Question
In the context of Kubernetes, what is a validation webhook?
Answer
They are an API invocation to confirm a resource was created properly. Unlike a mutating webhook, validation webhooks make no changes to resources deployed in Kubernetes. Also unlike a mutating webhook, validation webhooks happen at a different step in the admission controller process. The admission controller process starts with an API request and ends with persisting data to etcd.
See the diagram here and visually search for "diagram representing."
Object schema validation precedes validation webhooks; object schema validation happens after mutating webhooks.
See also https://banzaicloud.com/blog/k8s-admission-webhooks/.