<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-admission-controllers
description: >-
  Implement Kubernetes admission controllers including OPA Gatekeeper, Kyverno,
  and custom validating/mutating webhooks to enforce security policies at the
  API server level before resources are persisted to etcd.
domain: cybersecurity
subdomain: container-security
tags:
  - admission-controllers
  - gatekeeper
  - kyverno
  - validating-webhook
  - mutating-webhook
  - policy-enforcement
  - kubernetes
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Admission Controllers

## Overview

Kubernetes admission controllers intercept API requests after authentication
and authorization but before persistence, enabling real-time policy enforcement.
This skill covers built-in admission controllers, deploying OPA Gatekeeper with
Rego constraint templates, Kyverno declarative policies, and building custom
validating and mutating webhooks.

Mode: `[MODE: ARCHITECT]` — Policy architecture and enforcement design.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes >= 1.25 with admission webhook support | Required |
| `kubectl` with cluster-admin access | Required |
| OPA Gatekeeper >= 3.14 or Kyverno >= 1.10 | Required |
| For custom webhooks | TLS certificates for webhook endpoint |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/implementing-admission-controllers-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/implementing-admission-controllers-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/implementing-admission-controllers-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Admission Controllers Detection
id: a0117b93-bb72-4a2a-a0f8-74739ff13aba
status: experimental
description: Detects suspicious activity related to implementing admission controllers techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Admission Controllers Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Kubernetes Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/)
- [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper/)
- [Kyverno](https://kyverno.io/docs/)
