Protecting control plane with admission plugins
Where RBAC controls access rules between users and groups and available projects, you can define access to the Red Hat OpenShift Container Platform master API by using admission plugins .
API requests go through a chain of rules that consist of the following admission plugins:
-
Default admissions plugins: These implement a default set of policies and resources limits that are applied to components of the Red Hat OpenShift Container Platform control plane.
-
Mutating admission plugins: These plugins dynamically extend the admission chain. They call out to a webhook server and can both authenticate a request and modify the selected resource.
-
Validating admission plugins: These validate requests for a selected resource and can both validate the request and ensure that the resource does not change again.
API requests go through admissions plugins in a chain, with any failure along the way causing the request to be rejected. Each admission plugin is associated with particular resources and only responds to requests for those resources.