Kubernetes admission webhook for the cocoonstack VM platform, enforcing controller ownership and lifecycle constraints before resources reach the VM controllers.
Documentation: cocoonstack.github.io/cocoon-webhook (source in docs/).
- Pods entering the cocoon gate through the
virtual-kubelet.io/providertoleration or thevm.cocoonstack.io/nameannotation require a CocoonSet owner and an allowlisted requester. This applies on CREATE and on UPDATE from outside the gate; updates to already gated Pods remain allowed. - Scale-down is blocked on cocoon-tolerated Deployments and StatefulSets.
- CocoonSet validation checks cross-field rules and reserves room for derived snapshot names before a VM is created.
- CocoonHibernation validation allows at most one live object per Pod.
| Project | Role |
|---|---|
| cocoon-common | CRD types, annotation contract, shared helpers |
| cocoon-operator | CocoonSet and CocoonHibernation reconcilers |
| vk-cocoon | Virtual kubelet provider managing VM lifecycle |
make build # build cocoon-webhook binary
make test # vet + race-detected tests
make lint # golangci-lint on linux + darwin
make fmt # gofumpt + goimports