An enforcement action configures how a policy handles violations. Set enforcementAction: dryrun to audit violations without blocking requests; remove it to enforce denial through the admission controller. section 13.9.1
Use the setting operationally as follows:
- Deploy a constraint with enforcementAction: dryrun, then inspect its violations output. section 13.9.1
- After confirming the audit results, remove the enforcementAction: dryrun line and redeploy the constraint. section 13.9.1
- Expect noncompliant Pod requests to be denied at startup once enforcement is active. section 13.9.1
