Using, and mis-using K8s Dynamic Admission Control
summary
Explains how Kubernetes dynamic admission control works, with mutating webhooks that rewrite images or inject default annotations and validating admission policies (CEL, beta in Kubernetes 1.28) for declarative yes/no checks, plus full HTTPS validating webhooks for arbitrary logic. Notes concrete limits: 1 second minimum timeout (default ~10s), inability to block some control-plane changes, mutation-chaining that can requeue requests, and real-world uses—registry rewrites, runtimeClass enforcement, quota hacks—and misuses like red‑team fuzzing or accidental cluster overload.
AI-written summary · about
chapters (10)
- 0:00Introduction and Audience Engagement
- 1:22Overview of Kubernetes API Requests
- 1:49Dynamic Admission Control Explained
- 2:31Mutating Webhooks
- 3:48Validating Admission Policies
- 6:41Validating Webhooks
- 7:52Webhook Flow and Metadata
- 9:57Limitations and Challenges
- 11:50Practical Uses and Misuses
- 15:22Q&A Session
related talks
20mMaking Dynamic Admission Control Even More Dynamic Using...
25mCreating and Debugging Kubernetes Admission Webhooks
20mMaking Dynamic Admission Control Even More Dynamic Using...
35mHow to fight misconfiguration and bad intentions with Kubernetes admission policy
35mAdmission Webhooks: Configuration and Debugging Best Practices
41mKubernetes Security Jumpstart
35mEnforcing Bespoke Policies in Kubernetes [I]
59mKubernetes - going beyond the basics