Which is a potential use case for an Admission Controller in a Kubernetes cluster?

Which is a potential use case for an Admission Controller in a Kubernetes cluster?

• A. Enforcing a policy that a certain namespace doesn't exceed a given memory threshold
• B. Scheduling pods on specific nodes
• C. Automatically creating namespaces on demand
• D. Disabling admission controls

Answer: (A)

Admission Controllers act as gatekeepers at the API server, inspecting requests to create or modify objects and enforcing policies before they are stored. They can enforce rules such as quotas and resource limits to keep a cluster within safe bounds. Enforcing a policy that a specific namespace cannot exceed a memory threshold fits this role well because a Namespace ResourceQuota can cap the total memory usage in that namespace; when a new pod or resource would push beyond that limit, the admission process rejects the request, preventing over-allocation. Scheduling pods on particular nodes is handled by the scheduler, not the admission phase. Automatically creating namespaces on demand would be the job of a separate controller or operator that watches for needs and creates resources. Disabling admission controls would defeat their purpose and isn’t a legitimate use case.

Admission Controllers act as gatekeepers at the API server, inspecting requests to create or modify objects and enforcing policies before they are stored. They can enforce rules such as quotas and resource limits to keep a cluster within safe bounds. Enforcing a policy that a specific namespace cannot exceed a memory threshold fits this role well because a Namespace ResourceQuota can cap the total memory usage in that namespace; when a new pod or resource would push beyond that limit, the admission process rejects the request, preventing over-allocation.

Scheduling pods on particular nodes is handled by the scheduler, not the admission phase. Automatically creating namespaces on demand would be the job of a separate controller or operator that watches for needs and creates resources. Disabling admission controls would defeat their purpose and isn’t a legitimate use case.