<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-kubernetes-admission-controllers
description: >-
  Deploy and configure OPA/Gatekeeper, Kyverno, and custom webhook admission
  controllers to enforce security policies on Kubernetes workloads at admission
  time — blocking privileged pods, enforcing image registries, and requiring
  security contexts.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - opa
  - gatekeeper
  - kyverno
  - admission-controller
  - webhook
  - pod-security
  - policy-as-code
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Kubernetes Admission Controllers

## Overview

Admission controllers intercept API requests before persistence, enabling
real-time policy enforcement. This skill covers OPA/Gatekeeper constraint
templates, Kyverno policies, and custom ValidatingWebhookConfigurations for
blocking non-compliant workloads.

Mode: `[MODE: BLUE]` — Preventive policy enforcement. `[MODE: ARCHITECT]` — Policy design.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster >= 1.28 | Required |
| Gatekeeper >= 3.15 or Kyverno >= 1.11 | Required |
| kubectl with cluster-admin access | Required |

## Key Concepts

### OPA/Gatekeeper: Block Privileged Containers

```yaml
# ConstraintTemplate
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sblockprivileged
spec:
  crd:
    spec:
      names:
        kind: K8sBlockPrivileged
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8sblockprivileged
      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        container.securityContext.privileged == true
        msg := sprintf("Privileged container not allowed: %v", [container.name])
      }

---
# Constraint
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockPrivileged
metadata:
  name: block-privileged-containers
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    namespaces: ["production", "staging"]
```

### Kyverno: Enforce Image Registry

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  rules:
  - name: validate-image-registry
    match:
      any:
      - resources:
          kinds: ["Pod"]
    validate:
      message: "Images must come from approved registries."
      pattern:
        spec:
          containers:
          - image: "registry.internal.com/* | gcr.io/my-project/*"
```

### Kyverno: Require Security Context

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-run-as-nonroot
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-runasnonroot
    match:
      any:
      - resources:
          kinds: ["Pod"]
    validate:
      message: "Containers must run as non-root."
      pattern:
        spec:
          containers:
          - securityContext:
              runAsNonRoot: true
```

### Test Admission Policies

```bash
# Dry-run test against live policies
kubectl apply --dry-run=server -f test-pod.yaml

# Gatekeeper audit
kubectl get constraints -A -o json | jq '.items[].status.totalViolations'

# Kyverno policy report
kubectl get policyreport -A -o json | jq '.items[].results[] | select(.result == "fail")'
```

## Workflow

```bash
# Step 1: Audit current admission controllers
node scripts/agent.js --action audit

# Step 2: Test policy enforcement
node scripts/agent.js --action test --manifest test-pod.yaml

# Step 3: Review violations
node scripts/agent.js --action violations --output /tmp/violations.json
```

## Detection

```yaml
title: Kubernetes Admission Controllers Detection
id: da42205c-c378-487a-81a4-dff6a4de5c51
status: experimental
description: Detects suspicious activity related to implementing kubernetes admission controllers techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Kubernetes Admission Controllers Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Gatekeeper or Kyverno deployed with Enforce mode
- [ ] Privileged containers blocked in production namespaces
- [ ] Image registry allowlist enforced
- [ ] Security contexts required (runAsNonRoot, readOnlyRootFilesystem)
- [ ] Constraint violations produce audit trail
- [ ] Dry-run testing validates policies before production

## References

- [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper/)
- [Kyverno Documentation](https://kyverno.io/docs/)
- [K8s Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/)
