Admission policies that are proven to block

The problem

A policy that looks right in review can block nothing: a verb that does not exist, a check on a field an attacker controls, a match that never fires. Those failures are silent by nature, and they surface during an incident, not before it.

The approach

Pod Security Admission covers privileged pods and host access natively; Kyverno CEL policies add what it does not: images only from the platform registry and signed by the release workflow, pinned versions, requests and memory limits, probes, read-only root filesystems, no default service accounts, no public load balancers without an approval reference and source ranges, cluster-admin bound only by GitOps, and a namespace syncing only its own secrets.

Tested both ways

Every policy ships with fixtures that must be admitted and fixtures that must be rejected by that policy by name. The same policies run in Audit in development, so teams see violations before production rejects them. Exceptions exist, but each names its owner, its reason and its expiry, and exempts a workload, never a namespace.

What changed

A policy that blocks nothing can no longer pass review, because its test fails. Admission policy became something teams can predict, rather than a wall they discover at deploy time.

Described as a pattern: names, numbers of systems and identifiers from the environments where this was built are left out.