Cloud Native Policy Management 🎉
- About Kyverno
- Non-Goals
- Documentation
- Demos & Tutorials
- Popular Use Cases
- Explore the Policy Library
- Getting Help
- Contributing
- Software Bill of Materials
- Contributors
- License
Kyverno is a Kubernetes-native policy engine designed for platform engineering teams. It enables security, compliance, automation, and governance through policy-as-code. Kyverno can:
- Validate, mutate, generate, and clean up resources using Kubernetes admission controls and background scans.
- Verify container image signatures for supply chain security.
- Operate with tools you already use — like
kubectl,kustomize, and Git.
Kyverno is only able to impact the policies used by Kubernetes and is not designed to address Kubernetes security flaws that are inherent in its design. For example, it cannot protect against vulnerabilities in the Kubernetes API server (e.g. Billion Laughs YAML deserialization, or a faulty Admission Controller implementation) or underlying infrastructure, and Kyverno's policy enforcement may be bypassed if Kubernetes itself has a security flaw. Kyverno does not enforce security requirements that were not explicitly defined — it enforces only the policies that users define and must be actively maintained like any other security product.
Kyverno does not replace, but works in conjunction with, Kubernetes RBAC: RBAC controls access while Kyverno enforces policy compliance. Cluster admins are expected to use RBAC to manage user and service account authorization, and then leverage Kyverno for additional checks that RBAC cannot perform.
Kyverno also does not replace Kubernetes' built-in policy controls like ValidatingAdmissionPolicies and MutatingAdmissionPolicies, but complements these native controls with additional features such as comprehensive reporting, exception management, and periodic background scanning.
Several capabilities that are out of scope for the core engine are addressed by companion projects in the Kyverno organization: end-to-end testing tooling (Chainsaw), policy violation reporting and UI (Policy Reporter), policy evaluation for non-Kubernetes JSON payloads (Kyverno JSON), and authorization policy for service meshes (Kyverno Envoy Plugin). These are maintained as separate projects with their own release cycles.
Kyverno installation and reference documentation is available at kyverno.io.
Kyverno helps platform teams enforce best practices and security standards. Some common use cases include:
- Enforce Pod Security Standards (PSS)
- Require specific security contexts
- Validate container image sources and signatures
- Enforce CIS Benchmark policies
- Auto-label workloads
- Enforce naming conventions
- Generate default configurations (e.g., NetworkPolicies)
- Validate YAML and Helm manifests
- Enforce resource quotas and limits
- Require cost allocation labels
- Validate instance types
- Clean up unused resources
- Require readiness/liveness probes
- Enforce ingress/egress policies
- Validate container image versions
- Auto-inject config maps or secrets
Discover hundreds of production-ready Kyverno policies for security, operations, cost control, and developer enablement.
We’re here to help:
- 🐞 File a GitHub Issue
- 💬 Join the Kyverno Slack Channel
- 📅 Attend Community Meetings
- ⭐️ Star this repository to stay updated
Thank you for your interest in contributing to Kyverno!
- ✅ Read the Contribution Guidelines
- 🤖 Read The AI_Usage_Policy
- 🧵 Join GitHub Discussions
- 📖 Read the Development Guide
- 🏁 Check Good First Issues and request with
/assign - 🌱 Explore the Community page
All Kyverno images include a Software Bill of Materials (SBOM) in CycloneDX format. SBOMs are available at:
Kyverno is built and maintained by our growing community of contributors!
Made with contributors-img
Copyright 2026, the Kyverno project. All rights reserved.
Kyverno is licensed under the Apache License 2.0.
Kyverno is a Cloud Native Computing Foundation (CNCF) Incubating project and was contributed by Nirmata.