--- title: Kubernetes Admission Controllers, Explained: What They... description: Kubernetes admission controllers are the hidden checkpoint every API request passes through after authentication and authorization but before being persisted... canonical: https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work | daily.dev og:description: Kubernetes admission controllers are the hidden checkpoint every API request passes through after authentication and authorization but before being persisted... og:url: https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1 og:image: https://api.daily.dev/og/posts/YpslWR8h1.png og:image:alt: Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work **[Medium](https://daily.dev/sources/medium_js)** · 12 min read · 3 upvotes · 0 comments ## Summary Kubernetes admission controllers are the hidden checkpoint every API request passes through after authentication and authorization but before being persisted to etcd. The post explains the two-phase pipeline: mutating admission (which can modify objects via JSON Patch) runs first, followed by validating admission (which can only accept or reject). Dynamic admission control works via webhooks — HTTPS servers that receive an AdmissionReview JSON object and return a verdict or patch. The post covers the wire contract, why mutations must precede validation, TLS requirements (caBundle, SAN matching, cert mounting), failure modes (failurePolicy), and operational caveats like latency and scope. A reference Go implementation is provided on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between a mutating and a validating admission webhook in Kubernetes? A mutating webhook can change an incoming object by returning a JSON Patch (RFC 6902), such as adding labels or injecting sidecars, and always runs first. A validating webhook can only approve or reject the final object with an allowed true/false response and runs after all mutations and schema validation are complete, so it judges the object exactly as it will be persisted to etcd. _Compare mutating and validating webhook design patterns on daily.dev before writing your own admission controller._ ### Why does the Kubernetes API server require admission webhooks to use HTTPS with a caBundle? The API server refuses to call any admission webhook without mutual TLS trust because the webhook can rewrite or veto every object entering the cluster, making it a high-value target for impersonation. The registration's caBundle field supplies the base64-encoded CA certificate the API server uses to verify the webhook's TLS certificate, whose Subject Alternative Name must match the in-cluster service DNS exactly. _Track TLS and security requirements for cluster tooling like admission webhooks on daily.dev._ ### What happens when a Kubernetes admission webhook is unreachable and how does failurePolicy affect this? The failurePolicy field on the webhook configuration determines the outcome: set to Fail, an unreachable webhook blocks the matching request entirely; set to Ignore, the request is allowed through as if the webhook did not exist. Choosing wrong can either take down deployments when the webhook is down or silently disable the intended policy enforcement. _Weigh failurePolicy trade-offs for admission webhooks alongside other Kubernetes reliability decisions on daily.dev._ ## Similar posts on daily.dev - [Why Kubernetes Admission Control Is Really a Security UX Problem](https://daily.dev/posts/why-kubernetes-admission-control-is-really-a-security-ux-problem-f7qyqhnfg) · Cloud Native Now · 0 upvotes · 0 comments - [Close the Gap Between Kubernetes Visibility and Enforcement with Orca’s Admission Controller](https://daily.dev/posts/close-the-gap-between-kubernetes-visibility-and-enforcement-with-orca-s-admission-controller-ka6zen3wo) · Orca Security Blog · 0 upvotes · 0 comments - [Inside the Kubernetes API Server: The Brain Behind Every Kubernetes Operation](https://daily.dev/posts/inside-the-kubernetes-api-server-the-brain-behind-every-kubernetes-operation-dmpyolvtj) · Medium · 0 upvotes · 0 comments - [A Brief Deep-Dive into Attacking and Defending Kubernetes](https://daily.dev/posts/a-brief-deep-dive-into-attacking-and-defending-kubernetes-vxcbvujil) · Tech Lead Digest · 5 upvotes · 0 comments - [Kubernetes Architecture Made Simple: A School Analogy](https://daily.dev/posts/kubernetes-architecture-made-simple-a-school-analogy-gurwayqpg) · Container Journal · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work","url":"https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1"},"datePublished":"2026-07-29T07:32:44.598Z","dateModified":"2026-09-14T07:39:35.486Z","description":"Kubernetes admission controllers are the hidden checkpoint every API request passes through after authentication and authorization but before being persisted...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d1db0c376371d2b14c5e5eeb6ff5a7a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d1db0c376371d2b14c5e5eeb6ff5a7a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,golang","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1#faq","mainEntity":[{"@type":"Question","name":"What is the difference between a mutating and a validating admission webhook in Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"A mutating webhook can change an incoming object by returning a JSON Patch (RFC 6902), such as adding labels or injecting sidecars, and always runs first. A validating webhook can only approve or reject the final object with an allowed true/false response and runs after all mutations and schema validation are complete, so it judges the object exactly as it will be persisted to etcd. Compare mutating and validating webhook design patterns on daily.dev before writing your own admission controller."}},{"@type":"Question","name":"Why does the Kubernetes API server require admission webhooks to use HTTPS with a caBundle?","acceptedAnswer":{"@type":"Answer","text":"The API server refuses to call any admission webhook without mutual TLS trust because the webhook can rewrite or veto every object entering the cluster, making it a high-value target for impersonation. The registration's caBundle field supplies the base64-encoded CA certificate the API server uses to verify the webhook's TLS certificate, whose Subject Alternative Name must match the in-cluster service DNS exactly. Track TLS and security requirements for cluster tooling like admission webhooks on daily.dev."}},{"@type":"Question","name":"What happens when a Kubernetes admission webhook is unreachable and how does failurePolicy affect this?","acceptedAnswer":{"@type":"Answer","text":"The failurePolicy field on the webhook configuration determines the outcome: set to Fail, an unreachable webhook blocks the matching request entirely; set to Ignore, the request is allowed through as if the webhook did not exist. Choosing wrong can either take down deployments when the webhook is down or silently disable the intended policy enforcement. Weigh failurePolicy trade-offs for admission webhooks alongside other Kubernetes reliability decisions on daily.dev."}}]} ```