Use Gatekeeper's ExpansionTemplate to validate Pod-targeting constraints against Deployments and other higher-level controllers before they create Pods

Steps

1. Define an ExpansionTemplate custom resource specifying which parent resource kind (e.g., Deployment) expands into which child kind (Pod), including the path to the embedded Pod template.
2. Gatekeeper generates temporary, non-persisted 'expanded' Pod resources from the parent both at admission-webhook time and during audit, then evaluates Pod-targeting Constraints against those expanded resources.
3. If a mutating webhook or controller normally alters the Pod spec before real creation, mirror that behavior using Gatekeeper's Mutation feature so the expanded resource matches what will actually be created.
4. Test expansion configuration locally with the gator expand CLI before applying it to a cluster.
5. Tune --audit-interval and --constraint-violations-limit so violations surfaced against expanded Pods, along with regular audit findings, appear in each Constraint's status field at a reasonable frequency and volume.