An admission controller checks a Kubernetes API request before the requested object is created or updated. It can validate or mutate the request, then allow or deny it. This makes admission control useful for rules that permissions alone cannot express, such as requiring a label on every namespace or restricting how Pods are configured. section 13.4.1 section 11.2.3
ACM Policy Controller uses Gatekeeper for this role. Enabling it creates a ValidatingWebhook configuration that registers the policy engine with the API server. For a Pod creation request, the API server calls the Gatekeeper service; a Gatekeeper Pod evaluates the configured policies and returns its decision. A denial prevents creation and supplies an error to the API server. section 13.4.1
Gatekeeper policies pair a constraint template, which defines a test in Rego, with a constraint that supplies its arguments and selects where it applies. For example, a constraint can require a billing label on namespaces or deny privileged containers in Pods. ACM can also use ClusterSelectors to apply different constraints to different clusters. section 11.2.3 section 13.4.1
Test a Pod restriction before enforcing it
A K8sPSPPrivilegedContainer constraint can match Pods with `enforcementAction: dryrun`. Reported violations identify affected Pods, including system workloads, before the restriction is enforced. Review those results and plan exemptions rather than assuming every existing Pod satisfies a new policy. section 13.4.1
Table 13.2 Namespace exemption options (view table figure)
Namespace exemptions have different scopes: a webhook exemption bypasses admission checks but retains audit and sync; `*` exempts the namespace from all Gatekeeper processes. section 13.4.1
Treat the controller as part of the deployment path. A malfunction can obstruct deployment requests across a cluster, while an expensive custom policy can add latency. Gatekeeper is available as an open source deployment, but operating and supporting it remains the organization's responsibility; ACM provides a supported deployment option. section 13.3 section 13.4.1
