Mutating vs Validating webhooks with an Operator

WHAT THIS TESTS The interviewer wants to see that you understand the Kubernetes admission control chain and where webhooks sit relative to your Operator's reconciler. Webhooks act on the object before it is persisted to etcd; the Operator acts after.

A GOOD ANSWER COVERS The two phases run in a fixed order. Mutating admission webhooks fire first and may return a JSON patch that alters the incoming object. Validating admission webhooks fire afterward and may only allow or deny the request, never change it. Both are registered against your CustomResourceDefinition's group, version and kind. A mutating example: default an optional replicas field to three, or stamp a label, so users submit minimal manifests. A validating example: reject a CR whose backup schedule conflicts with its retention window, a cross-field rule that OpenAPI structural schema cannot express. You should mention failurePolicy, timeoutSeconds, and that webhooks must be highly available because they sit in the request path.

COMMON WRONG ANSWERS Saying a validating webhook can fix or patch the object, reversing the order, or rebuilding simple type and required checks that the CRD schema already enforces. Another mistake is putting business defaults inside the reconcile loop when they belong in mutation so the stored object is already complete.

LIKELY FOLLOW-UPS How do you avoid a webhook outage blocking all CR writes? Discuss failurePolicy Ignore versus Fail and namespace selectors. How is the webhook served and its TLS managed, often via cert-manager. How do you prevent infinite mutation loops with the Operator's own updates.

ONE CONCRETE EXAMPLE For a Database custom resource, the mutating webhook injects a default storageClass and a metrics sidecar container when monitoring is enabled. The validating webhook then rejects any Database whose requested storage is below the engine's minimum or whose version is not in the supported list, returning a clear message so the kubectl apply fails fast with a reason.