DevSecOps Practice Hub

Admission Control

Validate and mutate Kubernetes resources at creation time to enforce security requirements.

AdvancedKubernetes SecurityContainerGovernance

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.

Overview

Admission webhooks are the last enforcement point before a workload runs: they can reject non-compliant resources, inject defaults, and verify image signatures.

Why it matters

CI checks can be bypassed by anyone with cluster access. Admission control enforces regardless of how the resource arrived.

How it works

  1. 01The API server calls validating and mutating webhooks on write.
  2. 02Policies allow, deny or modify the resource.
  3. 03Verification policies check image signatures and attestations.

Common tools

KyvernoGatekeeperSigstore CosignKubernetesOpenShift

Implementation examples

yamlVerify image signatures at admission
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:  name: verify-image-signaturespec:  validationFailureAction: Enforce  rules:    - name: check-signature      match:        any:          - resources:              kinds: [Pod]      verifyImages:        - imageReferences: ["registry.example.com/prod/*"]          attestors:            - entries:                - keyless:                    subject: "https://github.com/acme/*"                    issuer: "https://token.actions.githubusercontent.com"
Set the webhook failure policy deliberately: Fail blocks deployments if the webhook is down, Ignore lets unverified workloads through.

Security considerations

  • Exclude system namespaces to avoid locking yourself out of the cluster.

Best practices

  • Audit before enforce.
  • Exclude kube-system.
  • Monitor webhook availability.

Common mistakes

  • Enforcing on all namespaces including system ones, causing cluster-wide outage.

Hands-on labs