Kyverno
By the Cloud Native Computing Foundation
Kyverno is a Kubernetes-native policy management engine that lets administrators validate, mutate, and generate cluster resources using policies written as ordinary Kubernetes custom resources rather than a separate policy language. It…
Definition
Kyverno is a Kubernetes-native policy management engine that lets administrators validate, mutate, and generate cluster resources using policies written as ordinary Kubernetes custom resources rather than a separate policy language. It runs as an admission controller, intercepting resource creation and update requests to enforce rules such as requiring resource limits, blocking privileged containers, or automatically injecting labels, so noncompliant configurations never reach the cluster.
Overview
Kubernetes clusters can accept almost any workload configuration by default, which means enforcing organizational standards, such as requiring image signatures, disallowing privileged containers, or mandating resource limits, has to be handled outside of core Kubernetes itself. Kyverno addresses this by acting as a policy layer that intercepts every resource request before it is persisted, checking it against declarative rules and either allowing, blocking, or modifying it. A Kyverno policy is itself a Kubernetes custom resource, written in YAML using the same structure as the resources it governs, which means a cluster operator can write and manage policies with kubectl and standard GitOps workflows rather than learning a separate policy language. Kyverno supports three policy actions: validation, which accepts or rejects a resource; mutation, which can automatically add or change fields such as labels or security context settings; and generation, which can create supporting resources like network policies whenever a triggering resource is created. All three run through Kubernetes' admission webhook mechanism. Kyverno's main point of comparison is Gatekeeper, which enforces similar admission-time policy but requires writing rules in Rego, the Open Policy Agent policy language. Kyverno's YAML-native approach lowers the barrier for teams already comfortable with Kubernetes manifests, while Gatekeeper's Rego foundation gives access to a more general-purpose policy language that can express more complex logic. Neither tool addresses runtime behavior once a resource is running, which is the domain of tools like Falco. Organizations commonly use Kyverno to enforce baseline pod security standards, require specific labels or annotations for cost tracking, block images from untrusted registries, and automatically generate default network policies for new namespaces. Because policies are Kubernetes resources, they fit naturally into existing GitOps pipelines and can be reviewed through the same pull request process as application manifests. Because Kyverno evaluates every matching admission request synchronously, poorly written or overly broad policies can add latency to resource creation or, in a misconfiguration, block legitimate deployments entirely. Its expressiveness is also bounded by its YAML-based rule structure, and workflows that need highly complex conditional logic sometimes find Gatekeeper's Rego language a better fit despite its steeper learning curve. Kyverno also supports a non-blocking audit mode so a team can trial a new policy against live traffic and measure its impact before switching it to enforce, which lowers the risk of an overly strict rule breaking legitimate deployments once it goes live. Kyverno also provides a CLI for testing policies against manifests locally before they are ever applied to a cluster, which lets policy authors iterate quickly without needing a live Kubernetes environment for every change.
Key Features
- Writes policies as native Kubernetes custom resources in YAML
- Supports validating, mutating, and generating resources through one engine
- Runs as a Kubernetes admission webhook to enforce rules before persistence
- Requires no separate policy language beyond standard Kubernetes manifest syntax
- Integrates naturally with GitOps review workflows for policy changes
- Can automatically generate supporting resources like default network policies
- Reports policy violations for auditing without necessarily blocking resources