Comparison
Admission controllervsArtefact signing
Admission controller
the deployment was rejected at submission because the image was unsigned and it asked to run as root.
A hook in the control plane that inspects, rejects or modifies objects as they are submitted, before anything is scheduled. It is where policy becomes enforcement rather than a report, and it is also the standard way to inject sidecars and defaults. Its risk is availability: a webhook that is slow or down can block every change to the cluster, which is why failure behaviour and timeouts are the settings that matter most.
Full entry →Artefact signing
the cluster refuses to run an image that is not signed by your pipeline, so a pushed-by-hand image simply will not start.
Cryptographically signing published artefacts and verifying the signature before running them. Signing alone changes nothing — the value is entirely in the verification step at admission, which is the part teams skip. It binds to the digest rather than the tag, which is why an estate that deploys by mutable tag cannot meaningfully enforce it.
Full entry →