privileged: true. Admission control fills that gap by inspecting and potentially mutating or rejecting API objects before they are stored.

privileged: true and hostNetwork: true to debug networking. That Pod had access to the host network stack and the potential to interact with other containers on the node. An attacker exploited a container vulnerability and escaped to the host.
RBAC could not prevent this because it does not inspect Pod specs; admission control can.

- Containers running as root or with
runAsUser: 0. - Images pulled from untrusted registries.
- Missing CPU/memory resource
requestsandlimits. - Missing or incorrect mandatory labels (e.g.,
team,cost-center). - Pods with
privileged: trueorhostNetwork: true.

RBAC and admission control are complementary: RBAC gates who can call the API and which resource types they can act on; admission control inspects the resource content and enforces configuration policies.
- Authentication — verifies who you are.
- Authorization (RBAC) — verifies whether you are allowed to perform the action on the resource type.
- Mutating admission webhooks — may modify the incoming object (run before validation).
- Validating admission webhooks — accept or reject the (possibly mutated) object.
- Persistence — if all checks pass, the object is stored in etcd.

Mutating webhooks can change objects (for example, inject defaults or sidecars). Validating webhooks only accept or reject. Because mutating webhooks can affect the final object, they must run before validating webhooks.
- Mutating webhooks
- Modify the incoming object.
- Common uses: inject sidecars (logging, service mesh), add default labels/annotations, populate missing resource
requests/limits.
- Validating webhooks
- Only accept or reject the object.
- Common uses: block
privileged: true, enforce image registry whitelists, require specific labels, enforce resource limits.
These six policy types cover the majority of platform enforcement needs and are a good starting point for a policy catalog.

Many organizations use both: Gatekeeper for sophisticated validation rules and Kyverno for YAML-native mutation/validation and resource generation.

- NamespaceLifecycle — prevents creating objects in namespaces that are terminating.
- LimitRanger / ResourceQuota — enforce defaults and resource usage quotas.
- ServiceAccount / TokenVolumeProjection — handle service account tokens in Pods.
- PodSecurity — enforce Pod Security Standards (PSS).
- MutatingAdmissionWebhook / ValidatingAdmissionWebhook — the API hooks that call external webhook servers.

- RBAC controls who may call the API; admission control inspects the payload and enforces configuration rules.
- Mutating webhooks run first to modify objects; validating webhooks run afterward to accept or reject the final object.
- Start with a small policy set: image registry whitelist, required labels, block privileged pods, require resource limits, inject defaults, and sidecar injection.
- Gatekeeper (Rego) is powerful for complex validation; Kyverno (YAML) is easier to adopt and supports mutation and generation.
- Use built-in admission controllers (LimitRanger, ResourceQuota, PodSecurity) alongside external engines for full coverage.
- Kubernetes Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
- Pod Security Standards (PSS): https://kubernetes.io/docs/concepts/security/pod-security-standards/
- OPA Gatekeeper: https://github.com/open-policy-agent/gatekeeper
- Kyverno: https://kyverno.io/
When implementing admission policies, start with non-blocking enforcement (audit mode) where possible, validate policy behavior on a staging cluster, and progressively enforce to avoid unexpected production disruptions.