Test Kyverno with a small set of Kubernetes manifests that includes both compliant and intentionally noncompliant resources. Begin in audit mode, inspect the resulting policy reports, and identify legitimate workloads that would be blocked. Only then move a narrowly scoped policy to enforcement.
Include admission behavior, background scans, exceptions, and upgrade handling in the trial. Security policy is useful when developers can understand the rejection and remedy it. Record who owns exceptions and how to revert an overly broad rule before applying it cluster-wide.
Akousa