What are Kubernetes Admission Controllers?

Question

Accepted Answer

**Admission Controllers** — intercept and modify requests to K8s API.

**MutatingWebhook (Injector Istio):**
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: sidecar-injector
webhooks:
  - name: sidecar.istio.io
    clientConfig:
      service:
        name: istiod
        namespace: istio-system
        path: "/inject"
    rules:
      - operations: ["CREATE"]
        apiGroups: [""]
        resources: ["pods"]
    namespaceSelector:
      matchLabels:
        istio-injection: enabled
```

**ValidatingWebhook (Require Labels):**
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: require-labels
webhooks:
  - name: require-team-label
    clientConfig:
      service:
        name: label-validator
        path: "/validate"
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["apps"]
        resources: ["deployments"]
    failurePolicy: Fail
```

**Built-in:** NamespaceLifecycle, LimitRanger, ResourceQuota, PodSecurity.

**Alternatives:** OPA Gatekeeper, Kyverno.

DevOps: What are Kubernetes Admission Controllers?