A Kubernetes ValidatingAdmissionWebhook (as implemented by OPA Gatekeeper or Kyverno) intercepts every pod creation request before it reaches etcd. The API server sends it an AdmissionReview object; the webhook returns allowed: true/false. With several policies active, admission is a logical AND:
admit(image) =
(require_signed → image.signed)
∧ (block_privileged → ¬image.privileged)
∧ (require_limits → image.hasResourceLimits)
∧ (image.cveCount ≤ maxAllowedCVEs)
Each cube on the belt is one image with randomised attributes: a green→red tint by CVE count from the scanner (Trivy/Grype), a small cyan sphere if it carries a valid Cosign signature, an orange cone if it requests privileged mode, and a red wireframe outline if it has no CPU/memory limits set. The gate evaluates every enabled policy against the image the instant it crosses the threshold plane; a single failing policy is enough to reject it — this is exactly the fail-closed behaviour a real cluster should have (failurePolicy: Fail). Admitted images are scheduled onto worker nodes, shown as green pods filling the instanced grid on the right; rejected images are shown flashing red and dropped from the belt.
- Toggle a policy off — watch previously-rejected image classes start sailing through untouched.
- CVE slider — models a vulnerability-scanning gate; tightening it rejects more images even with a valid signature.
- Real-world relevance — this AND-of-constraints model is exactly how Kyverno
ClusterPolicy / OPA Gatekeeper ConstraintTemplate resources compose: each constraint is independent, and any one violation blocks the whole request.