⚡ TL;DR: Stop trusting code review to catch unsafe manifests. Encode guardrails as policy with OPA, Gatekeeper, or Kyverno, then enforce them automatically both in CI and at cluster admission, preventive and detective.

Contents

Someone shipped a privileged container

What policy as code actually means

Where the engine sits

OPA / Gatekeeper vs Kyverno

A real policy: deny privileged pods

Catch it in CI, not just at the cluster

Preventive vs detective enforcement

Common mistakes that cost hours

Takeaways

Where to go next

Someone shipped a privileged container

On a Tuesday afternoon a developer needed their pod to mount a host path for a quick debug session. They added securityContext: { privileged: true } , opened a PR, got a thumbs-up from a busy reviewer who skimmed the diff, and merged. The manifest sailed through CI. It deployed to production. Nobody caught it.

A privileged container can escape to the host node.…