← Archive · tsd.report
›
1 story

The Security Diff

Security engineering, without the noise.

Lead story · cloud

Admission control is where Kubernetes policy becomes executable

By Pankaj Mouriya ·

Evidence path for prioritizing a vulnerable componentA decision path checks whether a component is deployed, reachable, exploited, and covered by vendor guidance before action.PATCH DECISION / EVIDENCE PATHWhat changed?01DEPLOYEDcomponent + version02REACHABLEpath + exposure03EXPLOITEDdated evidence04ACTIONvendor guidanceSUPPORTED PRIORITYReachability + exploitation evidencebefore emergency change.
Decision sequence for prioritizing supported action from current evidence.

Kubernetes admission turns broad API permission into an object-level policy decision. The durable design starts with built-in controls and in-process validation, then treats webhooks as control-plane dependencies.

Why it matters

RBAC can authorize a workload creation request without deciding whether the submitted workload meets the cluster's security contract.

Affected

Kubernetes API server · Pod Security Admission · ValidatingAdmissionPolicy · Admission webhooks

Supported action

Map the admission policies protecting each cluster, prefer built-in or in-process controls where they fit, and test webhook latency, failure policy, exclusions, and recovery before enforcing broadly.

Evidence

Quick Guide on Kubernetes Admission Controllers · Retrieved Sep 29, 2026