How Admission Controllers Work

Kubernetes provides a set of more than 25 admission controllers. A set of admission controllers is enabled by default and the cluster administrator can pass flags to the API server to control enabling/disabling the additional controllers (configuring the API server in a production-grade cluster is outside the scope of this book). These can be broadly divided into two types:

• Mutating admission controllers allow you to modify the request before it gets applied to the Kubernetes platform. LimitRanger is one such example, which applies the defaultRequests to the Pod if it is undefined by the Pod itself.
• Validating admission controllers validate the request and cannot change the request object. If this controller rejects the request, it will not be actioned by the Kubernetes platform. An example of this would be the NamespaceExists controller, which rejects the request if the namespace referenced in the request is not available.

Essentially...