validating webhook
also: admission webhook (validation phase), ValidatingAdmissionWebhook
A validating webhook is a mechanism that intercepts and validates API requests in Kubernetes before they are persisted, allowing you to enforce custom business logic or policy compliance at the API level.
A validating webhook is a user-defined HTTP callback that Kubernetes invokes automatically before accepting certain API operations (CREATE, UPDATE, DELETE, CONNECT). If the webhook rejects a request, the API call fails immediately without modifying the cluster.
Validating webhooks are commonly used to enforce organizational policies, such as requiring all container images come from an approved registry, ensuring pod security standards, or validating custom resource definitions have required fields. Unlike mutating webhooks which can modify the request, validating webhooks only accept or reject.
Example: a validating webhook might inspect an incoming Pod creation request and reject it if the image doesn't match registry.company.com/*. The webhook runs before the Pod is stored in etcd, preventing non-compliant objects from entering the cluster.