DevOps: What is Kubernetes Admission Review?

1apiVersion: admission.k8s.io/v1
2kind: AdmissionReview
3request:
4  uid: 12345-abcde
5  kind:
6    group: ""
7    kind: Pod
8    version: v1
9  resource:
10    group: ""
11    resource: pods
12    version: v1
13  name: my-pod
14  namespace: production
15  operation: CREATE
16  userInfo:
17    username: system:serviceaccount:production:myapp
18    uid: 12345-abcde
19  object:
20    apiVersion: v1
21    kind: Pod
22    metadata:
23      name: my-pod
24      namespace: production
25    spec:
26      containers:
27      - name: app
28        image: nginx:latest
29response:
30  uid: 12345-abcde
31  allowed: true
32  status:
33    message: "Pod created successfully"
34  patchType: JSONPatch
35  patch: W3sib3AiOiAiYWRkIiwgInBhdGgiOiAiL21ldGFkYXRhL2xhYmVscyIsICJ2YWx1ZSI6IHsiYXBwIjogIm5naW54In19XQ==
36---
37# Mutating webhook response with patches
38response:
39  uid: 12345-abcde
40  allowed: true
41  patchType: JSONPatch
42  patch: W3sib3AiOiAiYWRkIiwgInBhdGgiOiAiL21ldGFkYXRhL2xhYmVscyIsICJ2YWx1ZSI6IHsiYXBwIjogIm5naW54In19XQ==
43---
44# Validating webhook response (deny)
45response:
46  uid: 12345-abcde
47  allowed: false
48  status:
49    code: 403
50    message: "Pod does not meet security requirements"
51    reason: Forbidden

1# Check webhook logs for AdmissionReview
2kubectl logs -n kube-system -l app=webhook-server | grep AdmissionReview
3
4# View webhook audit events
5kubectl get events --field-selector reason=FailedCreate --sort-by=.lastTimestamp
6
7# Check webhook configuration
8kubectl get validatingwebhookconfigurations -o yaml | grep -A 20 admissionReviewVersions
9
10# Test webhook response
11kubectl apply -f pod.yaml 2>&1 | grep -i "admission webhook"