What is Kubernetes ValidatingAdmissionPolicy?

Question

Accepted Answer

**ValidatingAdmissionPolicy** — validate resources at admission time without webhooks.

```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "require-labels"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: ["apps"]
      apiVersions: ["v1"]
      operations: ["CREATE", "UPDATE"]
      resources: ["deployments", "statefulsets"]
  validations:
  - expression: "has(object.metadata.labels) && has(object.metadata.labels.app)"
    message: "Deployment must have an 'app' label"
  - expression: "object.spec.replicas >= 1 && object.spec.replicas <= 10"
    message: "Replicas must be between 1 and 10"
  - expression: >
      all(object.spec.template.spec.containers, c,
        has(c.resources) && has(c.resources.limits) && has(c.resources.limits.memory))
    message: "All containers must have memory limits"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "require-labels-binding"
spec:
  policyName: "require-labels"
  matchResources:
    namespaceSelector:
      matchLabels:
        enforce-policies: "true"
```

```bash
# Commands
kubectl get validatingadmissionpolicy
kubectl describe validatingadmissionpolicy require-labels

# Test policy (will fail)
kubectl create deployment test --image=nginx --replicas=3
```

**Advantages:**
- No webhook server needed.
- Low latency (in-process).
- CEL expressions for validation.
- Native Kubernetes feature.

DevOps: What is Kubernetes ValidatingAdmissionPolicy?