cel Server-Side CEL Type-Checking as a CI Lint kubectl --dry-run=client accepts a ValidatingAdmissionPolicy with a broken CEL expression. --dry-run=server compiles it, names the column of the error, and exits 1 — with nothing persisted. That is a free CI lint.
vap Native ValidatingAdmissionPolicy vs Kyverno, Same Two Controls The registry allow-list and the digest-pinning control were reimplemented as native CEL ValidatingAdmissionPolicies and run against the identical fixtures. Same verdict on every Pod — and CEL's messageExpression names the offending image.
