A Kubernetes admission match condition can silence the policy it was meant to enforce

ValidatingAdmissionPolicy lets the Kubernetes API server evaluate Common Expression Language rules without calling an external webhook. A policy declares the validation expressions. A binding decides which requests use the policy and whether violations are denied, audited or merely warned. Match conditions narrow that scope further. They look like a convenience, but a false result skips the policy.

Kubernetes documentation is explicit that if any match condition evaluates to false, the API server skips the policy regardless of other errors. That behavior makes a careless expression a security configuration change. A condition intended to select namespaces with a particular label may silently exclude every namespace after a label migration.…