Admission Controller
What is an Admission Controller?
An Admission Controller is a component of Kubernetes, which validates or mutates API requests before persisting the request to the storage of the Kubernetes API server. The Admission Controller executes after the authentication and authorization phases of processing an API request. The Admission Controller verifies resource requests like Pods Deployments Services ConfigMaps etc. It then selects pre-defined admission rules to the requested resource. Admission rules enforce security, policy, configuration, and resource needs to a Kubernetes cluster.
How Does an Admission Controller Work?
An Admission Controller gets invoked if an API request is made, after the API server has authorized and authenticated the request. The API server, before saving the resource, invokes any admission controllers configured to run in sequence. If a validating admission controller gets invoked it will authorize or not the request depending on its internal policy. For a mutating admission controller the request will be modified before validation:
Admission controllers will enforce various policies per the needs of the cluster. For example, cluster requirements may demand certain security constraints on all Pod’s. Another requirement could be for allowed container image registries to be specified by the policy. Resource demands might have minimum CPU or memory allocations. That’s why admission is an optional enforcement gateway between API requests and resource creation.
Key Characteristics of Admission Controller
- Request validation: An Admission Controller validates every request to the API server against established policies before any resource is created or changed.
- Policy enforcement: Policies are the wrappers that enforce security, configuration, resource, and operational requirements on all Kubernetes resources.
- Request mutation: a mutating admission controller intercepts resource fields just before admission is finally verified.
- Resource control: Admission rules impose requirements on resources like Pods, Deployments, Services, and ConfigMaps.
- Cluster safety: Security rules prevent risky configurations, illicit parameters, and invalid resource definitions.
Benefits of Admission Controller
- More robust policy enforcement: Admission controllers enforce policy decisions immediately in the process of handling each request to the Kubernetes API.
- More robust security: Security rules prevent resource configurations that infringe cluster security policies from being done.
- Consistent configuration: The admission policies apply the same configuration demands on the resources and workload.
- Fewer configuration errors: Autoscaling of validation and mutation catches a number of resource configurations.
- Centralized control: Cluster administrators manage important resource policies through a centralized admission layer.
Admission Controller in Cloud Computing
Admission controllers assist organizations to manage workloads executing on Kubernetes in cloud setups. They implement resource policies before containerized applications and infrastructure components are introduced into a cluster.
For example, a cluster policy could mandate that all application containers have to specify requests for CPU and memory. A validating admission controller will turn down a deployment if these parameters are missing from the definition. A mutating admission controller could automatically insert standard values for these parameters if they are missing from the definition.