Sachin Chaurasiya
Search articles, labs, tools…

Protect · Admission policy

Kyverno

Kyverno enforces policies as Kubernetes resources — no new language. It validates and mutates resources at admission, generates defaults like NetworkPolicies, and verifies image signatures and attestations.

Stage
Protect
Category
Admission policy
Website
kyverno.io
Documentation
Official docs
Source
kyverno/kyverno
License
Apache-2.0
On this page

What it does

Runs as an admission controller and background scanner. Since Kyverno 1.19 the stable policy types are ValidatingPolicy, MutatingPolicy, GeneratingPolicy and ImageValidatingPolicy (policies.kyverno.io/v1), written in CEL as supersets of the Kubernetes ValidatingAdmissionPolicy and MutatingAdmissionPolicy types. The older ClusterPolicy/Policy kinds still work but print a deprecation warning. PolicyReport objects record pass and fail per resource, which is how an Audit policy is evaluated before it is switched to Deny.

Where it fits

Protect stage: the enforcement point for Pod Security, registry allowlists, required labels/limits and image signature verification.

Quick start

helm repo add kyverno https://kyverno.github.io/kyverno/
helm install kyverno kyverno/kyverno -n kyverno --create-namespace
kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/pod-security/restricted/disallow-privilege-escalation/disallow-privilege-escalation.yaml
kubectl get vpol,mpol,gpol            # the CEL policy types
kubectl get policyreport -A

Common pitfalls

  • Enforcing cluster-wide on day one breaks system namespaces; start in Audit, exclude kube-system.
  • Webhook failure policy set to Ignore silently disables enforcement when Kyverno is down; understand the trade-off.
  • A MutatingPolicy written against Object.spec… is auto-generated for Deployments and fails there with a type error; set spec.autogen.podControllers.controllers: [] or write it against spec.template.
  • Only the first denying policy’s message reaches the client (one fine-grained webhook per policy); the reports show all of them.

On this site

  • Platform Guardrails with Kyverno and GitOps: baseline and production ValidatingPolicy layers keyed on namespace labels, delivered by Argo CD, rolled out audit-first, with scoped PolicyException objects that expire.

Hands-on labs using Kyverno

Lab

Enforce Pod Security with Pod Security Admission and Kyverno

On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.

intermediate 45 minutes Kubernetes · Kyverno

Articles about Kyverno

DevOps intermediate

Platform Engineering Foundations: Defining the Platform Contract

The operating model behind the CI templates, ApplicationSets, Kyverno guardrails and observability stack on this site: what a team hands over, what the platform returns, where the golden path ends and enforcement begins.

11 min read
DevOps intermediate

Platform Guardrails with Kyverno and GitOps

Kyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.

17 min read
Kubernetes intermediate

Kubernetes Security Checklist for Production Clusters

A layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.

10 min read