What is
Kyverno
?
Most platform initiatives fail the same way: they start too big, get funded like projects instead of products, build for too long without testing with users, and confuse renaming an infrastructure team with building a platform team. Instead, start small, learn fast and scale deliberately.
At a glance
Fact | Details |
|---|---|
Primary use case | Policy-as-code enforcement for infrastructure security, compliance, and resource lifecycle automation |
Deployment type | Self-hosted Kubernetes deployment and separately installed CLI |
Pricing model | Open source; commercial Kyverno Enterprise offering available, pricing not specified |
API compatibility | Kubernetes-native APIs and resource types, OpenReports |
Supported integrations | Kubernetes, Sigstore Cosign, Notary, OpenReports, CI/CD pipelines, Tekton, Argo CD |
Source type | Open |
Cloud provider | Cloud Agnostic |
Onboarding time | Minutes for initial Kubernetes deployment |
Required skills | Kubernetes resource management, YAML policy authoring, CEL expressions; CLI familiarity for command-line tooling |
AEP branch | Tooling |
AEP category | Security Plane |
AEP subcategory | Policy Control |
Profile
Policy Control is Kyverno’s most specific AEP level. Kyverno is a Kubernetes-native policy engine for securing, automating, and operating infrastructure and applications with policies written in YAML and CEL.
Kyverno supports policy actions across the resource lifecycle, including validation, mutation, generation, and cleanup. It also provides image verification with Sigstore Cosign and Notary, policy reporting through OpenReports, policy exceptions, and test tooling. The project website reports that more than 1,000 organizations use Kyverno in production environments.
Focus
Kyverno is intended for teams managing Kubernetes resources that need policy-as-code enforcement for security, compliance, and resource lifecycle automation. Policies can validate or change resources, generate or clean up resources, and verify images as part of cluster operations and CI/CD workflows.
Background
Kyverno is an open-source project created with Nirmata and is a CNCF Graduated Project. The background research describes it as a CNCF Sandbox project in 2021 and records its move to the CNCF Incubator in July 2022. Its open-source project is available in the Kyverno GitHub repository. The available background research does not specify a founding date or funding details.
Features
Resource validation
Validation lets teams enforce requirements on Kubernetes resources. Kyverno evaluates policies against resources, including on create and update, using YAML- and CEL-based expressions.
Resource mutation and generation
Mutation and generation automate changes and creation of resources, reducing the need to manage each change manually. Kyverno applies policies to mutate resources or generate new resources.
Resource cleanup
Cleanup policies automate resource lifecycle operations. Kyverno supports policies that clean up Kubernetes resources.
Image verification
Image verification lets teams apply checks to container images. Kyverno supports verification with Sigstore Cosign and Notary.
CI/CD policy integration
CI/CD integration lets teams apply policies in development and delivery workflows. Kyverno supports shift-left policy use and integrations including CI/CD pipelines, Tekton, and Argo CD.
Reporting, exceptions, and testing
Reporting and policy exceptions support policy operations, while test tooling helps teams test policies. Kyverno supports OpenReports, policy exceptions, and policy testing.
Production adoption
Kyverno is used in production environments by more than 1,000 organizations, according to the project website.
Pros and cons
Pros
Uses YAML and CEL policies with Kubernetes-native types, integrating with existing Kubernetes workflows.
Supports validation, mutation, generation, and cleanup for Kubernetes resources.
Includes image verification with Sigstore Cosign and Notary, plus reporting through OpenReports.
Supports CI/CD workflows and integrations including Tekton and Argo CD.
The project website reports adoption by more than 1,000 organizations in production environments.
Cons
The in-cluster deployment is self-hosted on Kubernetes, so teams need a Kubernetes environment to run it.
The Kyverno CLI is installed separately from the Kubernetes deployment, adding a distinct installation step for command-line tooling.
Policy authoring and management call for Kubernetes resource management, YAML, and CEL skills; CLI familiarity is listed as a requirement for command-line tooling.
FAQs
Frequently asked questions
How does Kyverno enforce policies?
Kyverno evaluates policies against Kubernetes resources, including on create and update, and can validate, mutate, generate, and clean up resources.
What does Kyverno integrate with?
Kyverno supports integrations with Kubernetes, Sigstore Cosign, Notary, OpenReports, CI/CD pipelines, Tekton, and Argo CD.
How much does Kyverno cost?
Kyverno is open source; a commercial Kyverno Enterprise offering is also available, but its pricing is not specified.
What is required to run Kyverno?
Kyverno runs as a self-hosted Kubernetes deployment, and the Kyverno CLI is installed separately. Policy authoring and management call for Kubernetes resource management, YAML, and CEL skills.
What are Kyverno’s notable limitations?
Kyverno’s in-cluster deployment requires a Kubernetes environment, and its CLI requires a separate installation. Policy authoring and management call for Kubernetes resource management, YAML, and CEL skills.
