kTailor

Why it's ranked here

It does one narrow job with very little code and says plainly where it stops. The whole mutation path is a handful of Go files built on the official Kubernetes client libraries, it is Apache 2.0 licensed, and templates are plain YAML with no policy language to learn. Its own documentation points readers who need conditional logic or other resource types toward Kyverno or OPA Gatekeeper. The limits are real: only Deployments, no Go unit tests in the tree, a Helm chart whose image tag defaults to latest, and a README that says AI tools helped write the code.

What's good

Templates are watched through a Kubernetes informer filtered to one label, so each admission request reads from an in-memory cache instead of calling the API server. System namespaces for Kubernetes itself and OpenShift, plus cattle-system and cert-manager, are refused in code before any user configuration is consulted, as is the service's own namespace. On top of that sits a configurable allowlist or blocklist matched by exact name, prefix or suffix. Every add operation checks for an existing entry with the same name first, so reapplying a template does not stack duplicate sidecars or volumes.

Tradeoffs

Most failures are silent: a missing template, a malformed label or a rejected local template all let the Deployment through unchanged, logged but not surfaced to the user. The Helm default sets the webhook failure policy to Ignore, so an outage behaves the same way. The append operation joins values with a per-entry separator that defaults to empty, while the README describes a colon delimiter, so appending to an existing variable without setting a separator glues the strings together. A template ConfigMap is read from whichever data key comes first, which is unpredictable if the map holds more than one.

How to use it well

Fit it to platform teams that want a few standard injections, such as a proxy variable, a monitoring sidecar or a time-shifting library for tests, applied by label without editing every manifest. Keep each template ConfigMap to a single data key and always set a separator on append entries. Decide early whether application teams may supply their own templates, since a local template can add privileged containers to a workload. Switch the failure policy to Fail once templates are stable if a missed injection matters. Look elsewhere for validation, StatefulSets or DaemonSets, or rules that depend on the object's contents.

Observed

License

Apache License 2.0 (LICENSE)

Language

Go, built on k8s.io client-go, api and apimachinery (go.mod)

Interface

Kubernetes mutating admission webhook serving a single mutate endpoint

Resources mutated

Deployments only; other resource kinds are allowed through unchanged

Install surface

Plain manifests with kubectl, a Makefile build, or the Helm chart in the repository; cert-manager required for TLS

Default failure policy

Ignore, set in helm/values.yaml

Template source

ConfigMaps labelled ktailor.dev/template, cached in memory by an informer

Tests

No Go unit test files in the repository tree; the Helm chart carries only a connection test

Authorship note

README states AI tools assisted in writing the code and documentation