Admission Webhook
Deprecated. PandoCore installs as a node sensor.
The admission webhook, and the injected sidecar it created, are deprecated and receive no further release. PandoCore now installs as a node sensor: one DaemonSet pod per node, plus a cluster controller. Nothing is injected into your workloads, and no webhook sits in the path of pod creation.
What replaced it
The webhook mutated pods at admission time, adding a detector container to pods labelled pandocore.io/protect: "true". The node sensor instead watches the workloads already running on its node, so there is no admission step, no pod mutation, and no restart needed to start or stop watching a workload.
The label still matters, with its sense reversed: a pod now opts out, with the exact string pandocore.io/protect: "false". The old "true" value has no effect.
Where to go instead
- Getting Started installs the node sensor and the controller.
- Configuration covers the opt-out label and the per-node settings.
- Operating Modes covers what the sensor is permitted to do, and how to raise that ceiling.
- Upgrading is the path off the webhook if you are running it today.
- Trust Center states what the sensor runs as, what it reads, and what it is not granted.
This page keeps its URL so existing links and bookmarks do not break.