An admission controller intercepts Kubernetes deployment requests before they change an environment. A mutating admission controller can automatically modify resources, such as adding sidecars for secret retrieval or authentication; a validating controller checks whether requirements are satisfied. section 2.3.5 section 4.1.1
Use admission control to move enforcement to the point of change while keeping compliance work separate from compliance verification:
- Mutate every deployed service to add platform capabilities, including secret-loading or authentication sidecars. section 2.3.5
- Validate deployment evidence, such as matching an image commit SHA with a successful vulnerability-scan record, rather than rescanning the image. section 4.1.1
- Enforce configuration requirements directly, such as requiring labels on deployments through Gatekeeper. section 4.1.1
Secrets without application changes
A platform team configures a mutating controller to add a sidecar to every service. The sidecar continuously loads current secrets from a vault, allowing the primary workload to retrieve updated values without each development team implementing the mechanism. section 2.3.5
Figure 2.16 An example of a pod sidecar. This container runs a process alongside the application container to enhance functionality. In this example, a sidecar continuously loads a new secret value from a vault so that the application will always get the latest updates when secrets are requested.
Shows a pod sidecar running alongside the application container to load updated secrets from a vault. section 2.3.5
