Kubernetes Admission Controller Concepts
External
- https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
- https://docs.openshift.org/latest/architecture/additional_concepts/authorization.html#admission
Internal
Overview
An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the metadata, but after the request is authenticated and authorized. There is a fixed set of admission controller that include AlwaysPullImages, PodSecurityPolicy, etc. The controllers are compiled into the kube-apiserver binary, and may only be configured by the cluster administrator. Of these, two controllers (MutatingAdmissionWebhook and ValidatingAdmissionWebhook) are special, in that they allow for dynamic admission control.
OpenShift content: the admission controller validates requests by processing these requests relative to all applicable Security Context Constraintss. The admission controller first identifies all applicable SCCs based on the user identity and groups the user belongs to. If the pod specifies a service account, the constraints accessible to the service account will be added to the applicable SCC set. It then sorts the SCCs by their priority field, highest priority SCCs being placed in front of the list. Nil is considered 0 priority. If the priorities are equal, the SCCs will be sorted from most restrictive to least restrictive. All else being equal, the SCCs will be sorted by name. The field values for the security context settings that were not specified on the request are generated. The final settings are validated against the available constraints. Each field of the security context must be validated against SCCs in order for a request to be successful.
Admission Controller Types
AlwaysPullImages
PodSecurityPolicy
DefaultStorageClass
The DefaultStorageClass is relevant in Persistent Volume Claims and Storage Class conversation.
Dynamic Admission Control
In addition to compiled-in admission controller, admission plugins can be developed as extensions and run as webhooks configured at runtime.
MutatingAdmissionWebhook
ValidatingAdmissionWebhook
ValidatingWebhookConfiguration
It is a Kubernetes API resource.