Admission Control
Called until first rejection
Validating Webhook(s)
Validating Admission Policies
Mutating Webhook(s)
Authentication + Authorization
Kubernetes API Server
User
Validating Webhook(s)
Validating Admission Policies
Mutating Webhook(s)
Authentication + Authorization
Kubernetes API Server
User
loop
[For all Mutating Webhooks]
loop
[For all Validating Policies]
par
[For all Validating Webhooks in parallel]
Request (e.g., create a pod)
Authenticate user and
check user permissions
Invoke Mutating Webhooks
Modify or reject object (if needed)
Invoke Validating Policies
Reject object (if needed)
Invoke Validating Webhooks
Reject object (if needed)
Allow or reject request
Response (e.g., success or error)