Skip to main content
TT
Lab
Learn
Sandbox
Community
Language Learning (in Korean)
Get started
Learn
Learning paths
Courses
Policy as Code
Carve the rules into the cluster, not into a document.
고급 · Lessons 30 · Lab 10
Start the lab
Curriculum
Admission Control
The Path to etcd — Admission as a Place to Stand
reading
Quiz: Admission Control
quiz
validate Policies
validate — Patterns, deny, and Match Scope
reading
Writing Required-Label and Registry-Restriction Policies
lab
Quiz: validate Policies
quiz
mutate and generate
mutate and generate — Filling In Instead of Refusing
reading
Writing a Mutation Policy That Fills In Defaults
lab
A Generation Policy That Automates Tenant Onboarding
lab
Quiz: mutate and generate
quiz
Policy Exceptions and Reports
From Audit to Enforce — The Order in Which You Actually Turn Policy On
reading
The exception someone label-patched in a hurry was still there two years later
lab
Quiz: Policy Exceptions and Reports
quiz
Kubernetes checks itself
ValidatingAdmissionPolicy: blocking at the API server without an engine
reading
The policy was applied and nothing got blocked
lab
Quiz: Kubernetes checks itself
quiz
Turning on Pod Security Standards with one label
Pod Security Standards and Admission: levels and modes are different axes
reading
We left it on warn-only, then switched to enforce and every deploy stopped
lab
Quiz: Turning on Pod Security Standards with one label
quiz
Policies need tests too
Testing policies: pinning both the passes and the rejections
reading
We loosened the rule and the tests stayed green that day
lab
Quiz: Policies need tests too
quiz
Blocking it before it reaches the cluster
Reading the plan as policy: catching destroys, replacements and exposure before apply
reading
The exit code was 0, so the pipeline stayed green for weeks
lab
Quiz: Blocking it before it reaches the cluster
quiz
A tag is a name, a digest is an identity
Image reference policy: tags, digests, and what you layer on top
reading
The tag never changed, but what came up was not yesterday's
lab
Quiz: A tag is a name, a digest is an identity
quiz
When a policy breaks, the cluster stops
Scope and failure modes: the order to follow on rollout day
reading
One webhook was switched to Fail and the cluster stopped
lab
Quiz: When a policy breaks, the cluster stops
quiz
Reference docs
Kyverno 문서
Open Policy Agent 문서
Gatekeeper