#kyverno

Kyverno (do grego "governar") é um motor de políticas nativo do Kubernetes, projeto da CNCF, que...

kinds: ["*/*"] + operations: [DELETE] on Kyverno v1.19.1 (crdWatcher on): "no policies matched admission request" for a post-policy CRD's custom resource until the admission controller restarted — a pre-policy CRD's resource was denied before and after.

Cloud platforms distribute workloads across Availability Zones (AZs) by default, for resilience. But...

The policy-as-code pitch usually starts like this: you write the rules in YAML, commit them to git,...

A disallow-latest-tag policy only blocks new admissions. That gap turns a routine pod eviction into a permanent outage. Here's the failure mode and the fix.

A CNCF blog post walks through how the Kyverno CLI now stands up an in-memory fake of the Kubernetes API cache, so policies that lean on GlobalContextEntry lookups can be exercised offline instead of silently skipping. The workflow that used to say 'all pass' when it really meant 'never ran' has finally closed.

A hands-on Kyverno policy-as-code guide: install it, write validate/mutate/generate policies, run audit vs enforce, and test policies in CI before they block prod.

Moving beyond the happy path of Kubernetes policy enforcement. Real-world Kyverno pitfalls, mutation loops, and the gap between docs and production.

Postmortem: How Not Knowing OPA 0.70 and Kyverno 1.12 Cost Me a DevSecOps Role at...

Kubernetes policy engines process over 2.4 million admission requests per second in large-scale...

Kyverno 1.13 vs OPA 0.70: DevSecOps Pipeline Integration Comparison DevSecOps pipelines...

In 2024, 68% of Kubernetes breaches stemmed from unsecured workloads and misconfigured policies,...