. the value wlcc is invalid. Please set the value as one of: [HTTP1.1 HTTP1.0]
	listen-port格式错误	webhook validate ingress ingress: check ingress listen port invalid
	path不能包含^	webhook validate ingress ingress: path is invalid because path contains ^ character
	自定义转发动作unmarsh失败	webhook validate ingress test: the value of actions annotation is invalid