Skip to content
refplat

Learn: Policy & Admission

How the platform enforces its rules: automatically, on every resource, the moment it enters the cluster. Kyverno is the engine behind safe self-service. It rejects the non-compliant, injects the safe defaults, and generates the companion objects — all at admission, all as code.

For platform engineers who author or operate policy. Developers get the most out of the 2-minute view at the end of the orientation: what admission requires, and what it auto-injects for you. Already fluent in Kyverno? Go straight to the Reference.

Two things to have in hand first: Kubernetes stores resources as YAML, and a namespace is an isolated slice of a cluster. The domain model fills in Team / Product / Environment if you need it.

Read in this order

Section titled “Read in this order”
  1. Orientation — the core idea (a programmable checkpoint at the cluster door), the three verbs (validate, mutate, generate) taught on a real admission rejection, baseline-vs-per-product rules, and the Audit-first → Enforce rollout.
  2. Reference — lookup: the catalog shape, the enforce mechanics, the gotchas that bite (the deprecated failureAction field, the aggregated webhook, Rollout match), and a glossary.

To go deeper on the real system

Section titled “To go deeper on the real system”