nvimqWriteups and notes on DevSecOps, Kubernetes, cloud security and CTF work by Nurdaulet Bolat.https://nvimq.is-a.dev/enRBAC cannot see inside your YAML, and that is the whole problemhttps://nvimq.is-a.dev/writeups/2026/09/07/kyverno-admission-pipeline/https://nvimq.is-a.dev/writeups/2026/09/07/kyverno-admission-pipeline/RBAC decides who may create a Pod. It has no opinion on what is inside it. Here is where admission control fits, and how to prove it on a kind cluster in ten minutes.Mon, 07 Sep 2026 00:00:00 GMTkubernetesdevsecopspolicy-as-codekyvernoSuppressions that expire: how KubeBuddy handles ignored findingshttps://nvimq.is-a.dev/writeups/2026/09/03/kubebuddy-ignore-until/https://nvimq.is-a.dev/writeups/2026/09/03/kubebuddy-ignore-until/Most cluster scanners let you silence a finding forever. KubeBuddy makes the exception expire, and I verified it on a kind cluster.Thu, 03 Sep 2026 00:00:00 GMTkubernetesdevsecopspolicy-as-codeheadlamp