admission controller

An admission controller is a piece of Kubernetes middleware that sits between the API server and the etcd database. When a user submits a request to create, modify, or delete resources (pods, deployments, services, etc.), the admission controller examines that request and decides whether to allow it, reject it, or modify it before it's stored.

There are two types of admission controllers: validating controllers that only approve or deny requests, and mutating controllers that can modify the request before admission. For example, a mutating controller might automatically inject a sidecar container into every pod, while a validating controller might reject any image that doesn't come from an approved registry.

Built-in examples include PodSecurityPolicy (enforces security standards), ResourceQuota (prevents resource exhaustion), and NetworkPolicy (controls traffic). Organizations often deploy custom admission controllers via webhooks to enforce company-specific policies like requiring certain labels or blocking privileged containers.