Pod security admission controller in Kubernetes - Step-by-Step Execution

Process Flow - Pod security admission controller

Pod Creation Request

↓

Admission Controller Intercepts

↓

Check Pod Security Policy

↓

Allow

↓

Pod Created or Denied

When a pod is created, the admission controller checks its security settings. It either allows, warns, or denies the pod based on policy.

Execution Sample

Kubernetes

kubectl apply -f pod.yaml
# Pod creation intercepted
# Pod security admission controller checks policy
# Pod allowed or denied based on policy

This simulates creating a pod and how the admission controller checks its security before allowing creation.

Process Table

Step	Action	Pod Security Check	Result	Effect
1	Pod creation request received	N/A	Intercepted	Admission controller activated
2	Check pod against policy	Pod spec matches 'restricted' profile	Pass	Pod allowed
3	Pod creation proceeds	N/A	Success	Pod created in cluster
4	End	N/A	No further checks	Process complete

💡 Pod matches security policy, so creation is allowed and completes successfully

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
pod_creation_status	Not started	Intercepted	Allowed	Created	Created
security_check_result	None	Pending	Pass	N/A	Pass

Key Moments - 3 Insights

Why does the pod creation get intercepted before it is created?

The admission controller intercepts all pod creation requests to enforce security policies, as shown in execution_table step 1.

What happens if the pod does not meet the security policy?

If the pod fails the security check, it would be rejected and not created. This is implied by the 'Fail' branch in the concept_flow.

Why is there a 'warn' option in the policy check?

The 'warn' option allows the pod creation but logs a warning for administrators, helping them notice potential issues without blocking pods, as shown in concept_flow.

Visual Quiz - 3 Questions

Look at the execution_table, what is the pod_creation_status after step 2?

A Intercepted

B Allowed

C Created

D Rejected

💡 Hint

Check the variable_tracker row for pod_creation_status after step 2

At which step does the pod get created in the cluster?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at execution_table 'Effect' column for when pod creation completes

If the pod failed the security check, what would happen according to the concept_flow?

A Pod creation is rejected

B Pod creation is allowed with a warning

C Pod creation proceeds normally

D Pod creation is delayed

💡 Hint

Refer to the 'Fail' branch in the concept_flow diagram

Concept Snapshot

Pod Security Admission Controller intercepts pod creation requests.
It checks pods against security policies.
Pods can be allowed, warned, or rejected.
Allows enforcing cluster security automatically.
Configured via Kubernetes admission controllers.

Full Transcript

When you create a pod in Kubernetes, the Pod Security Admission Controller steps in before the pod is actually created. It checks the pod's security settings against predefined policies. If the pod meets the policy, it is allowed and created. If it only partially meets the policy, it may be allowed but with a warning logged. If it fails the policy, the pod creation is rejected. This process helps keep the cluster secure by enforcing rules automatically on every pod creation request.