Kyverno

Visit Website

Introduction

Kyverno is a Kubernetes-native policy engine designed for platform engineering teams. The README says it enables security, compliance, automation and governance through policy-as-code, and that it can validate, mutate, generate and clean up resources using Kubernetes admission controls and background scans.

Its defining choice is the policy language. Instead of a separate language like Rego, Kyverno policies are Kubernetes resources written in YAML, with Common Expression Language (CEL) available for more complex logic. For teams that already think in manifests, this lowers the barrier: a policy that requires a label or blocks privileged containers looks like the resources it governs.

Kyverno does more than block bad resources. Mutation policies can add defaults such as labels or security contexts; generation policies can create NetworkPolicies or quotas whenever a namespace appears; cleanup policies delete stale resources; and image verification rules can check container signatures and attestations. Policy reports record results for existing resources found during background scans.

For testing and release checks, the Kyverno CLI applies policies to manifests outside a cluster and runs declarative policy tests, so the same rules can fail a pull request before anything reaches the API server. The project also maintains Chainsaw, a declarative end-to-end testing tool for Kubernetes controllers.

The project publishes a policy library with hundreds of ready-made policies covering Pod Security Standards, best practices, cost control and developer enablement. In the quality loop, Kyverno sits at release (CLI in CI) and in production (admission control and background scans).

The source code is at kyverno/kyverno on GitHub under the Apache-2.0 licence, with about 8,300 stars; the most recent commit was on 11 November 2026.

Rolling out Kyverno safely usually starts in Audit mode: policies report violations without blocking, which shows how many existing workloads would fail. Teams then fix the workloads or add exceptions, switch critical policies to Enforce, and run the Kyverno CLI against manifests in CI so violations are caught before they reach the cluster.

Features

1. Validate: Block or audit resources that break rules, with clear messages.
2. Mutate: Add or change fields such as labels, security contexts or image registries.
3. Generate: Create related resources automatically, for example default NetworkPolicies.
4. Cleanup: Delete resources that match conditions on a schedule.
5. Image verification: Check container image signatures and attestations.
6. YAML and CEL: Policies are Kubernetes resources, with CEL for expressions.
7. Policy reports: Results for new and existing resources from background scans.
8. Kyverno CLI: Apply and test policies against manifests in CI.
9. Policy library: Hundreds of community policies, including Pod Security Standards.
10. Exceptions: Scoped policy exceptions for workloads that need them.

Pros

1. Kubernetes-native: No new language for teams fluent in YAML manifests.
2. Beyond validation: Mutation, generation and cleanup reduce manual platform work.
3. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
4. Actively maintained: The repository had commits as recent as 11 November 2026.
5. Community: About 8,300 GitHub stars.

Cons

1. Kubernetes only: Not a general policy engine for other systems.
2. Complex logic: Very intricate rules can become verbose in YAML.
3. Admission latency: Webhook policies add work to API requests, so sizing and failure modes need planning.
4. Policy sprawl: Large libraries need ownership and tests to stay maintainable.

Usage and Links (Example)

A validation policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: require-team-label }
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-team
      match: { any: [ { resources: { kinds: [Deployment] } } ] }
      validate:
        message: "label 'team' is required"
        pattern: { metadata: { labels: { team: "?*" } } }

Check manifests in CI before they reach a cluster:

kyverno apply policies/ --resource k8s/
kyverno test tests/

Practical tips:

1. Roll out new policies in Audit mode and read the policy reports before enforcing.
2. Keep policies and their CLI tests in the same repository.
3. Start from the official library rather than writing common rules from scratch.

Resources:

• Kyverno website
• GitHub repository

Pricing

Kyverno is free and open source under the Apache-2.0 licence.

Recommended for?

1. Kubernetes platform teams that want guardrails without learning Rego.
2. Clusters following Pod Security Standards or supply-chain signing policies.
3. Teams that want policies tested in CI and enforced at admission.
4. Not a fit for policy needs outside Kubernetes.

Conclusion

Kyverno makes Kubernetes policy approachable. YAML and CEL policies, mutation and generation, image verification and a CLI for CI give platform teams a full policy toolkit in a familiar format.

If your policy scope is Kubernetes, it is often the simplest strong choice; pair Audit mode, policy reports and CLI tests to roll rules out safely.

On CheckOps, Kyverno is filed under the Release & CI gates, Security testing and Production monitoring & observability stages. Related tools listed here include Open Policy Agent, OPA Gatekeeper, Conftest, Kubescape, KubeLinter and Chainsaw. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.