Admission controller
A Kubernetes component that intercepts API server requests after authentication and authorization and can reject or modify objects before they are stored. Teams use it to enforce Pod Security Standards, ValidatingAdmissionPolicy rules written in CEL, and image signature or provenance checks.
- Also called
- admission control
- Defined in
- Kubernetes: Admission control
Covered in
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Verify artifact signatures against an explicit trust policy
Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
Practice: Signed artifact provenance lab: Reject a release from the wrong producer · Privileged container lab: Reject a privileged workload before deployment · NetworkPolicy lab: Lock down a shop namespace · Local project: Build and verify a signed software release