Diegolden

Topic 4: Admission And Policy

2 min read

Topic 4: Admission And Policy

Official baseline: (The Kubernetes Authors, 2026a, 2026b). My working version: Admission is the gate between a valid API request and a request the cluster should actually accept.

Mental Model

Admission is the gate between a valid API request and a request the cluster should actually accept.

Notes

  • Mutating admission can change objects; validating admission can reject them.
  • Policy engines turn platform rules into repeatable checks.
  • Bad admission webhooks can break cluster operations.

Homelab Angle

Start with warn/audit policies before enforcing. Learn the blast radius.

Verify It

  • Read the object status before changing the manifest.
  • Check events for the controller or node that is actually complaining.
  • Confirm the official source linked below still matches the cluster version you run.

Common Failure Modes

  • Treating the YAML object as the system, instead of one input to a reconciliation loop.
  • Debugging from outside the cluster when the failure only exists inside cluster networking or node state.
  • Forgetting that Kubernetes version, addon version, and runtime behavior are linked.

Sources

  • Admission Controllers - source path: content/en/docs/reference/access-authn-authz/admission-controllers.md, commit 8cc9e19b8eec8d5cf49eacd66f86a81648edb1a0.
  • Dynamic Admission Control - source path: content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md, commit 8cc9e19b8eec8d5cf49eacd66f86a81648edb1a0.
  • Kubernetes documentation is licensed under CC BY 4.0; these notes are original commentary and link back to the official source.
The Kubernetes Authors. (2026a). Admission Controllers. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
The Kubernetes Authors. (2026b). Dynamic Admission Control. https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/

Graph View

Backlinks