Skip to content

Admission controllers#

Admission controllers are plugins that govern and enforce cluster usage. There are two types of admission controllers: default and custom. The tables below list the available admission controllers. For more information, see Kubernetes documentation: Using Admission Controllers.

Note

You cannot enable or disable custom admission controllers.

Default admission controllers#

Name Description
DefaultStorageClass Adds a default storage class to PersistentVolumeClaim objects that do not request a specific storage class.
DefaultTolerationSeconds Sets the pod default forgiveness toleration to tolerate the notready:NoExecute and unreachable:NoExecute taints based on the default-not-ready-toleration-seconds and default-unreachable-toleration-seconds Kubernetes API server input parameters if they do not already have toleration for the node.kubernetes.io/not-ready:NoExecute or node.kubernetes.io/unreachable:NoExecute taints. The default value for both input parameters is five minutes.
LimitRanger Ensures that incoming requests do not violate the constraints in a namespace LimitRange object.
MutatingAdmissionWebhook Calls any mutating webhooks that match the request.
NamespaceLifecycle Ensures that users cannot create new objects in namespaces undergoing termination and that MKE rejects requests in nonexistent namespaces. It also prevents users from deleting the reserved default, kube-system, and kube-public namespaces.
NodeRestriction Limits the Node and Pod objects that a kubelet can modify.
PersistentVolumeLabel (deprecated) Attaches region or zone labels automatically to PersistentVolumes as defined by the cloud provider.
PodNodeSelector Limits which node selectors can be used within a namespace by reading a namespace annotation and a global configuration.
ResourceQuota Observes incoming requests and ensures they do not violate any of the constraints in a namespace ResourceQuota object.
ServiceAccount Implements automation for ServiceAccount resources.
ValidatingAdmissionWebhook Calls any validating webhooks that match the request.

Custom admission controllers#

Name Description
UCPAuthorization
  • Annotates Docker Compose-on-Kubernetes Stack resources with the identity of the user performing the request so that the Docker Compose-on-Kubernetes resource controller can manage Stacks with correct user authorization.
  • Detects the deleted ServiceAccount resources to correctly remove them from the scheduling authorization backend of an MKE node.
  • Simplifies creation of the RoleBindings and ClusterRoleBindings resources by automatically converting user, organization, and team Subject names into their corresponding unique identifiers.
  • Prevents users from deleting the built-in cluster-admin, ClusterRole, or ClusterRoleBinding resources.
  • Prevents under-privileged users from creating or updating PersistentVolume resources with host paths.
  • Works in conjunction with the built-in PodSecurityPolicies admission controller to prevent under-privileged users from creating Pods with privileged options. To grant non-administrators and non-cluster-admins access to privileged attributes, refer to Use admission controllers for access in the MKE Operations Guide.
CheckImageSigning Enforces MKE Docker Content Trust policy which, if enabled, requires that all pods use container images that have been digitally signed by trusted and authorized users, which are members of one or more teams in MKE.
UCPNodeSelector Adds a com.docker.ucp.orchestrator.kubernetes:* toleration to pods in the kube-system namespace and removes the com.docker.ucp.orchestrator.kubernetes tolerations from pods in other namespaces. This ensures that user workloads do not run on swarm-only nodes, which MKE taints with com.docker.ucp.orchestrator.kubernetes:NoExecute. It also adds a node affinity to prevent pods from running on manager nodes depending on MKE settings.