Mutating webhook
Kubernetes admission-controller extension that can MODIFY objects before they're persisted. Takes incoming YAML, returns a JSON patch. Drives auto-injection of sidecars (Istio Envoy, Vault Agent), default labels, secret injection.
Runs after authentication/authorization but before validation/persistence. The webhook server must be HTTPS + a cert the API server trusts. Classic usage: Istio injects the Envoy sidecar into all pods with istio-injection=enabled; cert-manager creates a Secret from a Certificate. Race condition: multiple mutating webhooks are ordered alphabetically, order can matter. Can't mutate Status subresources. Failure-policy Fail|Ignore — Ignore is dangerous if the webhook is security-critical.