Kyverno apiCall SSRF: Policy Engines Need Egress Boundaries Too
Kyverno's apiCall feature is exactly the kind of capability platform teams end up wanting after the first wave of policy adoption. Static admission checks are useful, but real clusters are full of context. A namespace may need to be compared against an inventory system. A deployment may need
