failure policy
The setting that decides what the API server does when an admission webhook or policy cannot give an answer: Fail refuses the request, Ignore admits it.
In more detail
Fail is the default for webhooks and is the safe choice for security checks, as long as the webhook is scoped so that it cannot block kube-system. Ignore fails open, so an outage of the webhook silently admits everything. Webhook calls also time out, after 10 seconds by default and at most 30.
Related terms
- webhook — An HTTP request a provider sends to an address you registered, to tell you an event happened, instead of you polling for it.
- admission controller — A Kubernetes API server plugin that checks or changes each request after authentication and authorization, before the object is stored.
Taught in
- Forty Minutes Of Yes: Admission Control — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep
- Platform Sprint: Evidence, Order, Proof — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep
- Forty Three Of Sixty: The Mock, And How To Read It — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep
- Audit Day: Final Review — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep