What is a best practice and a common anti-pattern when using Kyverno?
Quick Answer
Do use validationFailureAction: Audit first, then Enforce; do not forget the webhook is in the request path — if the Kyverno pods are down with failurePolicy: Fail, admissions can stall.
Detailed Answer
Do use validationFailureAction: Audit first, then Enforce; do not forget the webhook is in the request path — if the Kyverno pods are down with failurePolicy: Fail, admissions can stall.
The anti-pattern usually comes from treating the tool as a checkbox rather than a control people have to live with. A gate that is too loud gets bypassed; a gate that blocks on things nobody can fix gets disabled; a suppression with no expiry becomes a permanent blind spot. The best practice above is the version that survives contact with a real team under delivery pressure.
Generally: make the signal trustworthy (low noise), make the required action clear and achievable, give an honest escape hatch for genuine exceptions, and review suppressions and thresholds on a schedule so the configuration does not quietly rot into "always green, never useful."
Code Example
# Best practice vs anti-pattern for Kyverno # Do use validationFailureAction: Audit first, then Enforce; do not forget the webhook is in the request path — if the Kyverno pods are down with failurePolicy: Fail, admissions can stall. # review suppressions/thresholds on a schedule so config doesn't rot
Interview Tip
Pair every best practice with the failure it prevents — it shows you learned it the hard way, not from a doc.