How do you prove a Kyverno validate.pattern actually blocks, given that a bad anchor fails open?

## Why patterns fail open A validate pattern produces one of two outcomes: a violation, or nothing. There is no third outcome for "this rule was incoherent". Kyverno will happily accept a pattern that can never produce a violation, because such a pattern is syntactically valid — it is just a set of conditions with nothing hanging off them. That is the structural reason a policy author cannot trust silence. The catalogue of silent no-ops is short and worth memorising: - **A conditional anchor with no peers.** `(resources): {limits: {memory: "?*"}}` alone is an `if` with no `then`; it asserts nothing. - **A star where you meant question-mark-star.** `"*"` matches the empty string, so it barely checks anything beyond key presence. - **A conditional anchor where you needed an equality anchor.** With `()`, a key that exists with the wrong value skips the peers silently; with `=()` it fails. - **An existence anchor on a universal rule.** `^(containers)` lets one compliant container answer for all the others. - **A misspelled anchored key.** `(resoures)` is a condition that is never true, so the block is skipped forever. - **A rule that matches nothing.** If the match block never selects the kind you thought, the rule is never even evaluated. Notice the asymmetry: the misspelling that is *unanchored* — `resoures:` as a required key — rejects every pod on day one and someone pages you within the hour. The same typo inside an anchor is invisible for as long as the rule exists. The louder failure is the safer one. ## Negative fixtures are the actual test The habit that fixes this is to write the rejection first. For every rule, keep two manifests next to the policy in the same repository: 1. A compliant pod — every container with `resources.limits.memory` and `ephemeral-storage`, every `emptyDir` with a `sizeLimit` — that must be **admitted**. 2. A deliberately non-compliant pod — one container missing the memory limit, ideally not the first one — that must be **rejected**. Run both through the Kyverno CLI: `kyverno apply` evaluates a policy against resource manifests offline, and `kyverno test` runs a declarative test file that states the expected result per policy, rule and resource. Wire that into CI on the policy repository so that the day someone "simplifies" a pattern by wrapping a key in parentheses, the negative fixture goes green-when-it-should-be-red and the pipeline stops them. ## Assert the path, not just the failure A negative fixture that only checks "something was rejected" is weak. A pod can be rejected by the wrong rule, or by the right rule for the wrong reason — for example the missing `initContainers` key rather than the missing memory limit. So assert the message content: the rule name and the field path Kyverno reports, such as `rule require-container-limits failed at path /spec/containers/1/resources/limits/memory/`. The index in that path is what proves the check reached the container you intended, and not the compliant one at index zero. Putting a non-compliant container second in the fixture is a cheap way to catch a rule that only ever inspects the first element. ## The estate-level smell test Before a rule is trusted, run it across a dump of manifests from real namespaces rather than only your two fixtures. The signal to look for is the violation count. Nobody's estate is fully compliant with a new resource-limits rule; a rule that finds zero violations across hundreds of workloads is telling you about the rule, not about the workloads. Conversely, a rule that flags every pod including ones you know are correct usually has an unanchored optional key — the `initContainers` trap — rather than a fleet-wide problem. ## When it fires, make it legible All this verification pays off at the moment somebody's deploy stops. You want to be able to say: this rule, this field, this container, and here is the fixture that proves it has behaved this way since the day it merged. That converts an argument about whether the gate is broken into a two-minute fix, which is most of what keeps a policy library alive in a team that has to ship.