Definition. An admission policy checks requests to the Kubernetes API server after they have been authenticated and authorised, but before the object is stored. The ValidatingAdmissionPolicy has been stable since Kubernetes 1.30. It evaluates rules written in the Common Expression Language (CEL) directly inside the API server. Kyverno and Gatekeeper are widely used alternatives that work as webhooks.

Why it matters. RBAC decides who may create a resource. An admission policy decides what it may look like. This lets you forbid dangerous configurations before they take effect, such as privileged pods, untrusted image sources or risky combinations of annotations.

Example. Against the Traefik flaw CVE-2026-114640, a rule rejecting Ingresses with a client certificate check and ssl-redirect disabled would have helped.

Related. Kubernetes, Pod Security Standards, NetworkPolicy