Skip to main content

Policy Reporter

A Kyverno policy compliance dashboard for Kubernetes.

Policy Reporter is a tool that reads Kubernetes PolicyReport and ClusterPolicyReport resources (generated by Kyverno) and provides a web UI dashboard and metrics for visualizing policy compliance across the cluster. Self-hosting this alongside Kyverno gives visibility into which workloads violate policies without external tooling.

Alternatives considered​

Self Hosted

ToolOpen SourceFull FeaturesNotes
OPA/GatekeeperYesYesOPA-based policies instead of Kyverno

Installation​

Architecture​

  • HelmRelease: Deployed via the policy-reporter Helm chart with UI and Kyverno plugin enabled
  • Config: ui.enabled: true, plugin.kyverno.enabled: true, metrics.enabled: true in ConfigMap values
  • Networking: HTTPRoute to internal gateway; no public exposure
  • Storage: No persistent storage — reads live from the Kubernetes API

Security​

No container-level securityContext visible in kustomize output (managed by Helm chart defaults). SOPS-encrypted tofu-encryption secret present in namespace.

Updates​

Managed by Renovate.

Data Management​

No persistent data. All data is read live from Kubernetes PolicyReport and ClusterPolicyReport resources. No backup needed.

User Management​

No OIDC configured. Access restricted to internal network via HTTPRoute.

Configuration Management​

  • Helm chart values in ConfigMap (UI, Kyverno plugin, and metrics settings)
  • tofu-encryption secret from SOPS-encrypted source

Usage​

Access the web UI to view policy compliance reports across namespaces. Filter by policy, resource, or result status (pass/fail/warn). Metrics are scraped by the monitoring stack for alerting on policy violations. The Kyverno plugin provides additional report enrichment.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/apps/policy-reporter/talos/README.md.

Cluster Deployment​

App URLs
Depends on

Policy Reporter — Talos cluster

Deviations from defaults​

  • All three images pinned by digest (policy-reporter-values.yaml) — verify-policy-reporter-provenance runs with verifyDigest: true, so the tag-only chart defaults are rejected at admission and Flux cannot reconcile the HelmRelease.
Kubernetes Metadata
  • HelmRelease: policy-reporter@3.11.1
  • HelmRepo: policy-reporter (oci://ghcr.io/kyverno/charts/policy-reporter)
Rendered manifests (kustomize build)
apiVersion: v1
data:
  values.yaml: |
    # All three Policy Reporter images are pinned by tag AND digest: the Kyverno
    # policy verify-policy-reporter-provenance checks SLSA provenance with
    # verifyDigest: true, which rejects tag-only image references at admission —
    # Flux's dry-run fails and the HelmRelease cannot reconcile. The chart has no
    # digest value, so the digest rides in `tag`. Renovate's helm-values manager
    # parses `tag@digest`; the chart version is grouped into the same PR.
    image:
      registry: ghcr.io
      repository: kyverno/policy-reporter
      tag: 3.11.1@sha256:a95ef6394c4d57eeb488c589d278c6c64f029b306b0838f26badbbe6588b8b56

    ui:
      enabled: true
      image:
        registry: ghcr.io
        repository: kyverno/policy-reporter-ui
        tag: 2.9.0@sha256:2a109222a00ee5896626a73b0c71fa7aa412588189e0fd6b80016adf11fe3662

    plugin:
      kyverno:
        enabled: true
        image:
          registry: ghcr.io
          repository: kyverno/policy-reporter/kyverno-plugin
          tag: 0.7.2@sha256:adc9d4c4601a24474084a900299e5e82ef3101536df2b6b22ea927c233b6176b

    metrics:
      enabled: true
kind: ConfigMap
metadata:
  name: policy-reporter-values-798f8dkt9b
  namespace: policy-reporter