Comparison
Admission controllervsAttestation
Admission controller
the deployment was rejected at submission because the image was unsigned and it asked to run as root.
A hook in the control plane that inspects, rejects or modifies objects as they are submitted, before anything is scheduled. It is where policy becomes enforcement rather than a report, and it is also the standard way to inject sidecars and defaults. Its risk is availability: a webhook that is slow or down can block every change to the cluster, which is why failure behaviour and timeouts are the settings that matter most.
Full entry →Attestation
the scan result, the test outcome and the review approval are each signed statements attached to the artefact's digest.
A signed claim about an artefact, made by whoever performed the check, and verifiable later by anyone. It generalises signing from 'this is ours' to 'this passed the things we require', and it is what makes a policy like 'only run images that have been scanned and approved' enforceable at admission. The chain is only as good as who is trusted to make each claim, so the identities issuing attestations become part of your threat model.
Full entry →