DevSecOps Policy as Code: Blocking Vulnerable Images & Root Containers with Trivy and Kyverno

Traditional security reviews happen at the end of the development cycle, delaying software releases and frustrating engineering teams. Policy as Code shifts security enforcement directly into the Kubernetes API admission controller phase, automatically rejecting any pod that attempts to run as root or contains critical unpatched CVEs.

Kyverno ClusterPolicy: Forbidding Root Execution

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-root-user
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: check-runAsNonRoot
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Running containers as root is strictly forbidden in production namespaces."
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true
            containers:
              - securityContext:
                  runAsNonRoot: true
                  allowPrivilegeEscalation: false