Beyond validation, what do Kyverno's mutate and generate rules let you do?
Quick Answer
Validate rejects bad resources, but mutate rewrites them on the way in (inject default securityContext, add labels, set resource limits) and generate creates companion resources automatically (a default NetworkPolicy or ResourceQuota for every new namespace).
Detailed Answer
Validate rejects bad resources, but mutate rewrites them on the way in (inject default securityContext, add labels, set resource limits) and generate creates companion resources automatically (a default NetworkPolicy or ResourceQuota for every new namespace). That turns policy from pure gatekeeping into automated guardrails. Kyverno can also verify container image signatures with Cosign at admission, blocking unsigned images.
Code Example
# Deep-dive: Kyverno # YAML policies instead of Rego, validate/mutate/generate rule types, Audit vs Enforce validationFailureAction, policy exceptions, image verification with Cosign, and the CLI for testing policies in CI before they hit a cluster # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
Interview Tip
This is where depth shows — be concrete about Kyverno, not generic about "security".