# webhook

Published articles for webhook.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## kube-apiserver / Kubernetes 控制面内核：storage、cacher、Admission 与 APF

DevFeed: [kube-apiserver / Kubernetes 控制面内核：storage、cacher、Admission 与 APF](<https://devfeed.tech/articles/kube-apiserver-kubernetes-storage-cacher-admission-apf-33974.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/index.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: article

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [etcd](<https://devfeed.tech/topics/etcd.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [API](<https://devfeed.tech/topics/api.md>), [site-reliability-engineering](<https://devfeed.tech/topics/site-reliability-engineering.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [rbac](<https://devfeed.tech/topics/rbac.md>)

Tags: [admission](<https://devfeed.tech/tags/admission.md>), [apf](<https://devfeed.tech/tags/apf.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cacher](<https://devfeed.tech/tags/cacher.md>), [control-plane](<https://devfeed.tech/tags/control-plane.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [etcd](<https://devfeed.tech/tags/etcd.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pagination](<https://devfeed.tech/tags/pagination.md>), [plan](<https://devfeed.tech/tags/plan.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [resourceversion](<https://devfeed.tech/tags/resourceversion.md>), [storage](<https://devfeed.tech/tags/storage.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [watch](<https://devfeed.tech/tags/watch.md>), [watch-cache](<https://devfeed.tech/tags/watch-cache.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

This article introduces a 16-part series on the kube-apiserver production request path, covering storage.Interface and etcd3, resourceVersion, watch cache behavior, List and Watch operations, Admission and Webhooks, authentication, authorization, auditing, APF, and extension boundaries. It explains how to distinguish failures across these layers and when to investigate kube-apiserver instead of directly querying etcd. The discussion is anchored to Kubernetes v1.30.3 and etcd v3.5.33, with experiments explicitly noted as not yet run.

### Source excerpt

补齐 etcd 系列 K8s 耦合篇之上的 kube-apiserver 生产内核：storage.Interface、watch cache、resourceVersion、Admission/Webhook、APF，并以排障与相对 etcd 的分层收束。

## 【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界

DevFeed: [【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界](<https://devfeed.tech/articles/kube-apiserver-admission-webhook-33964.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/08-admission-chain/08-admission-chain.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [admission](<https://devfeed.tech/tags/admission.md>), [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [authz](<https://devfeed.tech/tags/authz.md>), [controllers](<https://devfeed.tech/tags/controllers.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [mutating](<https://devfeed.tech/tags/mutating.md>), [namespace-lifecycle](<https://devfeed.tech/tags/namespace-lifecycle.md>), [openapi](<https://devfeed.tech/tags/openapi.md>), [resourcequota](<https://devfeed.tech/tags/resourcequota.md>), [timeout](<https://devfeed.tech/tags/timeout.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [validating](<https://devfeed.tech/tags/validating.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

This tutorial explains the Kubernetes v1.30.3 admission chain in kube-apiserver. It places Admission between authorization and storage, describes the Mutating-then-Validating order, and covers built-in plugins, webhooks, timeout behavior, and fail-open versus fail-closed considerations.

### Source excerpt

钉 Kubernetes v1.30.3 Admission 链的阶段位置、Mutating 与 Validating 两阶段顺序、内置插件注册路径与典型示例、webhook 边界与 timeout 语义，以及 fail-open vs fail-closed 的工程争议。

## 【kube-apiserver】CRD / aggregation / 扩展边界：API 扩展停损线

DevFeed: [【kube-apiserver】CRD / aggregation / 扩展边界：API 扩展停损线](<https://devfeed.tech/articles/kube-apiserver-crd-aggregation-api-33969.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/13-extension-boundary/13-extension-boundary.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: article

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [API](<https://devfeed.tech/topics/api.md>), [etcd](<https://devfeed.tech/topics/etcd.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [aggregation](<https://devfeed.tech/tags/aggregation.md>), [api](<https://devfeed.tech/tags/api.md>), [api-server](<https://devfeed.tech/tags/api-server.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [apiservice](<https://devfeed.tech/tags/apiservice.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [crd](<https://devfeed.tech/tags/crd.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [etcd](<https://devfeed.tech/tags/etcd.md>), [extension](<https://devfeed.tech/tags/extension.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [v1](<https://devfeed.tech/tags/v1.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [v3-5](<https://devfeed.tech/tags/v3-5.md>), [v3-5-33](<https://devfeed.tech/tags/v3-5-33.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

This article explains the boundary between Kubernetes CRD and Aggregated API extension paths in kube-apiserver. CRD requests remain within the apiserver and use its storage and admission paths, while Aggregated API requests are proxied to an external Extension Server. The two paths have different failure modes and troubleshooting points, although both can appear as 503 errors or timeouts.

### Source excerpt

厘清 CRD v1 与 Aggregated API 两条扩展路径在 kube-apiserver 中的存储与请求分界：CRD 对象存 etcd、conversion webhook 失败如何体现在 Storage 轴，APIService 则把请求转发到外部 Extension Server 可引发 503。明确 scheduler/controller/kubelet 为扩展停损线之外的数据面与控制循环。

## 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门

DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门](<https://devfeed.tech/articles/kube-apiserver-mutating-validating-webhook-timeout-failurepolicy-33965.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/09-webhooks/09-webhooks.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [dry-run](<https://devfeed.tech/topics/dry-run.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [admission](<https://devfeed.tech/tags/admission.md>), [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [cel](<https://devfeed.tech/tags/cel.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kyverno](<https://devfeed.tech/tags/kyverno.md>), [mutating](<https://devfeed.tech/tags/mutating.md>), [timeout](<https://devfeed.tech/tags/timeout.md>), [tls](<https://devfeed.tech/tags/tls.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [validating](<https://devfeed.tech/tags/validating.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag.

### Source excerpt

钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。

## 【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列

DevFeed: [【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列](<https://devfeed.tech/articles/kube-apiserver-authorization-audit-rbac-sar-403-33967.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/11-authz-audit/11-authz-audit.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [audit](<https://devfeed.tech/topics/audit.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [403](<https://devfeed.tech/tags/403.md>), [admission](<https://devfeed.tech/tags/admission.md>), [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [authz](<https://devfeed.tech/tags/authz.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [etcd](<https://devfeed.tech/tags/etcd.md>), [http](<https://devfeed.tech/tags/http.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [policy](<https://devfeed.tech/tags/policy.md>), [post](<https://devfeed.tech/tags/post.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [subjectaccessreview](<https://devfeed.tech/tags/subjectaccessreview.md>), [v1](<https://devfeed.tech/tags/v1.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

This tutorial explains Kubernetes v1.30.3 authorization and auditing. It distinguishes the RBAC, Node, Webhook, and legacy ABAC authorizer paths; describes SAR and SSAR access checks; outlines audit policies and stages; and explains why user-facing 403 errors come from Kubernetes authorization rather than etcd permissions or Admission failures.

### Source excerpt

钉 K8s v1.30.3 的授权链：RBAC、Node、Webhook、ABAC（遗留）；SubjectAccessReview / SelfSubjectAccessReview 用法；Audit policy 四级；403 与 etcd 权限错误、Admission 拒绝的分列；不把 etcd 的 mTLS 错误写成 K8s RBAC 故障。

## A Repository Graveyard

DevFeed: [A Repository Graveyard](<https://devfeed.tech/articles/a-repository-graveyard-37834.md>)

Original publisher: [Read original article](<https://carlosbecker.com/posts/repositories-graveyard/>)

Author: Carlos Alexandro Becker

Published: 2017-09-04T00:00:00Z

Content type: article

Language: en

Sources: [Carlos Becker](<https://devfeed.tech/sources/carlos-becker.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Code](<https://devfeed.tech/topics/code.md>), [opensource](<https://devfeed.tech/topics/opensource.md>)

Tags: [deprecated](<https://devfeed.tech/tags/deprecated.md>), [github](<https://devfeed.tech/tags/github.md>), [opensource](<https://devfeed.tech/tags/opensource.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [repository](<https://devfeed.tech/tags/repository.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

### AI overview

A developer describes cleaning up a long-used GitHub profile by moving abandoned repositories to a graveyard organization, deleting empty scaffolds, and updating a fork-cleaner utility. The process reduced the account from roughly 270 repositories to 54 and led to a webhook that responds to new issues and pull requests on unmaintained repositories.

### Source excerpt

This past weekend I decided I need to clean up my GitHub profile. In this post I'll write about why I cleaned everything up and also how I did, as well as some initial results.