#PolicyException
LightNews LightNews
beefedai.bsky.social
Security Policy Exception Process: Design & Governance

https://beefed.ai/en/security-policy-exception-process

#PolicyException #ExceptionProcess #RiskAcceptance #SecurityGovernance #CompensatingControls
Security Policy Exception Process: Design & Governance
beefed.ai
October 13, 2026 at 3:56 PM
devtocash.bsky.social
Last trap: a Kyverno PolicyException must also list the autogen- rule name, or the Deployment stays blocked.

Full workflow, policy, and break-glass:
https://devtocash.com/blog/2026-09-19-cosign-keyless-signing-github-actions-sbom-kyverno-verify
#DevSecOps #Kubernetes
Cosign Keyless Signing in GitHub Actions: Sign Images, Attest SBOMs, and Enforce It with Kyverno
Cosign keyless signing in GitHub Actions, end to end: sign images by digest, attach SBOM attestations, and enforce verification at admission with Kyverno.
devtocash.com
September 19, 2026 at 6:16 PM
Kyverno 1.12 released
Project post originally published on Kyverno’s blog Kyverno 1.12 released with new alternative report server, Global Context Entry, Kyverno JSON in CLI, performance optimizations, enhanced ValidatingAdmissionPolicy and PolicyException support, and tons…
dlvr.it
May 24, 2024 at 2:15 AM
goodfirstissue.bsky.social
an issue just got labeled #goodfirstissue for kyverno/kyverno #Go
[Feature] Add PolicyException name to skipped PolicyReportResults
[Feature] Add PolicyException name to skipped PolicyReportResults
Problem Statement When a validation rule for a resource was skipped because of an existing PolicyException its not visible for a User which PolicyException leads to the skip. Solution Description A...
github.com
June 8, 2024 at 11:28 PM
goodfirstissue.bsky.social
an issue just got labeled #goodfirstissue for kyverno/kyverno #Go
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
Problem Statement In 1.12, policy exceptions support excluding pod security control names as follows: apiVersion: kyverno.io/v2beta1 kind: PolicyException metadata: name: pod-security-exception nam...
github.com
January 26, 2024 at 12:06 PM
goodfirstissue.bsky.social
an issue just got labeled #goodfirstissue for kyverno/kyverno #Go
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
Problem Statement In 1.12, policy exceptions support excluding pod security control names as follows: apiVersion: kyverno.io/v2beta1 kind: PolicyException metadata: name: pod-security-exception nam...
github.com
January 26, 2024 at 12:06 PM
goodfirstissue.bsky.social
an issue just got labeled #goodfirstissue for kyverno/kyverno #Go
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
[Feature] Add Chainsaw tests to cover podSecurity exemptions in policy exceptions
Problem Statement In 1.12, policy exceptions support excluding pod security control names as follows: apiVersion: kyverno.io/v2beta1 kind: PolicyException metadata: name: pod-security-exception nam...
github.com
January 26, 2024 at 12:06 PM
goodfirstissue.bsky.social
an issue just got available for assignment #goodfirstissue for kyverno/kyverno #Go
[Feature] Support PolicyException with CLI
[Feature] Support PolicyException with CLI
Problem Statement I cannot evaluate resources against both PolicyException and policies using the CLI Solution Description I would like to be able to test a series of policies and PolicyException a...
github.com
January 3, 2024 at 12:01 PM
goodfirstissue.bsky.social
an issue just got labeled #goodfirstissue for kyverno/kyverno #Go
[Feature] Support PolicyException with CLI
[Feature] Support PolicyException with CLI
Problem Statement I cannot evaluate resources against both PolicyException and policies using the CLI Solution Description I would like to be able to test a series of policies and PolicyException a...
github.com
September 14, 2023 at 9:18 AM
pras.my.id
Kyverno blocks privileged containers. Falco needs privileges to attach its eBPF probe.

I wrote a scoped PolicyException in Git: namespace-locked; label-matched, and ArgoCD synced it before Falco's Wave 3 even started.

That's the policy lifecycle: Audit → Exception → Enforce.
Kube GitOps Lab 03: Adding Runtime Security with Falco and FalcoSidekick
Phase 2c adds Falco and FalcoSidekick for both admission-time enforcement and runtime syscall monitoring under the same GitOps workflow
medium.com
April 28, 2026 at 2:19 AM
cyberhub.blog
📌 CVE-2024-48921 - Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation o... https://www.cyberhub.blog/cves/CVE-2024-48921
CVE-2024-48921
Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this all
www.cyberhub.blog
July 11, 2026 at 3:07 PM
rgonv.bsky.social
Announcing Kyverno release 1.13!
Project post originally published on the Kyverno blog Kyverno 1.13 released with Sigstore bundle verification, exceptions for validatingAdmissionPolicies, new assertion trees, generate enhancments, enhanced ValidatingAdmissionPolicy and PolicyException…
dlvr.it
November 13, 2024 at 7:11 PM
cve-notifications.incredincomp.com
ID: CVE-2024-48921
CVSS V4.0: HIGH
Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are...
#security #infosec #cve-alert
nvd.nist.gov
October 29, 2024 at 3:15 PM