I Broke My Cluster with Kyverno (So You Don’t Have To)
summary
Three concrete failures: blocking all workloads by enforcing wide validation rules, infinite mutation loops that continuously mutate objects until the API server is overloaded, and bad patching that mismatches container names and breaks pods. Remedies include start with audit mode then increment to enforce, test policies in dev clusters and with kyverno test, add exclusion/where clauses and regex matches for containers, and use policy reports, controller logs and kubectl describe/events to debug; example policies live in the linked repo.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:42Blocking all workloads
- 2:49First mistake lessons
- 3:10Inflight policy loops
- 4:54Fixing mutation loops
- 5:14Bad patching with mutation
- 6:16Kyverno debugging tips
- 7:21Key takeaways
- 8:03Closing
- 8:23Q&A
- 9:46Kyverno vs OPA
- 10:49Final thoughts
related talks
37mKyverno Introduction And Overview
22mDrift Prevention in GitOps Workflows Using Kyverno
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
36mKubernetes Confessions: Real Mistakes We’ve All Made (and What They Teach Us)
45mWhat I Learnt Fixing 50+ Broken Kubernetes Clusters
31mThe Myth of the Monocluster
29mKyverno Chronicles: A DevSecOps Tale
33mWhat We Learned from Reading 100+ Kubernetes Post-Mortems