Admission and Policy

Access rules say who may create a pod. But they say nothing about what the pod contains. Should an image tagged latest be allowed? Should every pod have limits? Admission control answers such questions, by checking every request, before anything is stored. In this lesson, you will write a real policy.

• Who may is not enough
• Check what is inside the request
• Reject before it is stored

Where admission happens

Every write request passes through the A P I server in stages. Authentication, then authorization, and then admission. There are two kinds of admission. Mutating admission may change the request, for example, to add a default, or a sidecar. Validating admission may only approve, or reject. If any check rejects, the request fails, and nothing is stored. Admission is how a platform team enforces rules, for everybody, without trusting every developer to remember them.

1. Authenticatewho are you?
2. Authorizemay you do this?
3. Mutatedefaults and additions
4. Validateapprove or reject

A validating policy

Here is a built in policy, written in a small expression language. It applies to pods that are being created. The validation is one line. All containers must have an image that does not end with colon latest. And the message is what the user will see, when blocked. A second object, the binding, applies the policy, here only to namespaces labelled policy equals strict. Separating the rule from where it applies, lets you roll out safely.

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: no-latest
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      operations: ["CREATE"]
      resources: ["pods"]
  validations:
  - expression: "object.spec.containers.all(c, !c.image.endsWith(':latest'))"
    message: "Images must not use the :latest tag"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: no-latest-binding
spec:
  policyName: no-latest
  validationActions: ["Deny"]
  matchResources:
    namespaceSelector:
      matchLabels:
        policy: strict

A policy that says no

Let's try it. We create a namespace, and label it strict. We apply the policy and its binding. Now we try to run a pod with the latest tag, in that namespace. The A P I server rejects it, and shows our message. A pod with a fixed version is accepted. Anyone, from any tool, gets the same answer. For larger rule sets, tools such as Kyverno and Gatekeeper let you manage many policies, in the same spirit.

kubectl create namespace strict
namespace/strict created
kubectl label namespace strict policy=strict
namespace/strict labeled
kubectl apply -f no-latest.yaml
validatingadmissionpolicy.admissionregistration.k8s.io/no-latest created
validatingadmissionpolicybinding.admissionregistration.k8s.io/no-latest-binding created
kubectl run x --image=nginx:latest -n strict 2>&1 | cut -c1-150
The pods "x" is invalid: : ValidatingAdmissionPolicy 'no-latest' with binding 'no-latest-binding' denied request: Images must not use the :latest tag
kubectl run y --image=nginx:1.27 -n strict
pod/y created

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: no-latest
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      operations: ["CREATE"]
      resources: ["pods"]
  validations:
  - expression: "object.spec.containers.all(c, !c.image.endsWith(':latest'))"
    message: "Images must not use the :latest tag"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: no-latest-binding
spec:
  policyName: no-latest
  validationActions: ["Deny"]
  matchResources:
    namespaceSelector:
      matchLabels:
        policy: strict

Summary