diff --git a/net-istio-webhook/rockcraft.yaml b/net-istio-webhook/rockcraft.yaml
new file mode 100644
index 0000000..0c85304
--- /dev/null
+++ b/net-istio-webhook/rockcraft.yaml
@@ -0,0 +1,53 @@
+# From (ko image): https://github.com/knative-extensions/net-istio/tree/release-1.12
+name: net-istio-webhook
+base: ubuntu@22.04
+version: v1.12.3
+summary: An image for Knative's net-istio-webhook
+description: |
+  An image for Knative's net-istio-webhook
+license: Apache-2.0
+entrypoint-service: net-istio-webhook
+run-user: _daemon_
+
+platforms:
+  amd64:
+
+services:
+  net-istio-webhook:
+    override: replace
+    command: "/ko-app/webhook [ ]"
+    startup: enabled
+    user: ubuntu
+
+parts:
+  security-team-requirement:
+    plugin: nil
+    override-build: |
+      mkdir -p ${CRAFT_PART_INSTALL}/usr/share/rocks
+      (echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && \
+      dpkg-query --root=${CRAFT_PROJECT_DIR}/../bundles/ubuntu-22.04/rootfs/ -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) \
+      > ${CRAFT_PART_INSTALL}/usr/share/rocks/dpkg.query
+
+  net-istio-webhook:
+    plugin: go
+    build-snaps:
+      - go/1.21/stable
+    source: https://github.com/knative-extensions/net-istio.git
+    source-tag: release-1.12
+    build-environment:
+      - CGO_ENABLED: 0
+      - GOOS: linux
+    override-build: |
+      cd cmd/webhook
+      mkdir $CRAFT_PART_INSTALL/ko-app
+      go build -o $CRAFT_PART_INSTALL/ko-app/webhook -a .
+  
+  non-root-user:
+    plugin: nil
+    after: [ net-istio-webhook ]
+    overlay-script: |
+      # Create a user in the $CRAFT_OVERLAY chroot
+      groupadd -R $CRAFT_OVERLAY -g 1001 ubuntu
+      useradd -R $CRAFT_OVERLAY -M -r -u 1001 -g ubuntu ubuntu
+    override-prime: |
+      craftctl default
diff --git a/net-istio-webhook/tests/test_rock.py b/net-istio-webhook/tests/test_rock.py
new file mode 100644
index 0000000..bc5cc32
--- /dev/null
+++ b/net-istio-webhook/tests/test_rock.py
@@ -0,0 +1,54 @@
+# Copyright 2024 Canonical Ltd.
+# See LICENSE file for licensing details.
+#
+#
+
+from pathlib import Path
+
+import os
+import logging
+import random
+import pytest
+import string
+import subprocess
+import yaml
+
+from charmed_kubeflow_chisme.rock import CheckRock
+
+
+@pytest.fixture()
+def rock_test_env(tmpdir):
+    """Yields a temporary directory and random docker container name, then cleans them up after."""
+    container_name = "".join(
+        [str(i) for i in random.choices(string.ascii_lowercase, k=8)]
+    )
+    yield tmpdir, container_name
+
+    try:
+        subprocess.run(["docker", "rm", container_name])
+    except Exception:
+        pass
+    # tmpdir fixture we use here should clean up the other files for us
+
+
+@pytest.mark.abort_on_fail
+def test_rock(rock_test_env):
+    """Test rock."""
+    temp_dir, container_name = rock_test_env
+    check_rock = CheckRock("rockcraft.yaml")
+    rock_image = check_rock.get_name()
+    rock_version = check_rock.get_version()
+    LOCAL_ROCK_IMAGE = f"{rock_image}:{rock_version}"
+
+    subprocess.run(
+        [
+            "docker",
+            "run",
+            "--entrypoint",
+            "/bin/bash",
+            LOCAL_ROCK_IMAGE,
+            "-c",
+            "ls -la /ko-app/webhook",
+        ],
+        check=True,
+    )
diff --git a/net-istio-webhook/tox.ini b/net-istio-webhook/tox.ini
new file mode 100644
index 0000000..8219202
--- /dev/null
+++ b/net-istio-webhook/tox.ini
@@ -0,0 +1,51 @@
+# Copyright 2024 Canonical Ltd.
+# See LICENSE file for licensing details.
+[tox]
+skipsdist = True
+skip_missing_interpreters = True
+envlist = pack, export-to-docker, sanity, integration
+
+[testenv]
+setenv =
+    PYTHONPATH={toxinidir}
+    PYTHONBREAKPOINT=ipdb.set_trace
+
+[testenv:pack]
+passenv = *
+allowlist_externals =
+    rockcraft
+commands =
+    rockcraft pack
+
+[testenv:export-to-docker]
+passenv = *
+allowlist_externals =
+    bash
+    rockcraft
+    yq
+commands =
+    # export rock to docker
+    bash -c 'NAME=$(yq eval .name rockcraft.yaml) && \
+             VERSION=$(yq eval .version rockcraft.yaml) && \
+             ARCH=$(yq eval ".platforms | keys | .[0]" rockcraft.yaml) && \
+             ROCK="$\{NAME\}_$\{VERSION\}_$\{ARCH\}.rock" && \
+             DOCKER_IMAGE=$NAME:$VERSION && \
+             echo "Exporting $ROCK to docker as $DOCKER_IMAGE" && \
+             rockcraft.skopeo --insecure-policy copy oci-archive:$ROCK docker-daemon:$DOCKER_IMAGE'
+
+[testenv:sanity]
+passenv = *
+deps =
+    pytest
+    charmed-kubeflow-chisme
+commands =
+    # run rock tests
+    pytest -s -v --tb native --show-capture=all --log-cli-level=INFO {posargs} {toxinidir}/tests
+
+[testenv:integration]
+passenv = *
+allowlist_externals =
+    echo
+commands =
+    # TODO: Implement integration tests here
+    echo "WARNING: This is a placeholder test - no test is implemented here."