Webhook Topology and Admission Latency: Lessons from Migration - Tanat Lokejaroenlarb, Adevinta

Staff SRE Tanat Lokejaroenlarb shares Adevinta's experience migrating from Gatekeeper to Kyverno and the unexpected admission webhook latency spike that followed. The talk covers how mixing ValidatingPolicy and ClusterPolicy caused p99 latency to jump from sub-second to several seconds despite the policy logic itself executing in under 1ms. This session is valuable for SREs and platform engineers managing Kubernetes admission control at scale who want to understand webhook topology implications and avoid similar pitfalls.