Policy Management
Policy Management covers the lifecycle around your policies: how they are tested, rolled out, excepted, and cleaned up after.
Ship policies like code
Keep policies in Git, run kyverno test and an apply check in CI, and promote through GitOps so every change is reviewable. Pin the CLI to the cluster's Kyverno minor version so test results match runtime behaviour.
Roll out in stages
Start with failureAction: Audit and let background scans run. Read PolicyReport and ClusterPolicyReport results filtered by policy name, remediate the flagged workloads, then flip to Enforce. Keep an audit copy of high-risk policies even after enforcement so you can spot drift.
Exceptions as tracked debt
PolicyException resources name the policy and rules being bypassed and carry their own match. Record an owner and a reason, scope them to one namespace, and review them on a schedule - an exception with no expiry is a permanent hole.
Cleanup
CleanupPolicy and ClusterCleanupPolicy delete resources by schedule or TTL, including objects produced by generate rules that would otherwise linger after their trigger disappears.
Worked example
Rolling out "disallow hostPath": deploy in Audit with a Pod match and autogen, review failures, find one vendor DaemonSet that genuinely needs hostPath, create a PolicyException scoped to that namespace and rule name, fix everything else, then switch to Enforce. Reasoning: the exception documents the one real edge case instead of weakening the rule for everyone, and the report shows the remaining failures are zero before enforcement begins.
Traps
Enforcing on day one and blocking deployments; deleting a policy without cleaning up generated resources; unbounded exceptions with no owner; disabling the reports controller and losing visibility; and carrying policies across upgrades with fields the new CRD schema rejects.