🔹 Beginner Level Questions

1. What is an Admission Controller in Kubernetes?

👉 A component that intercepts API requests after authentication and authorization, and before persistence, to validate or modify them.

2. At what stage do Admission Controllers run?

👉 After:

Authentication
Authorization
But before:
Object is stored in etcd

3. What are the two main types of Admission Controllers?

Mutating Admission Controllers → Modify requests
Validating Admission Controllers → Accept or reject requests

4. What is the difference between mutating and validating controllers?

Feature	Mutating	Validating
Can modify object	✅ Yes	❌ No
Execution order	Runs first	Runs after mutation
Purpose	Add/change fields	Enforce rules

5. Why are Admission Controllers important?

Enforce security policies
Maintain consistency
Prevent misconfigurations
Automate defaults

🔹 Intermediate Level Questions

6. Name some built-in Admission Controllers.

NamespaceLifecycle
LimitRanger
ServiceAccount
ResourceQuota
PodSecurity

7. What is a MutatingAdmissionWebhook?

👉 A custom webhook that can modify incoming requests before they are stored.

8. What is a ValidatingAdmissionWebhook?

👉 A webhook that validates requests and either allows or rejects them.

9. What is the order of execution for Admission Controllers?

Mutating Admission Controllers
Object is updated
Validating Admission Controllers

10. What is a real-world use case of Admission Controllers?

Injecting sidecars (e.g., service mesh)
Blocking privileged containers
Enforcing labels and annotations

11. How do Admission Controllers improve security?

Prevent root containers
Enforce Pod Security Standards
Restrict image registries

12. What happens if a validating admission controller fails?

👉 The request is rejected and not persisted.

🔹 Advanced Level Questions

13. How do dynamic admission controllers work?

👉 They use webhooks:

API server sends request to external service
Service returns allow/deny or patch
API server applies decision

14. What is a JSON Patch in mutating webhooks?

👉 A format used to describe changes to a resource (add, replace, remove fields).

15. What is the role of AdmissionReview object?

👉 It is the request/response structure used between API server and webhook.

16. How do you secure an admission webhook?

Use TLS certificates
Authenticate API server
Restrict network access

17. What is failurePolicy in webhooks?

Fail → Reject request if webhook fails
Ignore → Allow request even if webhook fails

18. What is matchPolicy?

👉 Determines how rules match API versions (Exact or Equivalent).

19. How do Admission Controllers differ from RBAC?

Feature	Admission Controllers	RBAC
Purpose	Policy enforcement	Access control
Stage	After authorization	During authorization
Scope	Object content	User permissions

20. Can Admission Controllers modify existing resources?

👉 Yes, during update requests—but not after persistence unless triggered again.

🔹 Scenario-Based Questions (Very Important)

21. How would you prevent developers from using the `latest` image tag?

👉 Use a Validating Admission Webhook to reject such requests.

22. How would you automatically add labels to all Pods?

👉 Use a Mutating Admission Webhook.

23. How would you enforce resource limits across namespaces?

👉 Use LimitRanger or a custom validating webhook.

24. How would you block privileged containers?

👉 Use Pod Security Admission or validating webhook rules.

25. What would you do if your webhook is slowing down API requests?

👉

Optimize webhook logic
Reduce external dependencies
Use caching
Set timeout and failurePolicy properly

🔹 Expert / System Design Questions

26. How would you design a scalable admission webhook system?

Stateless services
Load balancing
Low-latency processing
Retry mechanisms

27. What are performance considerations for Admission Controllers?

Latency impact on API server
High availability
Timeout configuration

28. How do you debug admission controller issues?

Check API server logs
Inspect webhook logs
Use kubectl describe
Validate certificates

29. What is the difference between PodSecurityPolicy (PSP) and Pod Security Admission?

👉 PSP is deprecated; replaced by Pod Security Admission (built-in, simpler model).

30. Can multiple admission controllers act on the same request?

👉 Yes, they run in sequence.

🔹 Quick Interview Tips

Always mention request flow (Auth → AuthZ → Admission)
Clearly explain mutating vs validating
Give real-world examples
Talk about webhooks (very important in interviews)

Admission Controller in Kubernetes Interview Questions