all
Sep 2, 2026
How ImagePolicyWebhook actually gets wired: kube-apiserver flags, admission config, kubeconfig, and why defaultAllow: false is the whole point.