Kubernetes admission webhook for the cocoonstack VM platform.

cocoon-webhook hosts four admission endpoints: a mutating webhook that rejects cocoon-tolerated pods not created by the CocoonSet controller, a validating webhook that rejects scale-down on cocoon-tolerated Deployments/ StatefulSets, a validating webhook that enforces CocoonSet cross-field business rules the CRD's OpenAPI schema can't express, and a validating webhook that pins each pod to at most one live CocoonHibernation.

Documentation: cocoonstack.github.io/cocoon-webhook (source in docs/).

• Overview — the admission endpoints and what each one does
• Validation rules — the cross-field business rules enforced on CocoonSet CREATE/UPDATE and on CocoonHibernation CREATE
• Configuration — every environment variable
• Installation — the kubectl apply -k path and building from source

make all            # full pipeline: deps + fmt + lint + test + build
make build          # build cocoon-webhook binary
make test           # vet + race-detected tests
make lint           # golangci-lint on linux + darwin
make fmt            # gofumpt + goimports
make help           # show all targets

The Makefile detects Go workspace mode (go env GOWORK) and skips go mod tidy when active so cross-module references resolve through go.work without forcing a release of cocoon-common.

MIT