A platform team wants to enforce that all Kubernetes workloads define resource requests and limits before being admitted to the cluster. Which tool category best implements this at cluster admission time?

Question

Accepted Answer

B. An admission controller using a policy engine such as OPA Gatekeeper or Kyverno. Admission controllers with policy engines like OPA Gatekeeper or Kyverno intercept API server requests before resources are persisted and can enforce content-level policies such as requiring resource fields. RBAC controls who can perform actions but cannot enforce field content constraints. CI lint checks catch issues early but cannot block non-compliant manifests submitted through paths that bypass the CI pipeline.

A platform team wants to enforce that all Kubernetes workloads define resource requests and limits before being admitted to the cluster. Which tool category best implements this at cluster admission time?

Related Questions

Discussion