The question that matters is never “do you have policies.” It is closer to this: on 3 March, a workload ran in this cluster with a mutable image tag. Name the control that should have prevented it. Show me that the control was in effect on that date. Show me every exception that was openContinue reading “Policy as Governance: What OPA and Kyverno Actually Buy You at Audit Time”
