CKS-Lessons/learning-records/0005-validating-admission-policy-retrieval.md

Validating Admission Policy retrieval

The learner completed Lesson 31 after iterative correction. They can now explain that a ValidatingAdmissionPolicy CEL expression returns true to admit a request, use all() to evaluate every regular and init container, guard optional fields with has(), combine compliance checks with short-circuit logic, and scope Deny enforcement through a ValidatingAdmissionPolicyBinding namespace selector.

Evidence

The final manifest passes static review and includes a helpful denial message. Runtime admission outcomes remain unverified because kubectl was unavailable in the teaching shell.

Retrieval target

Revisit CEL list macros and optional-field guards later without stepwise prompting. Continue reporting the complete issue list while correcting only one issue per review round.