What is Kubernetes Validating Admission Policy?

Question

Accepted Answer

**Validating Admission Policy (K8s 1.26+)** — native validation without webhook (built-in).

**Advantages:** no sidecar, no network dependency, works even when control plane is down.

**Example (require labels):**
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "require-team-label"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["apps"]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["deployments", "statefulsets"]
  validations:
    - expression: "has(object.metadata.labels) && has(object.metadata.labels.team)"
      message: "Label team is required"
```

**Namespace binding:**
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "require-team-binding"
spec:
  policyName: "require-team-label"
  matchResources:
    namespaceSelector:
      matchLabels:
        pod-security.kubernetes.io/enforce: restricted
```

**Complex rule (CEL):**
```yaml
validations:
  - expression: "object.spec.replicas <= 10"
    message: "Maximum 10 replicas"
  - expression: |
      object.spec.template.spec.containers.all(c,
        c.image.startsWith("ghcr.io/myorg/")
      )
    message: "Only images from ghcr.io/myorg/"
  - expression: |
      object.spec.template.spec.containers.all(c,
        has(c.resources.limits) && has(c.resources.requests)
      )
    message: "resources.limits and resources.requests are required"
```

**Validating Admission Policy vs OPA/Kyverno:**
- CEK: native, no dependency, limited to CEL.
- OPA: Rego, complex policies, multi-platform.
- Kyverno: YAML, mutate + verify, Kubernetes-centric.

DevOps: What is Kubernetes Validating Admission Policy?