<p>AFAIK, the admission controller is the last pass before the submission to the database.</p>

<p>However I cannot know which one is enabled, Is there a way to know which one is taking effect?</p>

<p>Thanks.</p>

<p>There isn't an admissionscontroller k8s object exposed directly in <code>kubectl</code>.</p>
<p>To get a list of admissions controllers, you have to hit the k8s master API directly with the right versions supported by your k8s installation:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl get --raw /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations | jq
</code></pre>
<p>For our environment, we run open policy agent as an admissions controller and we can see the webhook object here:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl get --raw /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations | jq '.items[] | select(.metadata.name==&quot;open-policy-agent-latest-helm-opa&quot;)'
</code></pre>
<p>Which outputs the JSON object:</p>
<pre class="lang-sh prettyprint-override"><code>{
  &quot;metadata&quot;: {
    &quot;name&quot;: &quot;open-policy-agent-latest-helm-opa&quot;,
    &quot;selfLink&quot;: &quot;/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/open-policy-agent-latest-helm-opa&quot;,
    &quot;uid&quot;: &quot;02139b9e-b282-4ef9-8017-d698bb13882c&quot;,
    &quot;resourceVersion&quot;: &quot;150373119&quot;,
    &quot;generation&quot;: 93,
    &quot;creationTimestamp&quot;: &quot;2021-03-18T06:22:54Z&quot;,
    &quot;labels&quot;: {
      &quot;app&quot;: &quot;open-policy-agent-latest-helm-opa&quot;,
      &quot;app.kubernetes.io/managed-by&quot;: &quot;Helm&quot;,
      &quot;chart&quot;: &quot;opa-1.14.6&quot;,
      &quot;heritage&quot;: &quot;Helm&quot;,
      &quot;release&quot;: &quot;open-policy-agent-latest-helm-opa&quot;
    },
    &quot;annotations&quot;: {
      &quot;meta.helm.sh/release-name&quot;: &quot;open-policy-agent-latest-helm-opa&quot;,
      &quot;meta.helm.sh/release-namespace&quot;: &quot;open-policy-agent-latest&quot;
    },
    &quot;managedFields&quot;: [
      {
        &quot;manager&quot;: &quot;Go-http-client&quot;,
        &quot;operation&quot;: &quot;Update&quot;,
        &quot;apiVersion&quot;: &quot;admissionregistration.k8s.io/v1beta1&quot;,
        &quot;time&quot;: &quot;2021-03-18T06:22:54Z&quot;,
        &quot;fieldsType&quot;: &quot;FieldsV1&quot;,
        &quot;fieldsV1&quot;: {
          &quot;f:metadata&quot;: {
            &quot;f:annotations&quot;: {
              &quot;.&quot;: {},
              &quot;f:meta.helm.sh/release-name&quot;: {},
              &quot;f:meta.helm.sh/release-namespace&quot;: {}
            },
            &quot;f:labels&quot;: {
              &quot;.&quot;: {},
              &quot;f:app&quot;: {},
              &quot;f:app.kubernetes.io/managed-by&quot;: {},
              &quot;f:chart&quot;: {},
              &quot;f:heritage&quot;: {},
              &quot;f:release&quot;: {}
            }
          },
          &quot;f:webhooks&quot;: {
            &quot;.&quot;: {},
            &quot;k:{\&quot;name\&quot;:\&quot;webhook.openpolicyagent.org\&quot;}&quot;: {
              &quot;.&quot;: {},
              &quot;f:admissionReviewVersions&quot;: {},
              &quot;f:clientConfig&quot;: {
                &quot;.&quot;: {},
                &quot;f:caBundle&quot;: {},
                &quot;f:service&quot;: {
                  &quot;.&quot;: {},
                  &quot;f:name&quot;: {},
                  &quot;f:namespace&quot;: {},
                  &quot;f:port&quot;: {}
                }
              },
              &quot;f:failurePolicy&quot;: {},
              &quot;f:matchPolicy&quot;: {},
              &quot;f:name&quot;: {},
              &quot;f:namespaceSelector&quot;: {
                &quot;.&quot;: {},
                &quot;f:matchExpressions&quot;: {}
              },
              &quot;f:objectSelector&quot;: {},
              &quot;f:rules&quot;: {},
              &quot;f:sideEffects&quot;: {},
              &quot;f:timeoutSeconds&quot;: {}
            }
          }
        }
      }
    ]
  },
  &quot;webhooks&quot;: [
    {
      &quot;name&quot;: &quot;webhook.openpolicyagent.org&quot;,
      &quot;clientConfig&quot;: {
        &quot;service&quot;: {
          &quot;namespace&quot;: &quot;open-policy-agent-latest&quot;,
          &quot;name&quot;: &quot;open-policy-agent-latest-helm-opa&quot;,
          &quot;port&quot;: 443
        },
        &quot;caBundle&quot;: &quot;LS0BLAH=&quot;
      },
      &quot;rules&quot;: [
        {
          &quot;operations&quot;: [
            &quot;*&quot;
          ],
          &quot;apiGroups&quot;: [
            &quot;*&quot;
          ],
          &quot;apiVersions&quot;: [
            &quot;*&quot;
          ],
          &quot;resources&quot;: [
            &quot;namespaces&quot;
          ],
          &quot;scope&quot;: &quot;*&quot;
        }
      ],
      &quot;failurePolicy&quot;: &quot;Ignore&quot;,
      &quot;matchPolicy&quot;: &quot;Exact&quot;,
      &quot;namespaceSelector&quot;: {
        &quot;matchExpressions&quot;: [
          {
            &quot;key&quot;: &quot;openpolicyagent.org/webhook&quot;,
            &quot;operator&quot;: &quot;NotIn&quot;,
            &quot;values&quot;: [
              &quot;ignore&quot;
            ]
          }
        ]
      },
      &quot;objectSelector&quot;: {},
      &quot;sideEffects&quot;: &quot;Unknown&quot;,
      &quot;timeoutSeconds&quot;: 20,
      &quot;admissionReviewVersions&quot;: [
        &quot;v1beta1&quot;
      ]
    }
  ]
}
</code></pre>
<p>You can see from above the <code>clientConfig</code> endpoint in k8s which is what the admissions payload is sent to. Tail the logs of the pods that serve that endpoint and you'll see your admissions requests being processed.</p>
<p>To get mutating webhooks, hit the version of the API of interest again:</p>
<pre class="lang-sh prettyprint-override"><code># get v1 mutating webhook configurations
kubectl get --raw /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations | jq
</code></pre>
