ValidatingAdmissionPolicy

k8s Policy enginek8s-validating-admission-policy

In-process CEL admission rules evaluated by the API server instead of a validating webhook.

Provider: k8s
Kind: Policy engine
Category: Operations
Official docs: https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/

Properties · 3 set by this component

property	type	values	required	kind default	this component
bindingRequired · component property	boolean	—	no	true	inherited
effect	enum	audit \| deny \| modify \| deploy-if-not-exists	no	—	inherited
enforcementMode	enum	enforced \| disabled	no	—	inherited
expressionLanguage · component property	enum	cel	no	cel	inherited
inProcess · component property	boolean	—	no	true	inherited
managed	boolean	—	no	false	▸ false
policyCount	integer	—	no	—	inherited
remediation	boolean	—	no	false	▸ false
scope	enum	resource \| group \| account \| organization	no	—	▸ resource
validationAction · component property	enum	deny \| warn \| audit	no	—	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "validating-admission-policy", component: "k8s-validating-admission-policy" }

Other Policy engine products · 56

Cloud Configalibaba-cloud-configalibabacloudpolicy-engine Data Security Centeralibaba-data-security-centeralibabacloudpolicy-engine Amazon CodeGuru Revieweraws-codeguru-reviewerawspolicy-engine AWS Configaws-configawspolicy-engine AWS Control Toweraws-control-towerawspolicy-engine IAM Access Analyzeraws-iam-access-analyzerawspolicy-engine AWS Lake Formationaws-lake-formationawspolicy-engine AWS License Manageraws-license-managerawspolicy-engine AWS Organizationsaws-organizationsawspolicy-engine AWS Resource Access Manageraws-ramawspolicy-engine Amazon Verified Permissionsaws-verified-permissionsawspolicy-engine Microsoft Entra Conditional Accessazure-conditional-accessazurepolicy-engine Azure Policyazure-policyazurepolicy-engine Microsoft Entra Privileged Identity Managementazure-privileged-identity-managementazurepolicy-engine Cloudflare Data Loss Preventioncloudflare-dlpcloudflarepolicy-engine CalypsoAIcalypsoaipolicy-engine Cerboscerbospolicy-engine OPA Gatekeepergatekeeperpolicy-engine Guardrails AIguardrails-aipolicy-engine HiddenLayer AI Security Platformhiddenlayerpolicy-engine KubeArmorkubearmorpolicy-engine Kubewardenkubewardenpolicy-engine Kyvernokyvernopolicy-engine Lakera Guardlakera-guardpolicy-engine LLM Guardllm-guardpolicy-engine NeMo Guardrailsnemo-guardrailspolicy-engine Open Policy Agentopapolicy-engine Permit.iopermit-iopolicy-engine Generic policy enginepolicy-enginepolicy-engine Prompt Securityprompt-securitypolicy-engine Protect AIprotect-aipolicy-engine Rebuffrebuffpolicy-engine Robust Intelligencerobust-intelligencepolicy-engine SonarQube Serversonarqubepolicy-engine DigitalOcean CSPMdigitalocean-cspmdigitaloceanpolicy-engine Access Context Managergoogle-access-context-managergcppolicy-engine Assured Workloadsgoogle-assured-workloadsgcppolicy-engine Binary Authorizationgoogle-binary-authorizationgcppolicy-engine Identity and Access Managementgoogle-cloud-iamgcppolicy-engine Firebase App Checkgoogle-firebase-app-checkgcppolicy-engine

and 16 more → Policy engine page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Kubernetes ValidatingAdmissionPolicy: "a declarative, in-process alternative to validating
3# admission webhooks" that expresses admission rules in CEL ("Validating Admission Policy").
4# Per that page it is `admissionregistration.k8s.io/v1`, stable since v1.30, and evaluated
5# inside the API server with no webhook server to call. A policy does nothing until a
6# ValidatingAdmissionPolicyBinding scopes it and names its validationActions; there is no
7# default action, at least one of Deny, Warn or Audit must be declared, and Deny and Warn
8# cannot be combined.
9schemaVersion: "1"
10type: "component"
11id: "k8s-validating-admission-policy"
12kind: "policy-engine"
13provider: "k8s"
14docs: "https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/"
15defaults:
16  managed: false
17  scope: "resource"
18  remediation: false
19properties:
20  validationAction:
21    type: "enum"
22    values: ["deny", "warn", "audit"]
23  expressionLanguage:
24    type: "enum"
25    values: ["cel"]
26    default: "cel"
27  bindingRequired:
28    type: "boolean"
29    default: true
30  inProcess:
31    type: "boolean"
32    default: true

The same page as markdown, for an agent: /catalogue/components/k8s-validating-admission-policy.md