Which order best represents the typical processing sequence for a Kubernetes API request?

Which order best represents the typical processing sequence for a Kubernetes API request?

• A. Authentication, Authorization, Admission Control
• B. Authentication, Admission Control, Authorization
• C. Authorization, Authentication, Admission Control
• D. Admission Control, Authentication, Authorization

Answer: (A)

Requests to the Kubernetes API server are processed in this order: first determine who is making the request (authentication), then verify what that user is allowed to do (authorization), and finally apply policy and defaults before the object is stored (admission control). Authentication confirms identity using tokens, certificates, or other methods. Authorization checks that identity against permissions (RBAC, ABAC, etc.) to see if the requested action on the resource is allowed. If both steps pass, admission controllers—both mutating and validating—run to modify or validate the object before it is persisted. This sequence ensures security and policy enforcement before any changes are saved. Doing admission control before authentication or authorization would allow policy actions to occur without knowing who is making the request, which could bypass proper access checks. Likewise, authenticating after authorization would mean trying to authorize an unknown identity.

Requests to the Kubernetes API server are processed in this order: first determine who is making the request (authentication), then verify what that user is allowed to do (authorization), and finally apply policy and defaults before the object is stored (admission control). Authentication confirms identity using tokens, certificates, or other methods. Authorization checks that identity against permissions (RBAC, ABAC, etc.) to see if the requested action on the resource is allowed. If both steps pass, admission controllers—both mutating and validating—run to modify or validate the object before it is persisted.

This sequence ensures security and policy enforcement before any changes are saved. Doing admission control before authentication or authorization would allow policy actions to occur without knowing who is making the request, which could bypass proper access checks. Likewise, authenticating after authorization would mean trying to authorize an unknown identity.