<p>I need to be able to restrict users from creating new Deployments/ReplicaSets into existing namespace spaces if they don't match a list of approved apps, I assume a custom admission controller would be the best way but I'm unsure how to go about this.</p>
<p>Any solution to do so?</p>

Limeyman
<p>You're right - if you need to use data like the list of approved apps in an admission control decision you need more than RBAC. You could write a custom admission controller, but a more recommended approach would be to use <a href="https://www.openpolicyagent.org/" rel="nofollow noreferrer">Open Policy Agent (OPA)</a> for this as it gives you the flexibility you need without having to deal with low-level API server integration concerns.</p>
<p>Check out <a href="https://github.com/open-policy-agent/gatekeeper" rel="nofollow noreferrer">OPA Gatekeeper</a> for an open source integration of OPA with Kubernetes, or <a href="https://www.styra.com/" rel="nofollow noreferrer">Styra</a> for a commercial solution.</p>
<p>Finally, <a href="https://kyverno.io/" rel="nofollow noreferrer">Kyverno</a> is an alternative to OPA for policy-based admission control on Kubernetes.</p>
