問題文
A team has one ClusterPolicy containing two validate rules. A colleague proposes splitting it into two ClusterPolicies with one rule each, arguing that this changes the enforcement behavior. Is the colleague correct, and why?
選択肢
- Yes. Only the first rule in a policy is evaluated unless applyRules is set, so the second rule is dead code today.
- Yes. Namespaced policies can override cluster-wide policies, so the split creates an override opportunity.
- Yes. Rules inside one policy are evaluated as a logical OR, so splitting them turns the check into a logical AND.
- No. A single policy with two validate rules produces the same ultimate effect as two policies each having one rule, so the split is organizational.