Build fluency in the vocabulary of enforcing a custom cluster policy at resource admission time.
0 / 5 completed
1 / 5
At standup, a dev mentions the Kubernetes API server calling out to an external HTTP endpoint to approve or reject a resource before it's persisted, rather than relying only on its own built-in checks. What is this mechanism called?
An admission webhook has the Kubernetes API server call out to an external HTTP endpoint to approve or reject a resource before it's persisted, extending validation and defaulting behavior beyond the API server's own built-in checks. Persisting every submitted resource immediately, with no external endpoint consulted, leaves no room for a cluster-specific policy the built-in checks don't cover. This external call is what lets a cluster enforce a custom, organization-specific rule at admission time.
2 / 5
During a design review, the team wants a webhook that can reject a non-compliant resource outright, distinct from one that can only modify a resource's fields before it's persisted. Which capability supports this?
The distinction between a validating webhook, which can only accept or reject a resource, and a mutating webhook, which can modify a resource's fields before it's persisted, gives the admission chain two clearly separated roles. Using one undifferentiated webhook type for both purposes blurs a policy decision with a defaulting or injection behavior, making the admission chain harder to reason about. This distinction is fundamental to how Kubernetes structures its admission control pipeline.
3 / 5
In a code review, a dev notices the webhook configuration specifies a failure policy determining whether the API server should reject a resource or let it through if the webhook itself becomes unreachable. What does this represent?
The webhook failure policy determines whether the API server should reject a resource or let it through if the webhook itself becomes unreachable, giving the cluster operator an explicit choice between fail-closed safety and fail-open availability. Configuring a webhook with no failure policy at all leaves that critical behavior undefined right when it matters most, during an outage of the webhook itself. This policy is essential to reasoning about a cluster's behavior if an admission webhook ever goes down.
4 / 5
An incident report shows the entire cluster was unable to create any new resource for several minutes because a validating webhook's backing service went down and its failure policy was set to reject on failure. What practice would prevent this?
Running the webhook service with high availability, and choosing a failure policy that actually matches how critical its check is, prevents a webhook outage from stalling every resource creation across the entire cluster. Running a single, non-redundant instance with a fail-closed policy and no regard for its own availability is exactly what caused the outage this incident describes. This combination of resilience and a deliberately chosen failure policy is essential for any webhook sitting in the cluster's critical admission path.
5 / 5
During a PR review, a teammate asks why the team enforces a custom policy through an admission webhook instead of relying only on the API server's own built-in validation. What is the reasoning?
The API server's built-in validation doesn't know about an organization-specific rule, like requiring every Pod to carry a particular label or forbidding a container from running as root. An admission webhook can enforce exactly that custom policy at the moment a resource is submitted, before it's ever persisted. The tradeoff is the added operational responsibility of keeping the webhook's own service highly available, since it now sits in the critical path of every resource submission it's configured to intercept.
What does the "Kubernetes Admission Webhooks Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to kubernetes admission webhooks vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 14 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.