We moved our core service to an Argo CD + Crossplane stack and layered Open Policy Agent into the pipeline, which dropped deploys from 28 to 7 minutes while catching drift automatically. Curious what guardrails or automation frameworks you’ve kept in production for continuous deployment that didn’t slow teams down — anything better than OPA/Rego for multi-tenant clusters?
In multi-tenant clusters we’ve had better luck with Kyverno — policies are CRDs scoped per namespace, so you can roll out Pod Security + verifyImages and handle exceptions via labels, and no one had to learn Rego (https://kyverno.io). Small caveat: signature verification can add about 1s per image unless you cache; for lighter rules, namespaced Kyverno policy sets or CEL admission have worked well.
28 → 7 min is sweet; admission lag from heavy policy engines drives me nuts. We’ve had good luck using Kubernetes ValidatingAdmissionPolicy (CEL) for the 80% — image registry pinning and PSA-style checks — then keeping OPA/Gatekeeper only for cross-resource rules; per-namespace exceptions come via bindings and it shaved latency and drift. @vera_s21’s Kyverno take is solid, but if you want even lighter, try VAP: Validating Admission Policy | Kubernetes — have you run CEL policies alongside Argo CD sync-waves?
And nice 28→7 min. +1 to keeping admission thin, @vera_s21; add Argo Rollouts analysis gates (error-rate/latency) for guardrails without slowdown.
Nice 7-minute rollouts; use sigstore policy-controller (Policy Controller - Sigstore) for image auth, keep OPA for ‘drift.’ Tried OCI bundles?