Validating Configuration Drift with Admission Webhooks

In this lesson, you will learn how to use Validating Admission Webhooks to detect and block configuration drift, ensuring that your cluster's desired state remains consistent over time.

Preventing Configuration Drift

Configuration drift occurs when the state of your resources gradually diverges from the intended "source of truth"—such as your GitOps repository or CI/CD pipelines—due to manual interventions or legacy patches applied directly to the cluster. While you have previously learned to enforce security contexts and standardize configurations, Validating Admission Webhooks act as the final gatekeeper that prevents "illegal" changes from ever being persisted in etcd.

Cross-Resource Validation

Unlike static policies that check a single object, advanced configuration validation involves cross-resource checks. For example, imagine you have a policy where a Service can only expose a Deployment if that deployment carries a specific environment: production label.

When a user attempts to create or update a Service, your webhook interceptor triggers the following logic:

1. Extraction: The webhook inspects the Service definition for its target selector.
2. Cross-Reference: It queries the Kubernetes API for the corresponding Deployment.
3. Comparison: It checks if the Deployment possesses the required label.
4. Decision: If the label is missing, the webhook returns a 403 Forbidden response, rejecting the request with a descriptive error message.

# Example logic triggered by the admission request
if object.kind == "Service":
    target_deployment = get_deployment(object.spec.selector)
    if target_deployment.labels["environment"] != "production":
        deny("Service must only point to production-labeled deployments.")

By implementing this logic, you stop "configuration drift" before it happens. Even if a user tries to point a production service to a development-tier workload, the cluster rejects the mutation, maintaining the architectural integrity defined in your CI/CD pipeline. This approach transforms your cluster from a passive execution environment into an active enforcer of your infrastructure-as-code standards.

Key Takeaway: Validating Admission Webhooks allow you to perform cross-resource logic that blocks configuration drift by verifying that new or updated objects align with the dependencies and state requirements of existing cluster workloads.