What is Kubernetes Admission Controllers?

Question

Accepted Answer

**Admission Controllers** — intercept and modify requests to API server. ```yaml # ValidatingWebhookConfiguration apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: pod-validation webhooks: - name: validate-pod.example.com clientConfig: service: name: validation-service namespace: kube-system path: /validate caBundle: rules: - operations: ["CREATE", "UPDATE"] apiGroups: [""] apiVersions: ["v1"] resources: ["pods"] failurePolicy: Fail sideEffects: None admissionReviewVersions: ["v1"] --- # MutatingWebhookConfiguration apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: pod-mutation webhooks: - name: mutate-pod.example.com clientConfig: service: name: mutation-service namespace: kube-system path: /mutate caBundle: rules: - operations: ["CREATE"] apiGroups: [""] apiVersions: ["v1"] resources: ["pods"] sideEffects: None ``` ```bash # Commands kubectl get validatingwebhookconfigurations kubectl get mutatingwebhookconfigurations kubectl describe validatingwebhookconfiguration pod-validation # Disable webhook temporarily kubectl delete validatingwebhookconfiguration pod-validation # Check API server admission plugins kubectl proxy & curl http://localhost:8001/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations ``` **Built-in Admission Plugins:** - NamespaceLifecycle: prevent deletion. - LimitRanger: apply defaults. - ResourceQuota: check quotas. - PodSecurity: enforce security. - MutatingAdmissionWebhook: modify resources. - ValidatingAdmissionWebhook: validate resources.

DevOps: What is Kubernetes Admission Controllers?