DevSecOps Policy as Code: Blocking Vulnerable Images & Root Containers with Trivy and Kyverno

Traditional security reviews happen at the end of the development cycle, delaying software releases and frustrating engineering teams. Policy as Code shifts security enforcement directly into the Kubernetes API admission controller phase, automatically rejecting any pod that attempts to run as root or contains critical unpatched CVEs.

Kyverno ClusterPolicy: Forbidding Root Execution

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: disallow-root-user
spec:
 validationFailureAction: Enforce
 background: true
 rules:
 - name: check-runAsNonRoot
 match:
 any:
 - resources:
 kinds:
 - Pod
 validate:
 message: "Running containers as root is strictly forbidden in production namespaces."
 pattern:
 spec:
 securityContext:
 runAsNonRoot: true
 containers:
 - securityContext:
 runAsNonRoot: true
 allowPrivilegeEscalation: false