Gatekeeper admission

Admit a pod only when Judge passed its image, through an in-cluster Gatekeeper external data provider that holds the read-only credential and a bounded last-known-good cache. Written for Kyverno 1.19.1; Enforce needs Kyverno 1.19.2 or later (1.19.2-rc.1 until it is released).

Not available yet. Gatekeeper sends no request headers to a provider, so a cluster cannot present a credential to the platform directly. The entry will ship with the in-cluster provider that holds the read-only credential and a bounded last-known-good cache (decided 2026-10-16). Until then, use Kyverno admission.