After a Pod create, the stored object includes an extra envoy sidecar container that was not in the developer’s manifest. A separate webhook later rejects Pods missing a required annotation. What admission behaviors do these describe?

Mutating admission webhooks may change objects during admission, such as injecting sidecar containers. Validating admission webhooks allow or deny requests without intending to reshape the object as their primary role. Observing an unexpected sidecar usually points to mutation; policy rejects for missing fields point to validation. Both run before the object is persisted when configured on the create path.