Kubernetes security fundamentals: Admission Control

This article explains Kubernetes admission control as the final stage of API request processing, detailing the roles of mutating and validating controllers, default built-ins (e.g., PodSecurity, ServiceAccount), and external webhooks (Validating/MutatingWebhookConfiguration). It outlines key security considerations—such as fail-open vs fail-closed behavior, controller placement, and privilege exposure—and compares policy mechanisms: Pod Security Admission (namespace-level profiles), Validating Admission Policy using CEL (flexible validation), and external controllers like Kyverno and OPA Gatekeeper. The piece emphasizes using admission control to restrict risky pod configurations (e.g., privileged pods) while understanding limitations and operational risks.