Kubernetes Admission Control: Image Signing & Policy Gate

Container images roll down a conveyor toward a validating admission webhook, each one carrying randomised real-world attributes — a signature status, a CVE count from an image scan, a privileged-mode flag and whether resource limits are set. Toggle the same policies a cluster operator would configure in OPA Gatekeeper or Kyverno — require signed images, block privileged pods, require resource limits, and cap the allowed CVE count — and watch the gate admit or reject each image live, scheduling the winners as green pods onto an instanced worker-node grid while rejects flash red and drop off the belt. Live counters track admitted, rejected and the running admission rate, and the "How it works" panel spells out the AND-of-constraints logic every real admission controller implements.