What does an admission engine's replicated copy of cluster objects give a counting rule, and how is it wrong?

## What the copy is for Counting and uniqueness rules need objects the admission request does not contain. The common answer is to have the policy engine hold a local, continuously updated copy of a chosen set of kinds - it lists them once, then watches for changes - so a rule can ask *how many LoadBalancer Services exist in this namespace* or *does any Ingress already claim this host* without a network call in the middle of somebody's apply. That is a genuine capability. It is also a specific and limited one, and an interviewer probing this leaf wants to hear the limits named rather than the feature described. ## Limit 1: it is a read of the past The ordering is fixed and you cannot change it: the API server persists a write, then the change is delivered to watchers, then the local copy is updated. Every one of those steps takes time. A decision made in that gap is made against a state that does not include the write, even though the write already happened. For a limit of three, that means the fourth Service can be admitted if it arrives while the third is still propagating. The rule is not buggy - it answered correctly for the state it had. The state was simply behind. Say it precisely in an interview: **the copy is never the current cluster; it is the cluster as of a moment ago.** How far behind depends on watch delivery and the engine's own processing, and it stretches under load - exactly when writes are frequent and conflicts most likely. ## Limit 2: cold start When the engine process restarts - a rollout, an eviction, a node failure - its copy begins empty and repopulates from an initial listing. Until that finishes, a namespace with ten Services can look like a namespace with none. You get to choose which way that fails, and choosing by accident is the mistake: - **Serve anyway.** Rules evaluate against a partial view. Counting rules undercount, so they admit things they should have refused; uniqueness rules see no conflict, so they allow duplicates. Silent false passes. - **Refuse to serve until synced.** The engine reports itself not ready, and with a fail-closed configuration every matching write in the cluster is rejected until the copy is warm. Loud, safe, and an outage if warm-up is slow on a large cluster. Neither is wrong in the abstract; discovering which one you have during an incident is. Know it in advance, and monitor both sync completion and replication lag as signals with an actual owner. ## Limit 3: only what you nominated The copy holds the kinds someone configured it to hold. A rule referring to a kind that was never replicated does not get an error that stops the world - it gets nothing, and a rule reading nothing generally decides nothing is wrong. That is a quiet false pass with a configuration change, not a code change, as its root cause. Whenever a rule starts depending on a new kind, replicating that kind is part of the same change. ## Limit 4: it is not free Replication means keeping objects in memory and processing every change to them. Nominating a narrow kind such as Ingresses is cheap. Nominating a hot, high-cardinality kind because it might be useful is how a policy engine becomes the most memory-hungry component in the cluster and a source of load on the API server. Replicate what your rules actually read. ## Limit 5: it cannot see a decision in flight The copy only ever holds objects that have been written. Two conflicting requests being decided at the same instant are, by definition, not yet objects, so neither decision can see the other - no amount of freshness fixes that, because the information does not exist yet in any store. ## How to talk about it The honest summary is a downgrade, not a defect: replication turns a rule that is impossible into a rule that is usually right. It reliably catches the sequential case - somebody creating a fourth LoadBalancer an hour later - and it cannot catch the simultaneous case or the window after a restart. If an invariant genuinely must hold, admission plus a replicated copy is one layer, and it needs a detective sweep behind it that finds the violations that slipped through.