in pkg/cmd/admissioncontroller/main.go [147:181]
func (wh *WebHook) Startup(certs *tls.Certificate) {
wh.Lock()
defer wh.Unlock()
mux := http.NewServeMux()
mux.HandleFunc(healthURL, wh.ac.Health)
mux.HandleFunc(mutateURL, wh.ac.Serve)
mux.HandleFunc(validateConfURL, wh.ac.Serve)
wh.server = &http.Server{
Addr: fmt.Sprintf(":%v", wh.port),
TLSConfig: &tls.Config{
MinVersion: tls.VersionTLS12, // No SSL, TLS 1.0 or TLS 1.1 support
NextProtos: []string{"h2", "http/1.1"}, // prefer HTTP/2 over HTTP/1.1
CipherSuites: wh.getCipherSuites(), // limit cipher suite to secure ones
Certificates: []tls.Certificate{*certs},
},
Handler: mux,
ReadHeaderTimeout: 10 * time.Second,
}
go func() {
if err := wh.server.ListenAndServeTLS("", ""); err != nil {
if errors.Is(err, http.ErrServerClosed) {
log.Log(log.Admission).Info("existing server closed")
} else {
log.Log(log.Admission).Fatal("failed to start admission controller", zap.Error(err))
}
}
}()
log.Log(log.Admission).Info("the admission controller started",
zap.Int("port", HTTPPort),
zap.Strings("listeningOn", []string{healthURL, mutateURL, validateConfURL}))
}