Testing Kyverno Attestation Policies: The Bug That Shipped Twice, and What I Built to Stop a Third

You can write a Kyverno policy, pass kubectl apply --dry-run, get a clean code review, and still ship a policy that admits exactly the images it was supposed to block. Dry-run validates that your YAML