The Day I Found Out My Policies Were Off
Full length talk (20 minutes)
Abstract
The first time I actually checked which of my admission policies were enforcing, the answer was: not all of them. Namespaces had been excluded that I didn't exclude. Policies I'd set to enforce were sitting in warn only. A webhook config had been deleted and nobody had said anything. The dashboards were green the whole time. I'd been reporting "enforced" and enforcing a fraction of it.
This talk is how that happens, and how I rebuilt it so it stuck.
It happens because engineers don't hate security, they hate a denied deploy at 2am with a Rego error they can't read. So they take the one-line exit: failurePolicy: Ignore, a namespace exclusion, or deleting the ValidatingWebhookConfiguration outright. If the bypass is cheaper than complying, they bypass. That's not their failure, it's mine — I priced the control wrong, and then I didn't watch whether it stayed on.
The rebuild had two halves. First, roll out like you mean to keep it: audit mode before anything, so a policy shows me what it would block before it blocks a real deploy; then warn, then enforce, one namespace at a time; exceptions self-service and expiring, because one that never expires is a hole with paperwork on it. Second, and the part I'd missed entirely: instrument the bypasses. A change to a webhook config pages me now. Namespace exclusions get diffed against a baseline. The quiet disable is the one that hurts, so I stopped trusting the dashboard and started watching the exits.
You'll leave able to check whether your own controls are actually on — most people have never looked — and roll them out so they're still enforcing in six months instead of switched off in six weeks.
Speaker Bio
Osama Okunbo is a Security and Software Engineer who consults with startups and scaleups on cloud-native security, Kubernetes, and compliance. Before working in tech he competed as a professional Judoka and studied Sports Science, eventually transitioning into software engineering through game development before finding his way into cloud security and DevSecOps. He leads security engineering at Immibuddy, a Canadian immigration SaaS platform, and holds consulting clients in fintech and retail. He is the author of Hello Fraud: Why You Feel Like an Impostor in Tech and How to Fix It and holds an MSc in Cybersecurity from the University of Suffolk. He spoke at Manchester Tech Festival 2025 on agentic AI in cybersecurity.