Kubernetes Admission Control

The StatefulSet's volume claim template predates the policy and lacks the required label. Its existing replicas were never re-evaluated, but each new replica makes the controller create a fresh PVC, and that create is denied at admission.

Not at admission. Admission decides once, when the object is written, and a process fetching code an hour later produces no API request, so no rule runs. Admission can narrow what the workload is granted; only a runtime sensor can observe the act.

Report the count from an inventory of stored PVCs, not the dashboard. A 100% pass rate describes admission requests since the rule was enabled; the auditor asked about the population of objects that exist, which only enumerating them answers.

Deny already reports the failure in the API response the client receives, so adding Warn would repeat the identical text in a 299 warning header. Kubernetes disallows the pair as pointless duplication; Audit combines with either one.

At admission time the NetworkPolicy cannot exist yet: it lives inside the namespace being created. The rule asks about a future state at the one instant it cannot be true, so it rejects everything.

Because the exemption is checked against the requester, and the request that gets blocked is the Pod create — made by the ReplicaSet controller's service account, not by the person. The human's name only ever appears on the Deployment request.

Equivalent makes a rule fire even when a request arrives under an API version the rule did not list, converting the object first. Exact intercepts only the listed group, version and resource, so other served versions pass unevaluated.

An admission mutation patched the object before it was stored, so the cluster is compliant and the committed file is not. Confirm it with a server-side dry-run, then fix the manifest - the live object is not your source of truth.

Kubernetes statically estimates each expression's worst-case evaluation cost when the policy object is written, and refuses it if the estimate exceeds the limit. Nested iteration over collections the schema does not bound is the usual cause.

Only if the rule is worth the credential. An admission request carries no other object, so the engine must fetch state itself, and a standing cluster-wide read turns the enforcement plane into a cross-namespace reader and an escalation target.

Name the team that will upgrade it and carry its pager before you install it. Require a rehearsable upgrade: pinned versions, documented schema changes to the policy resources, rule tests re-run first, and a back-out on-call can execute.

Accept the requirement and refuse the placement. Name the fact that is missing from the request, name where it exists and who owns the check there, get the requirement recorded against that owner, and state on the coverage map that admission enforces nothing for it.