About this scenario
Finance reports cost per team from a team label on every Pod. The namespaces carry it (shop is team=payments, search is team=discovery), but Pods don't, and teams forget to add it. The tools namespace has no team at all.
Mutating Admission Policies are stable since Kubernetes 1.36: the API server runs CEL mutations itself, so there's no webhook server to build and keep running. Write one that copies the namespace's team label onto every new Pod.
Objectives
- New Pods in shop and search get their namespace's team label
- Pods in tools, which has no team, are still created, unlabelled
- Preview the change with a server-side dry run
- Every running Pod in shop and search carries the label
What you'll practice
- A Mutating Admission Policy changes objects inside the API server with CEL: no webhook to deploy, scale or secure. The binding decides where it applies.
ApplyConfiguration merges a partial object, the way server-side apply does; JSONPatch gives exact operations. object, oldObject and namespaceObject are the expression's inputs.- With
failurePolicy: Fail, an expression that errors blocks the request. Guard it with matchConditions or optional fields such as .?team. --dry-run=server runs admission without storing anything: the quickest way to see what a policy does.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Flux, Argo CD) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.