In this lesson, you will learn how to enforce organizational standards by writing custom admission logic that mandates specific labels and annotations on all new cluster resources.
The Problem: Configuration Drift
In a large cluster, it is easy for developers to deploy resources without necessary metadata, such as cost-center, owner-team, or environment. Without this, your billing reports, automated cleanup scripts, and monitoring dashboards become inaccurate. While you have previously learned to use ResourceQuotas and LimitRanges to govern resource consumption, standardizing metadata requires an Admission Controller to act as a gatekeeper during the API request lifecycle.
Implementing Mandatory Schema Enforcement
When a user submits a manifest to the API server, the request passes through the Admission phase before it is persisted in etcd. By implementing a Validating Admission Webhook, you can intercept the request and inspect the object's metadata. If the object lacks the required labels or annotations, the webhook rejects the request, returning a descriptive error to the user.
Example Validation Logic
Imagine you require every Deployment to have an owner-team label. Your logic inside the webhook would look conceptually like this:
// Inside your admission handler
func validateLabels(deployment appsv1.Deployment) error {
if _, ok := deployment.Labels["owner-team"]; !ok {
return fmt.Errorf("missing mandatory label: owner-team")
}
return nil
}
If the owner-team key is missing, the API server denies the request:
Error from server (Forbidden): admission webhook denied the request: missing mandatory label: owner-team
Why Not Just Use Mutating Webhooks?
While you could use a Mutating Webhook to automatically inject these labels, explicit validation is often preferred for standardization. By rejecting non-compliant manifests, you force developers to update their source-of-truth configurations (their CI/CD manifests or Helm charts). This ensures that the documentation and the actual cluster state remain perfectly synchronized, preventing the "invisible" configuration drift that occurs when the system silently injects missing values for you.
Key Takeaway: By implementing custom validation logic in your admission webhooks, you transform organizational standards from suggested guidelines into non-negotiable requirements enforced at the moment of deployment.