A validating admission webhook requires every new Pod in the tax namespace to carry an app.city.gov/owner label. A developer submits a Pod without that label. What happens at create time?
Select an answer to reveal the explanation.
Short Explanation
Picture a bouncer checking wristbands before anyone enters the club. Admission is that door check — no owner label, no entry, so nothing lands in etcd. This is not a scheduler or kubelet after-the-fact complaint.
Full Explanation
Validating admission webhooks run during the admission phase of an API request. If the webhook denies the request, the API server returns an error and does not persist the object. Scheduling and kubelet runtime behaviors only apply to objects that were successfully admitted. Label requirements enforced by admission therefore fail fast at create or update time.