From a5e270b7567c654a1cf608b9261f6aef959769b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= Date: Sun, 24 Mar 2024 15:41:22 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9D=20Update=20admission=20control=20u?= =?UTF-8?q?se=20cases?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks to Marcus Noble talk at Rejekts Paris 2024 💯 --- slides/k8s/admission.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/slides/k8s/admission.md b/slides/k8s/admission.md index 9c9e0914..4f122e81 100644 --- a/slides/k8s/admission.md +++ b/slides/k8s/admission.md @@ -20,19 +20,21 @@ ## Use cases -Some examples ... +- Defaulting -- Stand-alone admission controllers + *injecting image pull secrets, sidecars, environment variables...* - *validating:* policy enforcement (e.g. quotas, naming conventions ...) +- Policy enforcement and best practices - *mutating:* inject or provide default values (e.g. pod presets) + *prevent: `latest` images, deprecated APIs...* -- Admission controllers part of a greater system + *require: PDBs, resource requests/limits, labels/annotations, local registry...* - *validating:* advanced typing for operators +- Problem mitigation - *mutating:* inject sidecars for service meshes + *block nodes with vulnerable kernels, inject log4j mitigations...* + +- Extended validation for operators ---