Kubernetes Admission Controllers and Webhooks

💡 Quick Answer: Build validating and mutating admission webhooks for Kubernetes. Policy enforcement with OPA Gatekeeper, Kyverno, and custom webhooks.

The Problem

This is a critical skill for managing production Kubernetes clusters at scale. Without it, teams face operational complexity, security risks, and reliability issues.

The Solution

Admission controllers intercept API requests after authentication and before persistence. Prefer a policy engine over hand-written webhooks for most rules. This Kyverno policy enforces a required team label on every Pod:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-team-label
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-team-label
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "Every Pod must set a 'team' label."
        pattern:
          metadata:
            labels:
              team: "?*"

For lower-level control, register a webhook with failurePolicy: Fail so requests are rejected when the webhook is unavailable (fail-closed):

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: pod-policy
webhooks:
  - name: pods.example.com
    failurePolicy: Fail
    admissionReviewVersions: ["v1"]
    sideEffects: None
    rules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["pods"]
    clientConfig:
      service:
        name: pod-policy-webhook
        namespace: policy-system
        path: /validate

Use mutating webhooks to inject defaults (sidecars, labels) and validating webhooks to reject non-compliant objects.

Common Issues

Troubleshooting

Check logs and events first. Most issues have clear error messages pointing to the root cause.

Best Practices

• Follow the principle of least privilege for all configurations
• Test in staging before applying to production
• Monitor and alert on key metrics
• Document your runbooks for the team

Key Takeaways

• Essential knowledge for Kubernetes operations at scale
• Start simple and evolve your approach as needed
• Automation reduces human error and operational toil
• Share learnings across your team