Tag
policy-enforcement
- May 9, 2026 What an Admission Webhook Can and Cannot Decide The position of admission control in the write path, the fields a webhook receives, and why cross-object invariants and external state cannot be enforced there. devops
- Jul 18, 2025 Admission-Time Verification and Digest Pinning What a cluster can check between a pod specification and an image pull, why the kubelet is the wrong place for that check, and how digest pinning interacts with tag resolution order. virtualization
- Aug 4, 2023 Admission Control as the Enforcement Point for a Golden Path Validating and mutating admission sit between the tenant and the stored object. How they differ, why mutation order is undefined, and what a rejection should tell the tenant. virtualization