├── .github └── PULL_REQUEST_TEMPLATE.md ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── LICENSE ├── README.md ├── images └── solution-diagram.png ├── lambda_function.py ├── mutating-webhook.yaml ├── nginx-gcr.yaml └── sam-template.yaml /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | *Issue #, if available:* 2 | 3 | *Description of changes:* 4 | 5 | 6 | By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice. 7 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check [existing open](https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8/issues), or [recently closed](https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aclosed%20), issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *master* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any ['help wanted'](https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8/labels/help%20wanted) issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8/blob/master/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | 61 | We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes. 62 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of 4 | this software and associated documentation files (the "Software"), to deal in 5 | the Software without restriction, including without limitation the rights to 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 7 | the Software, and to permit persons to whom the Software is furnished to do so. 8 | 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 15 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Amazon API Gateway Mutating Webhook For K8S 2 | This demo project is intended to illustrate how to use [Amazon API Gateway](https://aws.amazon.com/api-gateway/) and [AWS Lambda](https://aws.amazon.com/lambda/) to set up an HTTP service, then been integrated with Kubernetes as [admission webhooks](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) to receive admission requests and mutate or validate Kubernetes resources dynamically. Particularly this project will setup a mutating webhook to modify the docker image path in K8S Pod after the deployment been submitted to K8S API server and before it's been persisted in etcd. 3 | 4 | ## Use cases 5 | - The same k8s cluster need to be deployed and use different docker registry, for example k8s cluster deployed in AWS Oregon and Singapore region, and use ECR registry in local region. 6 | - Due to firewall or security restriction, public registry cannot be accessed and need to modify the image path to access other mirrored repositories. 7 | 8 | ## How to deploy 9 | ### Prerequisites 10 | - Make sure that the Kubernetes cluster is at least as new as v1.9. 11 | - Make sure that MutatingAdmissionWebhook admission controllers are enabled. 12 | - Make sure that the admissionregistration.k8s.io/v1beta1 API is enabled. 13 | - If you are using AWS China regions, make sure your AWS account has been whitelisted for API Gateway access, you may contact AWS support for the procedure of the whitelisting. 14 | 15 | Amazon EKS has been enabled MutatingAdmissionWebhook. 16 | 17 | ### Steps to set up admission webhook: 18 | 1. Setup webhook with API GW, there are 2 options to build the API GW: 19 | #### OPTION #1 - Install from SAR(Serverless App Repository) 20 | This is the recommended approach, deploy it from SAR console: 21 | | Region | Click and Deploy | 22 | | :----------------: | :----------------------------------------------------------: | 23 | | **ap-northeast-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-northeast-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 24 | | **ap-east-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-east-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 25 | | **ap-northeast-2** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-northeast-2/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 26 | | **ap-northeast-3** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-northeast-3/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 27 | | **ap-south-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-south-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 28 | | **ap-southeast-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-southeast-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 29 | | **ap-southeast-2** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ap-southeast-2/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 30 | | **ca-central-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/ca-central-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 31 | | **eu-central-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/eu-central-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 32 | | **eu-north-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/eu-north-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 33 | | **eu-west-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/eu-west-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 34 | | **eu-west-2** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/eu-west-2/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 35 | | **eu-west-3** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/eu-west-3/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 36 | | **me-south-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/me-south-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 37 | | **sa-east-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/sa-east-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 38 | | **us-east-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/us-east-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 39 | | **us-east-2** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/us-east-2/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 40 | | **us-west-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/us-west-1/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 41 | | **us-west-2** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://deploy.serverlessrepo.app/us-west-2/?app=arn:aws:serverlessrepo:us-east-1:269621987045:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 42 | | **cn-north-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://console.amazonaws.cn/lambda/home?region=cn-north-1#/create/app?applicationId=arn:aws-cn:serverlessrepo:cn-north-1:086750097665:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 43 | | **cn-northwest-1** |[![](https://img.shields.io/badge/SAR-Deploy%20Now-yellow.svg)](https://console.amazonaws.cn/lambda/home?region=cn-northwest-1#/create/app?applicationId=arn:aws-cn:serverlessrepo:cn-north-1:086750097665:applications/amazon-api-gateway-mutating-webhook-for-k8s)| 44 | 45 | 46 | #### OPTION #2 - Build from scratch 47 | Firstly please install AWS CLI and SAM CLI by following [AWS SAM documentation](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html) 48 | 49 | 1). Check out this repository 50 | 51 | ```sh 52 | $ git clone https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8.git 53 | $ cd amazon-api-gateway-mutating-webhook-for-k8 54 | ``` 55 | 56 | 2). Build the SAM package, replace my_s3_bucket with your S3 bucket name at first. 57 | 58 | ```sh 59 | $ export S3_BUCKET=my_s3_bucket 60 | $ sam package -t sam-template.yaml --s3-bucket ${S3_BUCKET} --output-template-file packaged.yaml 61 | ``` 62 | 63 | 3). Deploy SAM package 64 | 65 | ```sh 66 | $ sam deploy -t packaged.yaml --stack-name amazon-api-gateway-mutating-webhook-for-k8 --capabilities CAPABILITY_IAM 67 | ``` 68 | 2. Go to the cloudformation stack console, find the stack which name is serverlessrepo-amazon-api-gateway-mutating-webhook-for-k8s if you are are using SAR deployment in previous step, or find the stack with name amazon-api-gateway-mutating-webhook-for-k8, get APIGatewayURL from the outputs of this stack. 69 | 70 | 3. Create k8s MutatingWebhookConfiguration resource 71 | - Modify mutating-webhook.yaml，replace with the value of APIGatewayURL 72 | - Create K8S resource: 73 | ```bash 74 | $ kubectl apply -f mutating-webhook.yaml 75 | ``` 76 | 4. Deploy sample k8s deployment 77 | ```bash 78 | $ kubectl apply -f ./nginx-gcr.yaml 79 | ``` 80 | 5. Check the image path 81 | ```bash 82 | $ kubectl get pod nginx-gcr-deployment-784bf76d96-hjmv4 -o=jsonpath='{.spec.containers[0].image}' 83 | asia.gcr.io/nginx 84 | ``` 85 | you may noticed the image path has been changed from "gcr.io/nginx" to "asia.gcr.io/nginx" 86 | 87 | ## How it works 88 | ![](./images/solution-diagram.png) 89 | The most famous use case of k8s mutating webhook is the [istio sidecar injector](https://istio.io/docs/reference/commands/sidecar-injector/), you may also reference [K8S documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) or [3rd-party blog](https://medium.com/dowjones/how-did-that-sidecar-get-there-4dcd73f1a0a4) to get understand how k8s admission works. 90 | 91 | This project will setup the API Gateway with Lambda to receive the admission request from k8s API server, you may get k8s Pod spec from "body" object of request payload json object: 92 | ```json 93 | { 94 | "kind": "AdmissionReview", 95 | "request": { 96 | "kind": { 97 | "kind": "Pod", 98 | "version": "v1", 99 | "group": "" 100 | }, 101 | "resource": { 102 | "resource": "pods", 103 | "version": "v1", 104 | "group": "" 105 | }, 106 | "uid": "b06b6ec2-681d-11e9-a645-06b44ed6a042", 107 | "object": { 108 | "status": {}, 109 | "spec": { 110 | "dnsPolicy": "ClusterFirst", 111 | "securityContext": {}, 112 | "serviceAccountName": "default", 113 | "schedulerName": "default-scheduler", 114 | "serviceAccount": "default", 115 | "priority": 0, 116 | "terminationGracePeriodSeconds": 30, 117 | "restartPolicy": "Always", 118 | "containers": [ 119 | { 120 | "name": "nginx", 121 | "image": "gcr.io/nginx:latest", 122 | "imagePullPolicy": "Always", 123 | "ports": [ 124 | { 125 | "protocol": "TCP", 126 | "containerPort": 80 127 | } 128 | ], 129 | "resources": {} 130 | } 131 | ] 132 | }, 133 | "metadata": { 134 | } 135 | }, 136 | "namespace": "admission-test", 137 | "userInfo": { 138 | "username": "system:unsecured", 139 | "groups": [ 140 | "system:masters", 141 | "system:authenticated" 142 | ] 143 | }, 144 | "oldObject": null, 145 | "dryRun": false, 146 | "operation": "CREATE" 147 | }, 148 | "apiVersion": "admission.k8s.io/v1beta1" 149 | } 150 | ``` 151 | then the response of webhook(API Gateway with Lambda) is like this: 152 | ```json 153 | { 154 | "body": { 155 | "kind": "AdmissionReview", 156 | "apiVersion": "admission.k8s.io/v1", 157 | "response": { 158 | "uid": "request.uid", 159 | "allowed": "True", 160 | "patch": "patch_base64", 161 | "patchType": "JSONPatch" 162 | }, 163 | "headers": { 164 | "Content-Type": "application/json" 165 | }, 166 | "statusCode": 200 167 | } 168 | ``` 169 | where the patch_base64 is base64 encoded of [JSON Patch](http://jsonpatch.com/), for example: 170 | ```json 171 | [ 172 | { 173 | "op": "replace", 174 | "path": "/spec/containers/0/image", 175 | "value": "xxxx.dkr.ecr.us-west-2.amazonaws.com/nginx:latest" 176 | } 177 | ] 178 | ``` 179 | JSON patch will be applied to the Pod spec and then persisted into etcd. 180 | 181 | ## License Summary 182 | 183 | This sample code is made available under the MIT-0 license. See the LICENSE file. 184 | -------------------------------------------------------------------------------- /images/solution-diagram.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8/df2840592c88be7cbcbcff4bdb3911890e9c2dc1/images/solution-diagram.png -------------------------------------------------------------------------------- /lambda_function.py: -------------------------------------------------------------------------------- 1 | import json 2 | import base64 3 | from functools import reduce 4 | 5 | image_mirrors = { 6 | #'/':'', #you can set dockerhub mirror with "/" 7 | 'gcr.io/': 'asia.gcr.io/', 8 | 'k8s.gcr.io/': 'asia.gcr.io/google-containers/' 9 | } 10 | 11 | def handler(event, context): 12 | request_body = json.loads(event['body']) 13 | json_patch = [] 14 | 15 | # get initContainers from request and replace image path with JSON Patch 16 | initContainers = dict_get(request_body, 'request.object.spec.initContainers') 17 | if initContainers: 18 | json_patch += image_patch(initContainers, '/spec/initContainers') 19 | 20 | # get containters from request and replace image path with JSON Patch 21 | containers = dict_get(request_body, 'request.object.spec.containers') 22 | if containers: 23 | json_patch += image_patch(containers, '/spec/containers') 24 | 25 | print(json.dumps(json_patch)) 26 | # set response body 27 | patch_b64 = base64.b64encode(json.dumps(json_patch).encode("utf-8")).decode("utf-8") 28 | response_body = { 29 | 'kind': 'AdmissionReview', 30 | 'apiVersion': 'admission.k8s.io/v1', 31 | 'response': { 32 | 'uid': dict_get(request_body, 'request.uid'), 33 | 'allowed': True, 34 | 'patch': patch_b64, 35 | 'patchType': 'JSONPatch' 36 | } 37 | } 38 | 39 | return { 40 | 'body': json.dumps(response_body), 41 | 'headers': { 42 | 'Content-Type': 'application/json' 43 | }, 44 | 'statusCode': 200 45 | } 46 | 47 | def dict_get(dictionary, keys, default=None): 48 | return reduce(lambda d, key: d.get(key, default) if isinstance(d, dict) else default, keys.split("."), dictionary) 49 | 50 | def replace_dockerhub_prfix(image): 51 | if image.startswith("library/"): 52 | return image[len("library/"):] 53 | elif image.startswith("docker.io/"): 54 | return image.replace("docker.io/library/","").replace("docker.io/","") 55 | 56 | def image_patch(containers, path_prefix): 57 | json_patch = [] 58 | for idx, container in enumerate(containers): 59 | image = container['image'] 60 | math_mirror=False 61 | for orig_image, mirror_image in image_mirrors.items(): 62 | if image.startswith(orig_image): 63 | math_mirror=True 64 | image = mirror_image + image[len(orig_image):] 65 | if "/" in image_mirrors and math_mirror==False: 66 | if image.startswith("docker.io/") or image.startswith("library/"): 67 | image = image_mirrors["/"] + replace_dockerhub_prfix(image) 68 | elif "." not in image.split("/")[0]: 69 | image = image_mirrors["/"] + image 70 | json_patch.append({'op': 'replace', 'path': '%s/%d/image' % (path_prefix, idx), 'value': image}) 71 | return json_patch 72 | -------------------------------------------------------------------------------- /mutating-webhook.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: admissionregistration.k8s.io/v1 2 | kind: MutatingWebhookConfiguration 3 | metadata: 4 | name: image-mutating 5 | webhooks: 6 | - name: image.mutating.webhook 7 | admissionReviewVersions: ["v1", "v1beta1"] 8 | sideEffects: None 9 | failurePolicy: Ignore 10 | clientConfig: 11 | url: 12 | rules: 13 | - operations: [ "CREATE", "UPDATE" ] 14 | apiGroups: [""] 15 | apiVersions: ["v1"] 16 | resources: ["pods"] 17 | -------------------------------------------------------------------------------- /nginx-gcr.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: "nginx-gcr" 5 | spec: 6 | replicas: 2 7 | selector: 8 | matchLabels: 9 | app: nginx-gcr 10 | template: 11 | metadata: 12 | labels: 13 | app: "nginx-gcr" 14 | spec: 15 | containers: 16 | - image: k8s.gcr.io/nginx 17 | imagePullPolicy: Always 18 | name: "nginx" 19 | ports: 20 | - containerPort: 80 -------------------------------------------------------------------------------- /sam-template.yaml: -------------------------------------------------------------------------------- 1 | AWSTemplateFormatVersion: "2010-09-09" 2 | Description: "K8S image path mutation webhook" 3 | Transform: AWS::Serverless-2016-10-31 4 | Metadata: 5 | AWS::ServerlessRepo::Application: 6 | Name: amazon-api-gateway-mutating-webhook-for-k8s 7 | Description: Amazon API Gateway Mutating Webhook For K8S 8 | Author: Walkley He 9 | SpdxLicenseId: MIT-0 10 | LicenseUrl: LICENSE 11 | ReadmeUrl: README.md 12 | Labels: ['api-gateway', 'k8s'] 13 | HomePageUrl: https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8 14 | SemanticVersion: 0.0.1 15 | SourceCodeUrl: https://github.com/aws-samples/amazon-api-gateway-mutating-webhook-for-k8 16 | Resources: 17 | ApiFunction: 18 | Type: AWS::Serverless::Function 19 | Properties: 20 | Events: 21 | ApiEvent: 22 | Type: HttpApi 23 | Properties: 24 | Path: / 25 | Method: POST 26 | Handler: lambda_function.handler 27 | Runtime: python3.9 28 | MemorySize: 128 29 | Timeout: 60 30 | Outputs: 31 | APIGatewayURL: 32 | Value: !Sub "https://${ServerlessHttpApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}" --------------------------------------------------------------------------------