<p>As described <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">here</a>, this is a <a href="https://github.com/kubernetes/kubernetes/blob/v1.13.0/test/images/webhook/main.go" rel="nofollow noreferrer">reference implementation</a> of a webhook server as used in kubernetes e2e test. In the <code>main</code> function, a number of endpoints have been defined to handle different requests for mutation. However, there is no clear <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#contacting-the-webhook" rel="nofollow noreferrer">documentation</a> as to which endpoint gets invoked when.</p>

<p>So, how do we know which endpoint is invoked when?</p>

<p>I see you are trying to understand what is the ordering of execution of mutating webhooks.</p>

<p>I have found <a href="https://github.com/kubernetes/kubernetes/blob/3edbc6afff17ea8dfe5c10b2677dcdc8767f67e2/staging/src/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager.go#L83-L86" rel="nofollow noreferrer">this piece of code in kubernetes repo</a>. Based on this you can see that these are sorted by name of a webhook to have a deterministic order.</p>

<p>A single ordering of mutating admissions plugins (including webhooks) does not work for all cases, so take a look at <a href="https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/00xx-admission-webhooks-to-ga.md#mutating-plugin-ordering" rel="nofollow noreferrer">mutating plugin ordering</a> section in Admission webhook proposal for explanation how its handled.</p>

<p>Also notice there are no "pod only endpoints" or "endpoints that get called for pods". Let's say you have your webhook server and want to mutate pods and your server has only one endpoint: <code>/</code>. If you want to mutate pods with it you need to specify it under <code>rules</code>. So setting <code>rules[].resources: ["pods"]</code> and <code>rules[].operations: ["CREATE"]</code> in your webhook config will run your mutating webhook whenever there is pod to be created.</p>

<p>Let me know it it helped.</p>
