Kubernetes admission controllers intercept API requests before resources are persisted to etcd and can validate, mutate, or reject them based on policy. ValidatingAdmissionWebhooks reject requests that violate policy. MutatingAdmissionWebhooks modify requests to add missing configuration — for example, automatically injecting a security context or resource limits. Together they enforce organisational guardrails on every Kubernetes resource, regardless of who creates it or which tool they use.
Analogy🏏Cricket
🏏 Think of it like cricket: A batting coach who only reviews a batter's technique after a tournament has already ended. The batter has played 10 matches with a flawed grip — every run scored with bad technique is harder to unlearn than if the coach had corrected it in the first net session. Shifting security left is bringing the coach into the net sessions, not the post-tournament review.