Kubernetes admission control
Kubernetes admission control is the API server's last chance to reject or modify a bad object before it is written to etcd. Admission controllers run after authentication and authorization but before the object is persisted. They come in two flavors: validating (accept or reject) and mutating (modify the object in flight, for example to inject sidecars or set defaults). Admission is the strongest place to enforce policy at deploy time, because without a validating webhook a cluster-admin can create any object they want.
How admission control works
When a client runs kubectl apply, the request hits the API server and flows through authentication → authorization → mutating admission → object schema validation → validating admission → persistence to etcd. An admission webhook that rejects the request blocks the entire create or update.
Webhooks are registered via ValidatingWebhookConfiguration or MutatingWebhookConfiguration resources. When a matching request arrives, the API server POSTs the object to the webhook URL. The webhook responds with {allowed: true|false, patches: [...]}.
Built-in admission controllers
Kubernetes ships with several built-in controllers including NamespaceLifecycle, ResourceQuota, and PodSecurity (the successor to PodSecurityPolicy). Pod Security Standards enforcement via the built-in PodSecurity controller is a practical first step for blocking privileged pods.
OPA Gatekeeper, Kyverno, and custom webhooks
OPA Gatekeeper uses Rego policies and integrates with the broader Open Policy Agent ecosystem. Powerful, with a learning curve.
Kyverno uses native YAML policies, so no new language is required. Easier onboarding, slightly less flexible for complex logic.
Custom webhooks (Go, Python, etc.) give maximum flexibility at the cost of maintenance.
Juliet includes a bundled admission controller that ships with a set of production-ready policies and supports custom Rego for Enterprise customers.
What to enforce with admission
- Block containers running as root or with
allowPrivilegeEscalation: true. - Require resource limits on every container.
- Block
hostPathmounts outside a narrow allowlist. - Require images only from approved registries.
- Block pods without liveness or readiness probes in production namespaces.
- Require Pod Security Standards baseline (or restricted) on every namespace.
- Block creation of RoleBindings or ClusterRoleBindings that grant cluster-admin.
Frequently asked about kubernetes admission control
Should I use mutating or validating webhooks?
Validating for security policy. An explicit rejection is easier to reason about than silent rewriting. Mutating webhooks fit platform conveniences such as injecting sidecars or adding default labels.
Do admission webhooks slow down deploys?
A well-written webhook responds in under 100 ms. The API server has a configurable timeout (default 10 seconds). A webhook that goes down with failurePolicy: Fail can block every matching API request, so it is worth setting failurePolicy: Ignore for non-critical webhooks, narrowing the namespaceSelector, and excluding kube-system.
Does admission control replace KSPM?
No. Admission stops new bad configurations at deploy time. KSPM continuously evaluates what is already in the cluster, including state that was created before the admission controller was installed or while it was misconfigured. Both controls work together.
Does Pod Security Standards admission work out of the box?
Yes, in Kubernetes 1.25+. Label a namespace with pod-security.kubernetes.io/enforce=baseline (or restricted) and the built-in admission controller rejects non-compliant pods. No external controller required.
Can admission webhooks cause cluster outages?
Yes. A webhook with failurePolicy: Fail that becomes unhealthy will block every matching API request, including pod scheduling. Narrow the objectSelector, exclude kube-system, run the webhook HA, set timeouts, and test failover in staging before promoting to prod.
See this in your clusters
Juliet maps your Kubernetes security posture as a graph and ranks findings by reachable attack paths, not just CVSS. Free tier, five-minute setup, no credit card.