Kubernetes admission webhook for the cocoonstack VM platform.
cocoon-webhook hosts four admission endpoints: a mutating webhook that
rejects cocoon-tolerated pods (bearing the virtual-kubelet.io/provider
toleration) not created by the CocoonSet controller, a validating
webhook that rejects scale-down on cocoon-tolerated Deployments/
StatefulSets, a validating webhook that enforces CocoonSet cross-field
business rules the CRD's OpenAPI schema can't express, and a validating
webhook that pins each pod to at most one live CocoonHibernation.
Documentation: cocoonstack.github.io/cocoon-webhook (source in docs/).
- Overview — the admission endpoints and what each one does
- Validation rules — the cross-field business rules enforced on CocoonSet CREATE/UPDATE and on CocoonHibernation CREATE
- Configuration — every environment variable
- Installation — the
kubectl apply -kpath and building from source
make all # full pipeline: deps + fmt + lint + test + build
make build # build cocoon-webhook binary
make test # vet + race-detected tests
make lint # golangci-lint on linux + darwin
make fmt # gofumpt + goimports
make help # show all targetsThe Makefile detects Go workspace mode (go env GOWORK) and skips go mod tidy when active so cross-module references resolve through go.work without forcing a release of cocoon-common.
| Project | Role |
|---|---|
| cocoon-common | CRD types, annotation contract, shared helpers |
| cocoon-operator | CocoonSet and CocoonHibernation reconcilers |
| epoch | Snapshot registry and storage backend |
| vk-cocoon | Virtual kubelet provider managing VM lifecycle |