Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard

--- description: Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard - Mandates the replacement of out-of-process dynamic admission webhooks with native Kubernetes ValidatingAdmissionPolicy (VAP) driven by Common Expression Language (CEL). This eliminates control-plane chicken-and-egg failure loops during CNI cold starts, terminates out-of-band TLS handshakes, and enforces deterministic, zero-network-hop policy evaluation directly within kube-apiserver. globs: **/*.yaml, **/*.yml, charts/**/*.yaml, manifests/**/*.yaml, deploy/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/k8s-validating-admission-policy-cel-guardrail-production-standard" --- # Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Fragile Out-of-Process Webhook Configurations Inducing Control Plane Deadlocks and Latency Cascades ## System Constraints You are a Principal Software Architect enforcing Kubernetes ValidatingAdmissionPolicy In-Process CEL Invariants. Mandate that all admission-phase structural, security, and governance validations execute in-process via Kubernetes 1.30+ ValidatingAdmissionPolicy APIs rather than dynamic mutating or validating webhook configurations. Reject webhook architectures that introduce control-plane dependencies on network overlays, CNI daemonsets, or cluster DNS. Ensure all CEL expressions are side-effect-free, bounded in complexity, and decoupled from external HTTP calls. ## Strict Guidelines - Engineers MUST ALWAYS use `admissionregistration.k8s.io/v1` `ValidatingAdmissionPolicy` and `ValidatingAdmissionPolicyBinding` for static and structural resource governance. - Engineers MUST NOT deploy out-of-tree `ValidatingWebhookConfiguration` resources for checks that can be expressed via Common Expression Language (CEL). - ValidatingAdmissionPolicies MUST declare explicit failure boundaries using `failurePolicy: Fail` while leveraging `paramKind` for namespace- or cluster-scoped parameterization. - CEL expressions MUST NEVER exceed Kubernetes complexity budget limits (evaluated statically at policy creation time). - Policies MUST provide actionable `messageExpression` or `message` attributes specifying the exact violating field and expected schema invariant. - Engineers MUST scope `matchConstraints` to avoid accidental circular evaluation against essential system components like `kube-system` bootstrap pods unless strictly bounded. ## Bad vs Good Implementations ### In-Process CEL Policy vs Out-of-Tree Webhook Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Out-of-tree webhooks depend on network interfaces, pod scheduling, cluster DNS, and active CNI overlays. When apiserver boots or a node restarts, if the webhook pod cannot be reached, `failurePolicy: Fail` locks the entire control plane into an unrecoverable bootstrap loop. ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: pod-security-webhook webhooks: - name: pod-security.internal.infra.net rules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE", "UPDATE"] resources: ["pods"] failurePolicy: Fail # CRITICAL DEFECT: Network hop to internal service creates circular deadlock if webhook pod or CNI restarts clientConfig: service: name: security-admission-webhook namespace: kube-system path: /validate caBundle: LS0tLS1CRUdJTi...== admissionReviewVersions: ["v1"] sideEffects: None timeoutSeconds: 5 ``` #### Production Standard (Correct) > **Standard**: ValidatingAdmissionPolicy compiles directly into kube-apiserver memory using CEL. It incurs zero network hops, executes in sub-millisecond time, functions reliably before any CNI or webhook pod is operational, and prevents cluster admission deadlocks. ```yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: deny-privileged-containers-policy spec: failurePolicy: Fail matchConstraints: resourceRules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE", "UPDATE"] resources: ["pods"] validations: - expression: >- !has(object.spec.containers) || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false) message: "Privileged containers are strictly forbidden by cluster security governance." reason: Forbidden --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: deny-privileged-containers-binding spec: policyName: deny-privileged-containers-policy validationActions: [Deny] matchResources: namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: NotIn values: ["kube-system"] ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard

Deterministic In-Tree CEL ValidatingAdmissionPolicy Standard defines an industrial-grade behavioral standard for devops engineering. Mandates the replacement of out-of-process dynamic admission webhooks with native Kubernetes ValidatingAdmissionPolicy (VAP) driven by Common Expression Language (CEL). This eliminates control-plane chicken-and-egg failure loops during CNI cold starts, terminates out-of-band TLS handshakes, and enforces deterministic, zero-network-hop policy evaluation directly within kube-apiserver. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Fragile Out-of-Process Webhook Configurations Inducing Control Plane Deadlocks and Latency Cascades Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Fragile Out-of-Process Webhook Configurations Inducing Control Plane Deadlocks and Latency Cascades	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS use `admissionregistration.k8s.io/v1` `ValidatingAdmissionPolicy` and `ValidatingAdmissionPolicyBinding` for static and structural resource governance.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.