hard20 pts · first answer countskubernetesdevsecopsreliability

Policy webhook takes down deploys

An admission webhook for image policy has failurePolicy: Fail and matches all namespaces. Its Pods crash, and now nothing can be created, including the webhook's own replacement Pods. What should have been done?

A.Use failurePolicy: Ignore for every webhook in the cluster, so a broken one can never block any request.B.Exclude system and webhook namespaces via namespaceSelector, and run it HA with a PDB and alerts.C.Remove all admission webhooks from production clusters and enforce policy only in CI pipelines.D.Set the webhook timeoutSeconds to 0, so the API server skips it whenever it is slow.

← Only deploy images built by CI Alert silent when the service dies →