准入控制 Webhook 是 Kubernetes 在对象创建或更新前调用外部服务做校验与改写的扩展机制，核心是把准入决策交给可演进的外部逻辑，能力包括校验型拦截、修改型变更与策略外置管理。它解决的是准入策略写死在代码里无法快速调整的问题，并不解决容器运行时本身的安全漏洞问题。
准入控制 Webhook 的核心是策略外置，它可以帮助企业实现以下目标：
让准入策略可以独立演进。策略逻辑放在独立服务里，更新策略不需要重新编译或发布集群组件。校验逻辑运行在集群外部，策略更新后无需等待组件发布，规则变更可以当天生效。校验在对象持久化之前完成，不合规的请求不会占用集群资源，也避免了需要回滚清理的残留对象。
让不合规对象在进入集群前被拦下。校验型 Webhook 依据镜像来源、资源配额与标签规则拒绝违规请求。拒绝请求时返回的原因会传给提交方，调用方据此修正配置而不是反复盲目重试。
让默认配置被自动修正。修改型 Webhook 为缺少标签或安全配置的 Pod 补齐默认设置。
让策略来源可追溯。准入决策与拒绝原因被记录，事后可审计哪些资源因何被拒。
总之，准入控制 Webhook 可以帮助企业实现集群治理从硬编码规则到可运营策略的转变，提升准入控制的灵活性与一致性，减少人工审核负担，让安全基线在多集群环境下以统一方式落地并可追溯。
翻译
Admission webhooks are the Kubernetes extension mechanism that calls an external service to validate or mutate objects before creation or update. Its core is delegating admission decisions to evolvable external logic, with capabilities covering validating rejection, mutating changes and externally managed policy. It solves the problem of admission policies being hardcoded and slow to adjust, but it does not solve security vulnerabilities in the container runtime itself.
At the heart of admission webhooks is externalized policy, which can help companies achieve the following:
Let admission policies evolve independently. Policy logic lives in a separate service, so updating policy needs no recompilation or release of cluster components.
Stop non-compliant objects before they enter the cluster. Validating webhooks reject requests based on image source, resource quota and labeling rules.
Correct default configuration automatically. Mutating webhooks fill in missing labels or security settings on pods.
Make the source of policy traceable. Admission decisions and rejection reasons are recorded, so it can be audited later which resources were denied and why.
In short, admission webhooks can help enterprises shift cluster governance from hardcoded rules to operable policy, improve the flexibility and consistency of admission control, reduce manual review burden, and let security baselines land uniformly and auditably across multi-cluster environments.
