In this lesson, you will learn how to intercept and validate incoming Kubernetes API requests using custom Admission Controllers to ensure they comply with your cluster’s security policies before they are ever persisted.
The Gatekeeper Concept
While Pod Security Standards define what is allowed, Admission Controllers act as the gatekeeper that enforces these rules. When you submit a YAML file to the cluster, the API server processes the request through several phases. The "Admission" phase is the final checkpoint before an object is stored in etcd. By deploying a Validating Admission Webhook, you can reject any request that violates your governance standards—such as containers running as root or missing mandatory security labels.
How it Works
A validating webhook is essentially an HTTPS server running inside your cluster. When an API request hits the cluster, the API server sends a AdmissionReview payload to your webhook. Your service evaluates the request against your custom logic and returns a response: allowed: true or allowed: false.
For example, if you want to mandate that every Pod must have a security-check: passed label, your webhook logic would look like this:
// Simplified logic for an Admission Controller
if pod.ObjectMeta.Labels["security-check"] != "passed" {
return admission.Errored(http.StatusForbidden, fmt.Errorf("Missing security label"))
}
return admission.Allowed("Label present")
Why Use Custom Webhooks?
While standard Pod Security Admission (PSA) controllers handle broad constraints, custom webhooks provide the flexibility to enforce organization-specific governance that standard policies can’t catch. This might include:
- Requiring that every image comes from your private, internal container registry.
- Enforcing that every Deployment includes specific resource requests and limits.
- Blocking the creation of LoadBalancer Services if they don't include an internal-only annotation.
By automating this enforcement, you eliminate "human error" and ensure that non-compliant workloads are blocked at the front door rather than requiring manual cleanup or reactive auditing. Your CI/CD pipeline benefits because developers receive immediate feedback (a rejection error) when they attempt to deploy a non-compliant manifest, allowing them to remediate issues during development rather than in production.
Key Takeaway: Validating Admission Webhooks provide an automated, programmatic "gatekeeper" that prevents non-compliant configurations from ever entering your cluster.