Kubernetes Admission Control: Image Signing & Policy Gate (2D)

Container images roll along a conveyor toward a validating admission webhook, each one carrying randomised real-world attributes — a signature status, a CVE count from an image scan, a privileged-mode flag and whether resource limits are set. Toggle the same policies a cluster operator would configure in OPA Gatekeeper or Kyverno — require signed images, block privileged pods, require resource limits, and cap the allowed CVE count — and watch the gate admit or reject each image live, scheduling the winners onto an instanced worker-node grid while rejects fall away and fade. Drag to pan the view and scroll to zoom in on the belt or the cluster. Live counters track admitted, rejected and the running admission rate, and the "How it works" panel spells out the AND-of-constraints logic every real admission controller implements.