How Kubernetes Admission Control Turns Security Policies into Enforceable Gates

Kubernetes admission controllers evaluate workload requests before objects are saved to the cluster, allowing non-compliant pods to be rejected automatically rather than caught through manual review. The built-in Pod Security Admission enforces one of three security levels — privileged, baseline, or restricted — at the namespace level, and can run in audit or warn mode before full enforcement. Policy engines like Open Policy Agent Gatekeeper and Kyverno extend these controls to cover organisation-specific rules such as required image registries, resource limits, or labels. Experts recommend starting in audit mode to collect real violations before enforcing rules, keeping policy sources in version control, and restricting who can modify admission policies since any change affects the entire cluster. Admission control is a preventive gate and does not monitor runtime behaviour or remediate workloads that are already running.