Guardrails, not gates: rethinking policy in platform teams

T1Covered by 1 source · first reported by Kubernetes / CNCF / Linux Foundation / Apache / OpenSSF / OSI / Eclipse at 01 Oct, 11:30 UTC

The most popular OPA-based policy tool for Kubernetes is literally called Gatekeeper. Admission controllers block. Policies deny. Kyverno’s enforcement setting is validationFailureAction: Enforce, which at least sounds neutral, but the failure mode it describes is still...