admission-control

To validate resources before persistence, you implement a Validator handler that intercepts create and update requests, checks spec correctness, and rejects invalid resources with clear, field-oriented error messages before they reach storage.

You can set defaults by implementing a Mutator handler that modifies incoming resources during the admission request, normalizing fields or applying required derived values before the resources are persisted by the system.

Admission control handles immutability by providing operation-aware logic that differentiates create vs update actions, allowing handlers to access both the old and new objects to enforce immutability constraints on specific fields.

Yes, you can use grafana-app-sdk to define Validator handlers that enforce referential integrity by checking incoming resources for references to non-existent dependencies and rejecting invalid requests during admission.

You register validation and mutation operations by defining the respective handlers in your application code and enabling the corresponding validation or mutation operations within the CUE kind definition configuration.

Validating resources denies or allows requests based on spec correctness, while mutating resources modifies incoming objects to apply defaults or normalize fields before persistence, ensuring consistent data without rejecting the request.