How to skip Kubernetes Controller requests from ValidatingWebhook

Question

When using Kubernetes Admission Controllers ValidatingWebhookConfiguration, I'd like to skip the interception of internal requests such as Kubernetes Controllers.

More specifically, the only requests that I want the validation webhook to match are users' requests via the Kubctl/API, etc.

Is it possible?

Answer 1

According to Webhook request and response your webhook will receive an AdmissionRequest object which contains UserInfo field. In it, there are fields like Username, Groups and others that might be useful for solving your problem.

...
    "userInfo": {
      # Username of the authenticated user making the request to the API server
      "username": "admin",
      # UID of the authenticated user making the request to the API server
      "uid": "014fbff9a07c",
      # Group memberships of the authenticated user making the request to the API server
      "groups": ["system:authenticated","my-admin-group"],
      # Arbitrary extra info associated with the user making the request to the API server.
      # This is populated by the API server authentication layer and should be included
      # if any SubjectAccessReview checks are performed by the webhook.
      "extra": {
        "some-key":["some-value1", "some-value2"]
      }
    },
...