Kyverno — Policy as Code for Kubernetes

What it is

Kyverno is a policy engine designed for Kubernetes that uses native YAML instead of a proprietary policy language. It validates, mutates, and generates Kubernetes resources using policies defined as custom resources. Unlike OPA/Gatekeeper which requires learning Rego, Kyverno policies look like standard Kubernetes manifests.

Cluster administrators enforcing security baselines, platform teams standardizing resource configurations, and DevOps engineers automating Kubernetes best practices use Kyverno to codify and enforce rules across their clusters.

How it saves time or tokens

Without a policy engine, enforcing standards like 'all pods must have resource limits' or 'no containers can run as root' requires manual review or custom admission webhooks. Kyverno automates enforcement at the admission control layer. Its mutation capabilities can automatically inject sidecars, add labels, or set defaults, eliminating manual configuration steps. Since policies are YAML, the learning curve is minimal for teams already working with Kubernetes.

How to use

1. Install Kyverno via Helm:

helm repo add kyverno https://kyverno.github.io/kyverno/
helm install kyverno kyverno/kyverno --namespace kyverno --create-namespace

1. Apply a validation policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-team-label
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: 'The label team is required.'
        pattern:
          metadata:
            labels:
              team: '?*'

1. Apply with kubectl apply -f policy.yaml. Any pod without a 'team' label will be rejected.

Example

# Mutation policy: automatically add resource limits
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-resources
spec:
  rules:
    - name: add-limits
      match:
        any:
          - resources:
              kinds:
                - Pod
      mutate:
        patchStrategicMerge:
          spec:
            containers:
              - (name): '*'
                resources:
                  limits:
                    memory: 256Mi
                    cpu: 500m
                  requests:
                    memory: 128Mi
                    cpu: 250m

Related on TokRepo

• DevOps Tools -- explore DevOps and infrastructure tools
• Security Tools -- discover security policy and compliance tools

Common pitfalls

• Setting validationFailureAction to 'Enforce' blocks non-compliant resources immediately. Start with 'Audit' to see violations in reports before enforcing.
• Kyverno runs as an admission webhook. If it goes down, new resource creation may be blocked. Configure failurePolicy and resource limits to ensure high availability.
• Mutation policies apply in order. When multiple policies modify the same resource, the final state depends on policy execution order. Test with kubectl apply --dry-run to verify.