Kubernetes Native Admission Vs Custom Admission Controllers Native admission policies can now handle both validation and mutation, which covers many common policy requirements. However, they are not a complete replacement for tools like Kyverno. The following are the current limitations of native admission policies you should know. - Native policies don't cover every workflow available in dedicated policy engines, such as generating additional Kubernetes resources. - Tools like Kyverno can automatically create a NetworkPolicy or a RoleBinding whenever a new namespace is created. Native policies cannot do this. - CEL expressions run in the API server. It cannot call an external API, query a database, or check an OCI registry. If your validation logic needs to reach outside the cluster, you need a webhook. So, you can use native admission policies for straightforward admission rules. Use tools such as Kyverno or Gatekeeper when your policy requirements go beyond what native admission policies can handle. --- Every week, in our newsletter, we share one practical deep dive with illustrations and hands-on examples. It will help you learn something new. 📚 𝗝𝗼𝗶𝗻 𝗛𝗲𝗿𝗲 (𝗜𝘁'𝘀 𝗙𝗿𝗲𝗲): devopscube.com ♻️ If you find it useful, repost and share it with the community. #devops #kubernetes