# 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门

DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门](<https://devfeed.tech/articles/kube-apiserver-mutating-validating-webhook-timeout-failurepolicy-33965.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/09-webhooks/09-webhooks.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [dry-run](<https://devfeed.tech/topics/dry-run.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [admission](<https://devfeed.tech/tags/admission.md>), [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [cel](<https://devfeed.tech/tags/cel.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kyverno](<https://devfeed.tech/tags/kyverno.md>), [mutating](<https://devfeed.tech/tags/mutating.md>), [timeout](<https://devfeed.tech/tags/timeout.md>), [tls](<https://devfeed.tech/tags/tls.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [validating](<https://devfeed.tech/tags/validating.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

## AI overview

A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag.

## Source excerpt

钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。