Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption.
Admission Controls are Bypassed
CCC.K8S.TH12
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP18 | Admission Policy Enforcement | The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN05 | Enforce Restricted Workload Security | Minimize workload privilege and block unnecessary access to host-level resources that could defeat container isolation. |
| CCC.K8S.CN11 | Protect Admission Control Enforcement | Apply mandatory cluster security policy to every workload path and prevent its scope or enforcement configuration from being bypassed or modified without authorization. |