World map

 

BM

World K6: Guards

Policies: CEL, Kyverno, Gatekeeper

You will learn: to write a house rule for gate 3, roll it out safely, and pick a rule keeper.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Your team agreed: no :latest tags. On Friday, someone ships nginx:latest anyway. How do you stop it every time?

Watch

A ValidatingAdmissionPolicy: A house rule checked at gate 3, written in CEL. Built into Kubernetes, nothing to install. is a house rule, built into Kubernetes. The rule itself is one line of CEL. Tap it.

Tap the line that holds the rule.

0 of 1 found

Predict

image: nginx has no tag at all. Does this rule stop it?

Try it

A policy does nothing alone. A binding says where it runs, and what to do: Deny, Warn or Audit. Put a safe rollout in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Write the policy (the rule)
  • Switch the binding to [Deny]
  • Bind it with validationActions: [Warn]
  • Read the warnings. Fix the old YAML.

Watch

Mei ships nginx:latest after the switch to Deny. Her error ends like this:

ValidatingAdmissionPolicy 'no-latest' with binding 'no-latest-kedai' denied request: Pin a version tag, not latest.

Try it

Add-ons called policy engine: An add-on rule keeper at gate 3, like Kyverno or Gatekeeper. do more. Sort the three rule keepers.

Drag a card into a box. Or tap the card, then tap the box.

        Check

        Good rule habit, or risky? Swipe each one.

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        Start new rules with Warn, then switch to Deny

        You did it!

        You can now write a house rule for gate 3.

        Go deeper (optional)

        Since Kubernetes 1.36, MutatingAdmissionPolicy is stable too: it changes objects with CEL. failurePolicy: Fail refuses requests when the rule itself breaks. A binding’s matchResources picks zones by label. Kyverno and Gatekeeper run as webhooks: extra pods you keep healthy.

        Real mission

        1. kubectl apply -f policy.yaml
        2. kubectl create namespace policy-test
        4. kubectl run test -n policy-test --image=nginx:latest

        0 of 5 steps done · Your ticks are saved.