<p>I am trying to follow something similar to the Istio injection model where Istio is able to run a mutating admission webhook in order to auto inject their sidecar.</p>

<p>We would like to do something similar, but with some config maps.  We have a need to mount config maps to all new pods in a given namespace, always mounted at the same path.  Is it possible to create a mutating admission webhook that will allow me to mount this config map at the known path while admitting new pods?</p>

<p>docs to mutating webhooks: <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/</a></p>

<p>This should be entirely possible and is, in fact, an aligned use-case for a custom mutating admission webhook. Unfortunately, the official documentation on actually implementing them is somewhat sparse.</p>

<p><a href="https://github.com/morvencao/kube-mutating-webhook-tutorial" rel="nofollow noreferrer">This is the most useful reference material</a> I found when I was working on <a href="https://github.com/kubernetes-sigs/mutating-trace-admission-controller" rel="nofollow noreferrer">this mutating admission webhook</a>.</p>

<p>The general process is as follows:</p>

<ol>
<li>Generate and deploy certificates <a href="https://github.com/morvencao/kube-mutating-webhook-tutorial#deploy" rel="nofollow noreferrer">as demonstrated here</a></li>
<li>Deploy <a href="https://github.com/kubernetes-sigs/mutating-trace-admission-controller/blob/master/deploy/base/mutatingwebhook.yaml" rel="nofollow noreferrer">MutatingWebhookConfiguration</a> to your cluster. This configuration allows us to tell the API server where to send the <code>AdmissionReview</code> objects. This is also where you should specify which operations on which API resources in which namespaces you want to target.</li>
<li>Write the actual webhook server, which should accept <code>AdmissionReview</code> objects at the specified endpoint (<code>/mutate</code> is the convention) and return <code>AdmissionResponse</code> objects with the mutated object, <a href="https://github.com/kubernetes-sigs/mutating-trace-admission-controller/blob/589ff8723d1bc632c0ba2bb55313986db126d750/webhook.go#L85" rel="nofollow noreferrer">as is shown here</a> (note: in the linked example, I added an annotation to incoming pods that fit a certain criteria, while your application would add a field for the <code>ConfigMap</code>)</li>
<li>Deploy the webhook server and expose it using normal methods (<code>Deployment</code> and <code>Service</code>, or whatever fits your use case). Make sure it's accessible at the location you specified in the configuration for the <code>MutatingWebhookConfiguration</code></li>
</ol>

<p>Hope this was enough information! Let me know if I left anything too vague / was unclear.</p>
