Admission controller
A Kubernetes admission controller intercepts API requests after authentication and authorization, validating or mutating them before they are persisted.
Google Anthos in Action
An admission controller is a Kubernetes component that intercepts API requests after authentication and authorization and can validate or mutate them before persistence.
- How it is used
- Enforces object-level Kubernetes policies on API creation and update requests beyond what access permissions can express.
- How deep it goes
- Explains webhook registration and the request-decision flow, then shows policy configuration and exemptions; defers detailed policy creation.
- Examples
- Uses Pod creation, privileged-container checks, required namespace billing labels, dry-run violations, and namespace exemptions.
- What you can do after
- Operate/configure it through ACM Policy Controller constraints, dry-run checks, and scoped Gatekeeper exemptions.
Read how Google Anthos in Action explains admission controller →
Effective Platform Engineering
A mutating admission controller API allows a cluster control plane to modify resource requests before they are persisted or executed.
- How it is used
- Extends Kubernetes deployment control with automatic capability injection and low-friction compliance verification.
- How deep it goes
- Descends from API purpose to sidecar mutation, webhook verification, image evidence checks, and configuration enforcement.
- Examples
- Uses secret-loading sidecars, authentication and authorization processes, image SHA checks, and required deployment labels.
- What you can do after
- Operate/configure Kubernetes admission policies that mutate workloads or verify deployment evidence before environmental change.
Read how Effective Platform Engineering explains admission controller →
Kubernetes for Developers
An admission controller is a Kubernetes component that validates or mutates API requests before they are persisted.
- How it is used
- Enforces cluster-wide validation and mutation policies during Kubernetes object creation.
- How deep it goes
- Defines validating and mutating webhooks with a non-root example, but stops short of implementation details for custom controllers.
- Examples
- Uses runAsNonRoot enforcement, runAsUser: 1001, a port-8080 server, and a Service targeting the changed container port.
- What you can do after
- Operate/configure cluster policies that reject or automatically modify Pods before persistence.
Read how Kubernetes for Developers explains admission controller →
Related concepts
- Gatekeeperincludes · Gatekeeper is an open-source Kubernetes admission controller that validates and enforces policies using Open Policy Agent.
- Kubernetesused by · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.
- Policy Controllerimplemented by · Policy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.
- kubernetes api serveruses · The Kubernetes API server is the control-plane component that exposes, validates, and processes the Kubernetes API for managing cluster resources and state.
- annotationuses · A Kubernetes annotation is key-value metadata attached to an object for storing non-identifying descriptive, configuration, or operational information.
- pod security admissionincludes · Pod Security admission is a Kubernetes admission mechanism that enforces Pod security policies when resources are submitted to the API.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.