# admission Published articles for admission. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界 DevFeed: [【kube-apiserver】Admission 链概览：内置插件顺序与 webhook 边界]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes]() Tags: [admission](), [api](), [apiserver](), [authz](), [controllers](), [distributed](), [kubernetes](), [mutating](), [namespace-lifecycle](), [openapi](), [resourcequota](), [timeout](), [v1-30-3](), [validating](), [webhook]() ### AI overview This tutorial explains the Kubernetes v1.30.3 admission chain in kube-apiserver. It places Admission between authorization and storage, describes the Mutating-then-Validating order, and covers built-in plugins, webhooks, timeout behavior, and fail-open versus fail-closed considerations. ### Source excerpt 钉 Kubernetes v1.30.3 Admission 链的阶段位置、Mutating 与 Validating 两阶段顺序、内置插件注册路径与典型示例、webhook 边界与 timeout 语义，以及 fail-open vs fail-closed 的工程争议。 ## 【kube-apiserver】控制面全景：缺口、五轴坐标系与 16 篇路线 DevFeed: [【kube-apiserver】控制面全景：缺口、五轴坐标系与 16 篇路线]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [etcd]() Tags: [admission](), [apf](), [apiserver](), [auth](), [control-plane](), [distributed](), [etcd](), [kubernetes](), [network](), [overview](), [storage](), [v1-30-3](), [watch](), [watch-cache]() ### AI overview This article maps gaps in existing coverage of the Kubernetes control plane and proposes a 16-part reading route organized around Storage, Watch, Admission, Auth, and APF. It anchors the discussion to Kubernetes v1.30.3 and etcd v3.5.33, focusing on how requests travel through kube-apiserver and how to distinguish admission, caching, backend, and timeout failures. ### Source excerpt 相对 etcd/13、distributed/50、k8s-network 补齐 kube-apiserver 生产内核缺口；以 Storage/Watch/Admission/Auth/APF 五轴为坐标系定义 16 篇阅读路线；版本锚定 Kubernetes v1.30.3。 ## 【kube-apiserver】进程与请求路径：generic apiserver、HandlerChain 与 REST 路由 DevFeed: [【kube-apiserver】进程与请求路径：generic apiserver、HandlerChain 与 REST 路由]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [API]() Tags: [admission](), [apf](), [apiserver](), [audit](), [authn](), [authz](), [distributed](), [generic-apiserver](), [gvr](), [handlerchain](), [kubernetes](), [request-path](), [rest](), [v1-30-3]() ### AI overview This tutorial explains the Kubernetes v1.30.3 kube-apiserver process model, the generic apiserver framework, HandlerChain ordering, GVR routing, and the points where requests can be rejected before reaching storage. It also distinguishes failures caused by APF, authentication and authorization, admission, and storage. ### Source excerpt 拆解 kube-apiserver 进程模型与 generic apiserver 框架；钉 HandlerChain 各插槽顺序与失败落点；说明 GVR 路由机制与请求在到达 storage 前可能被拦截的位置。版本锚定 Kubernetes v1.30.3。 ## 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门 DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [configuration](), [dry-run](), [TLS (Transport Layer Security)](), [API]() Tags: [admission](), [api](), [apiserver](), [cel](), [configuration](), [distributed](), [kubernetes](), [kyverno](), [mutating](), [timeout](), [tls](), [v1-30-3](), [validating](), [webhook]() ### AI overview A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag. ### Source excerpt 钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。 ## 【kube-apiserver】排障五轴：Storage、Watch、Admission、Auth、APF DevFeed: [【kube-apiserver】排障五轴：Storage、Watch、Admission、Auth、APF]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [API](), [etcd]() Tags: [admission](), [apf](), [apiserver](), [auth](), [authz](), [distributed](), [etcd](), [five-axes](), [kubernetes](), [metrics](), [storage](), [troubleshooting](), [v1-30-3](), [watch]() ### AI overview A troubleshooting guide for kube-apiserver organized around five diagnostic axes: Storage, Watch, Admission, Auth, and API Priority and Fairness. It maps symptoms such as 504, 410 Gone, 401, 403, webhook timeouts, list storms, and OOM to likely axes, explains when to investigate etcd, and emphasizes that commands and metrics were not executed in the author's environment. ### Source excerpt 按 Storage/Watch/Admission/Auth/APF 五轴做症状否证；给出完整五轴命令表与症状->轴映射（504、410、401、403、webhook 超时、List 风暴、OOM）；说明 apiserver_request_duration_seconds 等核心 metrics 语义；并提供决策树：何时穿透到 etcd/15，何时留在 apiserver 轴。 ## 【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列 DevFeed: [【kube-apiserver】Authorization 与 Audit：RBAC、SAR 与 403 分列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Authorization](), [Kubernetes](), [audit](), [API]() Tags: [403](), [admission](), [api](), [apiserver](), [audit](), [auth](), [authorization](), [authz](), [distributed](), [etcd](), [http](), [k8s](), [kubernetes](), [policy](), [post](), [rbac](), [subjectaccessreview](), [v1](), [v1-30-3](), [webhook]() ### AI overview This tutorial explains Kubernetes v1.30.3 authorization and auditing. It distinguishes the RBAC, Node, Webhook, and legacy ABAC authorizer paths; describes SAR and SSAR access checks; outlines audit policies and stages; and explains why user-facing 403 errors come from Kubernetes authorization rather than etcd permissions or Admission failures. ### Source excerpt 钉 K8s v1.30.3 的授权链：RBAC、Node、Webhook、ABAC（遗留）；SubjectAccessReview / SelfSubjectAccessReview 用法；Audit policy 四级；403 与 etcd 权限错误、Admission 拒绝的分列；不把 etcd 的 mTLS 错误写成 K8s RBAC 故障。