Kubernetes Admission Control Enforces Cluster Policies, Explains Policy Inconsistencies

Admission control is the final enforcement mechanism in the Kubernetes API server, following authentication and authorization. It consists of mutating and validating phases, where webhooks and built-in controllers can modify or reject resource requests. This process explains why identical policies can have different outcomes across clusters, as the order of webhook execution is critical. Tools like Pod Security Admission provide built-in, namespace-level security baselines, while external policy engines like Gatekeeper offer more granular, parameterized rules. The operational success of these systems depends on careful configuration, such as failing securely and managing policy exceptions with clear audit trails.