Container Registry and Software Supply Chain Platform  ·  View 17 of 33  ·  4 · Runtime

Admission Decision

The one flow that must be fast, correct and available, and what it does when it cannot be all three.

Editable source SVG draw.io All views
kube-apiserver Admission Controller Local Bundle Cache Local Evidence Cache Regional Evidence API Audit Ledger 1. AdmissionReview · Pod 2. extract image references 3. bundle for env=prod 4. v247 · age 42 s 5. inputs for sha256:9f3c… 6. hit · 3 s old 7. miss → fetch, 2 s cap 8. attestations + findings 9. verify signatures offline 10. evaluate rego · 12 rules 11. ALLOW / DENY + reasons 12. decision + evidence digests 13. timeout → env posture Admission Decision — Critical Flow p50 ≤ 25 ms, p99 ≤ 150 ms. The common case never leaves the cluster. v 1.0 · owner Security Architecture · date 2026-09

Answering question 1

  • The enforcement point is a cluster admission webhook on Pod create, so workloads created by controllers cannot route around it
  • A CI gate was rejected as the control: a gate that can be skipped by pushing differently is not a control
  • A per-node agent was rejected as the primary point: it decides too late to give the developer a usable rejection message

Latency budget

  • p50 ≤ 25 ms, p99 ≤ 150 ms, hard timeout 2 s — chosen to stay inside the cluster's own webhook budget
  • The common case reads a local bundle and a local evidence cache and never leaves the cluster
  • Signature verification p99 ≤ 40 ms per artifact using cached trust roots

When it is blind

  • Beyond 30 minutes of cache staleness the environment's configured posture applies: fail-closed in production, fail-open elsewhere
  • That posture is a stated policy choice recorded in the bundle, not a library default
  • Every decision, ALLOW included, is logged with the bundle version and the evidence digests read
◀  Scan Pipeline All views Advisory Ingest and Reconciliation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises17-admission-decision-sequence