Admission controller

As explained in Kubernetes for Developers

An admission controller is a Kubernetes component that validates or mutates API requests before they are persisted.

An admission controller is Kubernetes code that runs when an object is created, before the object is accepted. It can enforce a cluster-wide rule instead of relying on every developer to configure each Pod manually. section 12.5

Admission webhooks perform two kinds of enforcement:

• Validating admission webhooks accept or reject an object, such as rejecting a Pod without runAsNonRoot. section 12.5
• Mutating admission webhooks change an incoming object, such as adding runAsNonRoot: true automatically. section 12.5
• You can write custom admission controllers, or use Kubernetes-provided, open source, or commercial controllers. section 12.5

Enforcing non-root Pods

A cluster can automatically add the non-root setting to every Pod or reject Pods that omit it. This centralizes a security requirement that would otherwise be configured manually. The resulting Pod still needs a compatible image and user configuration; an image that runs as root or binds to port 80 can fail, requiring runAsUser: 1001, a non-privileged port such as 8080, and an updated Service targetPort. section 12.5 section 12.4

Figure 12.3 The admission process of a Pod that gets scheduled

Trace how a Pod request passes through admission before it is scheduled. section 12.5

How Kubernetes for Developers covers it

How deep it goes

Defines validating and mutating webhooks with a non-root example, but stops short of implementation details for custom controllers.

Examples

Uses runAsNonRoot enforcement, runAsUser: 1001, a port-8080 server, and a Service targeting the changed container port.

What it assumes

Assumes basic Pod creation and securityContext familiarity while introducing admission webhooks through a manual-to-automatic comparison.

What you can do after

Operate/configure cluster policies that reject or automatically modify Pods before persistence.

How it connects

Connects validating admission webhooks, mutating admission webhooks, Kubernetes objects, Pods, and securityContext.

liveBookmanning.com

Read Kubernetes for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Google Anthos in ActionAn admission controller is a Kubernetes component that intercepts API requests after authentication and authorization and can validate or mutate them before persistence.
• 

  liveBookmanning.com
  Effective Platform EngineeringA mutating admission controller API allows a cluster control plane to modify resource requests before they are persisted or executed.

Compare how 3 books explain admission controller →

Related concepts

• Gatekeeperincludes · Gatekeeper is an open-source Kubernetes admission controller that validates and enforces policies using Open Policy Agent.
• Kubernetesused by · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.
• Policy Controllerimplemented by · Policy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.
• kubernetes api serveruses · The Kubernetes API server is the control-plane component that exposes, validates, and processes the Kubernetes API for managing cluster resources and state.
• annotationuses · A Kubernetes annotation is key-value metadata attached to an object for storing non-identifying descriptive, configuration, or operational information.
• pod security admissionincludes · Pod Security admission is a Kubernetes admission mechanism that enforces Pod security policies when resources are submitted to the API.

This explainer was generated by Manning's knowledge graph from the text of Kubernetes for Developers. The section links point to the parts of the book it draws on.