Refuel those propeller beanie-caps: "it depends" is about to become the Kubernetes API server's favorite answer.

First, Conditional Authorization. Authorizers used to answer only Allow, Deny, or NoOpinion. Now they can say "Allow if..." or "Deny if...", escaping all-or-nothing semantics. Via partial evaluation you can express "create gateways only when class is 'test-gateway'" or "a controller may touch only its own finalizer". We'll trace conditions from authorization into admission, show them in kubectl auth can-i, and explain how CEL lets the API server evaluate them in-process.

Next, a nastier gap: anything on the service network can reach an admission webhook unauthenticated. "IngressNightmare" (CVE-2025-1974) proved it, turning that exposure into RCE and cluster-wide secret theft. Learn how the API server now proves its identity to webhooks by default with API group scoped webhook bound service account tokens.