Porch Webhooks on Porch Documentation

Webhook Certificate Management

Mon, 01 Jan 0001 00:00:00 +0000

Porch webhooks require TLS certificates to function. By default, self-signed certificates are generated at deployment, which works for development and testing but doesn’t auto-rotate. For production, use cert-manager for automatic provisioning and rotation.

Default Setup (Development)

Self-signed certificates are generated by scripts/webhook-utils.sh during deployment and stored in Secret porch-controllers-webhook-tls in namespace porch-system. They’re mounted at /etc/webhook/certs in the porch-controllers pod.

The limitation of self-signed certificates is that they don’t auto-rotate before expiration, which can cause webhook outages if they are not renewed manually.

Webhook Validation Rules

Mon, 01 Jan 0001 00:00:00 +0000

Webhooks validate resources at admission time, before they’re written to Kubernetes etcd. This means invalid configurations are rejected immediately, preventing invalid state from entering the system. The validation rules below are enforced by two webhooks: one for PackageRevision v1alpha2 resources and one for Repository resources.

PackageRevision Validation

CREATE

When creating a PackageRevision, the webhook validates:

Repository must exist in the same namespace and have the porch.kpt.dev/v1alpha2-migration: "true" annotation. If missing, you’ll see the Repository {namespace}/{name} not found or not enabled for v1alpha2 error messages. Add the annotation to the Repository resource.