Admission Controller

Kubernetes admission controllers intercept API server requests before object persistence, enabling validation and mutation of resources to enforce security policies. Security-focused admission controllers reject workloads that request privileged access, require specific image registries, or violate namespace isolation policies.

Policy-as-code tools like OPA Gatekeeper and Kyverno implement custom admission controller logic.