A Kubernetes object that runs code or hands over the node - a privileged pod mounting the host root or the container socket, exec into a running pod, an admission webhook registered or bypassed. Reads the requesting identity, whether a controller stands behind it, and the namespace's deploys.
