admission-control

You can validate Kubernetes resources before persistence by implementing Validator interfaces to intercept admission requests and accept or reject create, update, delete, and connect flows for custom resource kinds.

Yes, admission control supports mutating handlers through Mutator interfaces that allow you to set defaults, normalize fields, or modify objects before they are saved to the Kubernetes cluster.

Admission validation handlers enforce immutability of critical fields, validate cross-field constraints, and perform client-based referential checks against other resources to reject invalid custom resource updates.

Yes, admission control requires CUE configuration to define validation and mutation rules, and you must register the Validator or Mutator implementations in pkg/app/app.go to handle requests.

Yes, admission control applies to grafana-app-sdk apps running as standalone operators or inside grafana/apps, intercepting Kubernetes resource requests across both deployment contexts before persistence.

The skill provides guidance for testing admission handlers by accessing AdmissionRequest fields and using structured error handling to verify validation and mutation logic before registering them in your app.