KubeTripwire

Admission Webhook Failure-Chain Analyzer for Kubernetes

Maps admission webhook runtime dependencies and identifies concrete failure paths that may block Kubernetes API requests.

---

The Problem

In production Kubernetes clusters, multiple admission webhooks (mutating + validating) coexist — Istio sidecar injectors, cert-manager, OPA/Gatekeeper, Kyverno, custom webhooks, etc. These webhooks form complex, invisible runtime dependency chains:

MutatingWebhookConfiguration / ValidatingWebhookConfiguration
  ├── failurePolicy (Fail / Ignore)
  ├── timeoutSeconds & matchPolicy
  ├── namespaceSelector & objectSelector
  ├── clientConfig.service
  │   ├── Service
  │   ├── EndpointSlice (ready endpoints count)
  │   ├── Backing Pods (node/zone spread)
  │   └── PodDisruptionBudget (effective protection)
  └── TLS Chain
      ├── caBundle (from webhook config)
      └── Serving certificate (cert-manager, mounted secret, active probe)

If any link in this chain fails on a webhook with failurePolicy: Fail, matching resource creations and updates are blocked cluster-wide.

KubeTripwire scans these runtime chains and reports concrete, evidence-based findings before outages happen.

---

Quick Start

Installation via Krew

kubectl krew install tripwire

Direct Download / Go Install

go install github.com/Dasmat13/kubectl-tripwire@latest

---

Usage

Analyze All Webhooks in Cluster

kubectl tripwire admission

Output Formats

# Rich colored terminal output (default)
kubectl tripwire admission

# Machine-readable JSON output for CI/CD
kubectl tripwire admission -o json

RBAC Preflight Check

# Verify permissions before scanning
kubectl tripwire admission --check-permissions

Target a Specific Webhook

kubectl tripwire admission --webhook istio-sidecar-injector

---

Sample Output

══════════════════════════════════════════════════════════════════
  KubeTripwire — Admission Failure-Chain Analysis
  Cluster: production-east · 8 webhooks analyzed (5 mutating, 3 validating)
══════════════════════════════════════════════════════════════════

Webhook: istio-sidecar-injector
────────────────────────────────────────────────────────────
  Type:            MutatingWebhookConfiguration
  failurePolicy:   Fail (fail-closed)
  timeoutSeconds:  10
  matchPolicy:     Equivalent
  sideEffects:     None

  Scope:
    - Ops:       CREATE
      Resources: pods
    - Namespaces: 31 of 34 match selector

  Backend:
    Service:       istio-system/istiod (port 443)
    Endpoints:     1 of 3 ready
    Pods:          3
    Owner:         Deployment/istiod
    Nodes:         1 unique nodes
    Zones:         1 unique zones (us-east-1a)

  Findings:
    [HIGH] Fail-closed webhook with degraded endpoints
      Only 1 of 3 endpoints are ready. If the remaining endpoint(s) become unavailable, matching admission requests will be rejected.
      Evidence:
        • Ready endpoints: 1 of 3
        • failurePolicy: Fail
        • Scope: pods/CREATE in 31 namespaces
      Consideration: Investigate why some endpoints are not ready. Check backend pod status and events.

    [MEDIUM] Fail-closed webhook with all backend pods on a single node
      All backend pods are scheduled on the same node. A node failure or drain will remove all backend pods simultaneously.
      Evidence:
        • Backend pods: 3
        • All on node: worker-2a
        • failurePolicy: Fail
      Consideration: Consider pod anti-affinity rules or topology spread constraints to distribute backend pods across nodes.

══════════════════════════════════════════════════════════════════
  Admission Compound Risks
══════════════════════════════════════════════════════════════════

  ⚠ Fail-closed webhook with endpoint issues affecting wide scope
    Webhook:  istio-sidecar-injector
    Scenario: Matching API requests in 31 namespaces are at risk of rejection. If all endpoints become unavailable, no matching resources can be created or modified.

──────────────────────────────────────────────────────────
Summary:
  Webhooks analyzed: 8
  Critical findings: 0
  High findings:     1
  Medium findings:   1
  Low findings:      0
  Info observations: 0
  Compound risks:    1
  Scan duration:     42ms
──────────────────────────────────────────────────────────

---

SIG Alignment

KubeTripwire targets sig-api-machinery semantics:

• Admission webhook configurations (MutatingWebhookConfiguration, ValidatingWebhookConfiguration)
• failurePolicy (Fail vs Ignore) semantics
• Selector resolution via k8s.io/apimachinery/pkg/labels
• Backend availability & hostname-aware TLS verification

---

License

Apache License 2.0