Post

This tutorial builds a Kubernetes admission control setup on a local kind cluster, using Kyverno policies to block latest tags, root containers and host networking, plus a custom Python webhook for checks Kyverno cannot express ➜ https://ku.bz/7HGvXhjVr

14/10/26, 7:06 pm0 reposts2 likes

The Projekt

@wearetheprojekt.bsky.social

Blocking latest catches the obvious case, but a pinned tag can still be pushed over. Requiring image digests in the Kyverno policy is the version that actually stops a silent swap.