Implementation:Kserve Kserve InferenceService Webhook Chain

Knowledge Sources	KServe KServe Architecture
Domains	Kubernetes, Validation, Mutation
Last Updated	2026-02-13 00:00 GMT

Overview

Concrete webhook implementations for defaulting, validating, and mutating InferenceService resources and their pods in KServe.

Description

The webhook chain consists of three Go implementations:

InferenceServiceDefaulter: Converts shorthand predictor specs to canonical form and applies ConfigMap defaults.
InferenceServiceValidator: Enforces naming conventions, component exclusivity, and autoscaler validation.
Pod Mutator: Injects storage-initializer init containers, model agent sidecars, and metrics aggregators.

Usage

These webhooks are automatically invoked by Kubernetes when an InferenceService is created or updated via kubectl apply. Developers extending KServe need to understand this chain when adding new model frameworks or modifying default behavior.

Code Reference

Source Location

Repository: kserve
File: pkg/apis/serving/v1beta1/inference_service_defaults.go, Lines 54-266 (Defaulter)
File: pkg/apis/serving/v1beta1/inference_service_validation.go, Lines 63-156 (Validator)
File: pkg/webhook/admission/pod/mutator.go, Lines 35-157 (Pod Mutator)

Signature

Defaulter

// Default implements webhook.CustomDefaulter
func (d *InferenceServiceDefaulter) Default(ctx context.Context, obj runtime.Object) error

// DefaultInferenceService sets defaults on InferenceService fields
func (isvc *InferenceService) DefaultInferenceService(config *InferenceServicesConfig,
    deploymentConfig *DeploymentConfig)

// setPredictorModelDefaults converts shorthand (e.g., tensorflow) to canonical model format
func setPredictorModelDefaults(predictorSpec *PredictorSpec)

Validator

// ValidateCreate implements webhook.CustomValidator
func (v *InferenceServiceValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (
    admission.Warnings, error)

// ValidateUpdate implements webhook.CustomValidator
func (v *InferenceServiceValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (
    admission.Warnings, error)

Pod Mutator

// Mutator handles pod mutation for storage initializer and agent injection
type Mutator struct {
    Client  client.Client
    Decoder *admission.Decoder
    Log     logr.Logger
}

// Handle processes the admission request
func (m *Mutator) Handle(ctx context.Context, req admission.Request) admission.Response

Import

import (
    servingv1beta1 "github.com/kserve/kserve/pkg/apis/serving/v1beta1"
    "github.com/kserve/kserve/pkg/webhook/admission/pod"
)

I/O Contract

Inputs

Name	Type	Required	Description
obj	runtime.Object	Yes	InferenceService resource to default/validate
ctx	context.Context	Yes	Request context with ConfigMap data
req	admission.Request	Yes (Mutator)	Pod admission request

Outputs

Name	Type	Description
Defaulted ISVC	InferenceService	Shorthand converted to canonical, resource defaults applied
Validation errors	error	nil if valid, field errors if invalid
Mutated Pod	admission.Response	Pod with injected init containers and sidecars

Usage Examples

Defaulting Behavior

# User submits shorthand:
spec:
  predictor:
    tensorflow:
      storageUri: "gs://bucket/model"

# Defaulter converts to canonical:
spec:
  predictor:
    model:
      modelFormat:
        name: tensorflow
      storageUri: "gs://bucket/model"
      resources:
        requests:
          cpu: "1"
          memory: "2Gi"
        limits:
          cpu: "1"
          memory: "2Gi"

Validation Rules

Name regex:     [a-z]([-a-z0-9]*[a-z0-9])?
Components:     Exactly one implementation per predictor/transformer/explainer
Autoscaler:     Must be compatible with deployment mode (e.g., KPA only with Serverless)

Related Pages

Implements Principle

Principle:Kserve_Kserve_Admission_Webhook_Processing

Requires Environment

Page Connections

Double-click a node to navigate. Hold to expand connections.

Principle

Implementation

Heuristic

Environment