Does Your Policy Engine Fail Open or Closed?

The question almost nobody asks until the audit: what happens to admission when the policy engine itself is down? Because it will be. It is a pod, and pods get evicted, upgraded, or fail to come back up. Gatekeeper ships failurePolicy: Ignore with a 3 second timeout — the upstream default. If it is down, slow, or mid-upgrade, workloads are admitted and the audit sweep flags it a minute later, by which point it is running. Kyverno is the other way around. It fails closed, with a 10 second timeout. Neither default is wrong. Fail-open protects the cluster, fail-closed protects the policy. An admission webhook is a structural control only if it fails closed — if it fails open, then for the duration of the outage it is an advisory control in a high-vis jacket. Go and check which one you installed. Most people never have. Full talk — policy as code on two real clusters, OPA Gatekeeper vs Kyverno: https://youtu.be/Cz_Bgg8wedM #kubernetes #policyascode #sre #platformengineering #shorts