What is Kyverno and where does it fit in a DevSecOps pipeline?

Describe Kyverno by the failure it prevents, not by its feature list. It belongs to Kubernetes-native policy as code and runs at the deploy stage of delivery, which matters because the cost of fixing a defect rises sharply the later it is found — the core argument behind shifting security left.

Strong answers cover YAML policies instead of Rego, validate/mutate/generate rule types, Audit vs Enforce validationFailureAction, policy exceptions, image verification with Cosign, and the CLI for testing policies in CI before they hit a cluster. Interviewers also listen for the operational side: who owns the rules, how findings reach the developer who introduced them, how false positives get suppressed without silently disabling coverage, and what the break-glass path is when a fix genuinely cannot ship in time.

Tie it to the wider toolchain. Security scanning is only useful when its output is actionable, deduplicated across tools, and attached to a specific commit, image digest or resource — otherwise teams learn to ignore it.