pod-security-admission Four of Our Six Policies Shouldn't Be Policies A Kyverno ClusterPolicy with four rules — non-root, no privileged, no privilege escalation, drop ALL capabilities — is four rules Pod Security Admission already enforces for free. The policy file says so in its own header.
trivy Exit Codes Are the Cheapest Gate You Will Ship One flag decides whether a Trivy scan blocks a pipeline. On the same image, --severity CRITICAL exits 0 and HIGH,CRITICAL --ignore-unfixed exits 1 — and the gate that actually fires is the one that costs 115 milliseconds.
cel Server-Side CEL Type-Checking as a CI Lint kubectl --dry-run=client accepts a ValidatingAdmissionPolicy with a broken CEL expression. --dry-run=server compiles it, names the column of the error, and exits 1 — with nothing persisted. That is a free CI lint.
vap Phase In a Binding, Not a Policy With native VAP, the grace period lives in the binding's validationActions, never in the policy object. The same four violating Pods still report as failures under [Warn, Audit] — but the run exits 0, and phase 3 is opt-in by namespace label.
kyverno A Policy Bundle With One Wrong Document Is a Silent No-Op A policy file carrying its companion ClusterRole made `kyverno apply` report 'Applying 0 policy rule(s)' and exit 0 — a green CI gate enforcing nothing. The fix is to assert the rule count, not the exit code.
kyverno Kyverno Test Goes Green When You Weaken a Policy A negative control on `kyverno test` found it is direction-asymmetric: assert `result: fail` on a resource the policy now lets through, and it prints 'Want fail, got pass' — then reports 25 tests passed and exits 0.
