Whenever I deal with istio service mesh, I used to come accross this particular word/term "Mutating webhooks"
At first, I assumed they were just another Kubernetes feature. But when i dig more I got to know that they're actually solving a very practical problem.
Imagine asking every developer to remember adding labels, annotations, resource limits, monitoring configs, security settings, or even service mesh sidecars to every Pod manifest.
In reality, someone will eventually forget.
That's where Mutating Webhooks come in.
Whenever you run kubectl apply (By any means like normal apply command or using helm apply), the request reaches the Kubernetes API Server before being stored.
A Mutating Webhook gets a chance to inspect the object and automatically modify it.
For example, it can:
- Add default CPU and memory requests/limits
- Inject an Istio sidecar
- Add standard labels and annotations
- Inject a Vault agent for secrets
- Apply organization-wide defaults
The best part? Developers can keep their manifests simple while the platform automatically enforces standards behind the scenes.
A simple way to remember it:
Mutating = Modify
Validating = Verify
It's one of those Kubernetes features that's quietly doing a lot of work in production clusters every day.