Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing | AgentRules.org

Rules Stacks Clients Auditor Pruner Self-Heal RFCs Benchmark CLI CI/CD Authors Submit

This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →

devopscritical PriorityID: k8s-validating-admission-policy-cel-fencing

Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing

Enforces deterministic, in-process Common Expression Language (CEL) validation policies within the kube-apiserver, deprecating out-of-process admission webhooks for zero-latency structural fencing. Mandates strict null-safe navigation, cost-budget enforcement, and Pod Security Standards immutability across multi-tenant workloads.

Prohibited Anti-Pattern: Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing - Enforces deterministic, in-process Common Expression Language (CEL) validation policies within the kube-apiserver, deprecating out-of-process admission webhooks for zero-latency structural fencing. Mandates strict null-safe navigation, cost-budget enforcement, and Pod Security Standards immutability across multi-tenant workloads.
globs: deploy/**/*.yaml, deploy/**/*.yml, k8s/**/*.yaml, k8s/**/*.yml, helm/**/templates/*.yaml, helm/**/templates/*.yml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/k8s-validating-admission-policy-cel-fencing"
---

# Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions

## System Constraints
You are a Principal Platform Engineer and Kubernetes Security Architect enforcing zero-latency CEL Invariant Fencing via ValidatingAdmissionPolicy. Mandate null-safe CEL navigation, explicit failure policies, strict runtime cost budgeting (<100 estimated cost units), and exhaustive validation coverage over Pod Security Standards (PSS) and resource immutability across all tenant namespaces.

## Strict Guidelines
- Engineers MUST ALWAYS declare 'admissionregistration.k8s.io/v1' for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.
- Engineers MUST NEVER introduce blocking Out-of-Process ValidatingWebhookConfigurations for policy invariants that are expressible in CEL.
- Expressions MUST ALWAYS utilize null-safe navigation operators (e.g., has(), optMap(), ?.) to avoid unexpected admission evaluation errors on partial resource updates.
- Expressions MUST NOT exceed the Kubernetes CEL cost budget of 1000 (ideally remaining under 100 cost units); avoid deeply nested list iterations over unindexed object trees.
- Policies MUST define precise 'failurePolicy: Fail' for multi-tenant containment zones and include explicit 'matchConditions' to restrict rule evaluation to mutable workloads.
- Engineers MUST pair each ValidatingAdmissionPolicy with a scoped ValidatingAdmissionPolicyBinding utilizing 'namespaceSelector' or 'paramRef' to prevent cluster-wide control plane locks.

## Bad vs Good Implementations
### Enforcing PSS Restricted Root Privilege & Drop Capabilities via CEL

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Fails on pods that do not define spec.template (e.g., bare Pod objects vs Deployments), crashes with CEL evaluation error when securityContext is omitted/null, and uses 'failurePolicy: Ignore' which completely defeats tenant isolation.
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: restrict-root-execution
spec:
  failurePolicy: Ignore
  validations:
    - expression: "object.spec.template.spec.containers.all(c, c.securityContext.runAsNonRoot == true)"
      message: "Containers must run as non-root!"
```

#### Production Standard (Correct)
> **Standard**: Targets exact Pod resources, utilizes CEL optional chaining (?.) and fallback defaults (orValue) to prevent null dereference failures, and enforces non-root execution and capability dropping with a blocking failurePolicy.
```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: restrict-root-execution
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: >-
        object.spec.?securityContext.?runAsNonRoot.orValue(false) == true ||
        object.spec.containers.all(c,
          c.?securityContext.?runAsNonRoot.orValue(false) == true
        )
      message: "Pod security context or all container security contexts must enforce runAsNonRoot: true."
    - expression: >-
        object.spec.containers.all(c,
          c.?securityContext.?capabilities.?drop.orValue([]).exists(cap, cap == 'ALL')
        )
      message: "All containers must explicitly drop 'ALL' capabilities."
```

Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP

Inspects cluster state, admission registration endpoints, and active admission policies directly from the client.

Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Validates and computes the compile-time complexity cost of CEL expressions prior to deployment.

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing

Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing defines an industrial-grade behavioral standard for devops engineering. Enforces deterministic, in-process Common Expression Language (CEL) validation policies within the kube-apiserver, deprecating out-of-process admission webhooks for zero-latency structural fencing. Mandates strict null-safe navigation, cost-budget enforcement, and Pod Security Standards immutability across multi-tenant workloads. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS declare 'admissionregistration.k8s.io/v1' for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.

Engineers MUST ALWAYS declare 'admissionregistration.k8s.io/v1' for ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

2

Engineers MUST NEVER introduce blocking Out-of-Process ValidatingWebhookConfigurations for policy invariants that are expressible in CEL.

Engineers MUST NEVER introduce blocking Out-of-Process ValidatingWebhookConfigurations for policy invariants that are expressible in CEL.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

3

Expressions MUST ALWAYS utilize null-safe navigation operators (e.g., has(), optMap(), ?.) to avoid unexpected admission evaluation errors on partial resource updates.

Expressions MUST ALWAYS utilize null-safe navigation operators (e.g., has(), optMap(), ?.) to avoid unexpected admission evaluation errors on partial resource updates.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

4

Expressions MUST NOT exceed the Kubernetes CEL cost budget of 1000 (ideally remaining under 100 cost units)

Expressions MUST NOT exceed the Kubernetes CEL cost budget of 1000 (ideally remaining under 100 cost units); avoid deeply nested list iterations over unindexed object trees.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

5

Policies MUST define precise 'failurePolicy

Policies MUST define precise 'failurePolicy: Fail' for multi-tenant containment zones and include explicit 'matchConditions' to restrict rule evaluation to mutable workloads.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

6

Engineers MUST pair each ValidatingAdmissionPolicy with a scoped ValidatingAdmissionPolicyBinding utilizing 'namespaceSelector' or 'paramRef' to prevent cluster-wide control plane locks.

Engineers MUST pair each ValidatingAdmissionPolicy with a scoped ValidatingAdmissionPolicyBinding utilizing 'namespaceSelector' or 'paramRef' to prevent cluster-wide control plane locks.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Kubernetes ValidatingAdmissionPolicy CEL Invariant Fencing critical for AI coding assistants?

Enforces deterministic, in-process Common Expression Language (CEL) validation policies within the kube-apiserver, deprecating out-of-process admission webhooks for zero-latency structural fencing. Mandates strict null-safe navigation, cost-budget enforcement, and Pod Security Standards immutability across multi-tenant workloads. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Fragile Out-of-Process Admission Webhooks and Unbounded, Null-Unsafe CEL Expressions) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Kubernetes