Binary accept/reject admission webhooks miss a critical middle category of Kubernetes configurations that are technically valid but contextually dangerous. A four-tier admission response model (Gate, Warn, Note, Score) better addresses this gap. The Kubernetes admission API's Warnings field, available since 1.19, is largely underutilized and can surface real-time, plain-language warnings to engineers at kubectl apply time before any damage occurs. A concrete example from the kubernetes-sigs/node-readiness-controller shows how combining NoExecute taint with continuous enforcement mode can cause mass pod evictions, and how a graduated webhook with structured warnings prevents this. Key implementation decisions involve precise warning wording, careful CAUTION vs NOTE severity classification to avoid alert fatigue, thorough positive and negative test coverage, and metrics to measure whether warnings actually change operator behavior.
