What is the primary function of Admission Controllers in Kubernetes?

What is the primary function of Admission Controllers in Kubernetes?

• A. To schedule pods on nodes
• B. To act as gatekeepers for pod creation and modification
• C. To store container images
• D. To manage cluster networking

Answer: (B)

Admission Controllers act as gatekeepers for API requests to Kubernetes. They run after a request to create or modify objects—such as a Pod—has been received by the API server and passed authentication and authorization, but before the change is stored. Their job is to enforce policies and rules by either allowing the operation, mutating the object to apply defaults or injections, or rejecting the request if it violates policy. This makes them the primary mechanism that governs whether a Pod (and other resources) can be created or updated in the cluster. Scheduling pods on nodes is the job of the Kubernetes Scheduler, which decides which node should run a given Pod. Storing container images is handled by image registries and the container runtime on each node, not by admission controls. Managing cluster networking is handled by networking components and CNI plugins, not admission controls.

Admission Controllers act as gatekeepers for API requests to Kubernetes. They run after a request to create or modify objects—such as a Pod—has been received by the API server and passed authentication and authorization, but before the change is stored. Their job is to enforce policies and rules by either allowing the operation, mutating the object to apply defaults or injections, or rejecting the request if it violates policy. This makes them the primary mechanism that governs whether a Pod (and other resources) can be created or updated in the cluster.

Scheduling pods on nodes is the job of the Kubernetes Scheduler, which decides which node should run a given Pod. Storing container images is handled by image registries and the container runtime on each node, not by admission controls. Managing cluster networking is handled by networking components and CNI plugins, not admission controls.