Skip to main content

Kyverno

Kubernetes-native policy engine for validation, mutation, and generation of resources.

Kyverno is a CNCF policy engine designed for Kubernetes. It uses admission webhooks to enforce, mutate, and generate Kubernetes resources based on declarative ClusterPolicy and Policy rules written in YAML. It is used in this cluster to enforce security standards (e.g. require securityContext, block privileged containers), auto-generate resources (e.g. default NetworkPolicies, pull secrets), and mutate resources at admission time.

Alternatives considered​

Self Hosted

ToolOpen SourceFull FeaturesNotes
OPA GatekeeperYesYesUses Rego; more powerful but steeper learning curve
jsPolicyYesYesJavaScript-based policies; less adoption
KubewardenYesYesWasm-based; policies in multiple languages

Installation​

Architecture​

HelmRelease kyverno in namespace kyverno, chart version 3.7.1 from https://kyverno.github.io/kyverno/. CRDs installed via chart (crds.install: true). High-availability setup: admission controller (3 replicas), background controller (2 replicas), cleanup controller (2 replicas). Background scan enabled with 23h interval and 2 workers. PolicyException resources enabled in the kyverno namespace.

Security​

RBAC is cluster-wide (admission controller requires watching all resource types). Webhook timeout set to 5 seconds. No custom pod securityContext in the HelmRelease values; chart defaults apply. The admission controller itself enforces security policies on all other workloads.

Updates​

Managed by Renovate. Chart version is semver-pinned (3.7.1).

Administration​

Usage​

Cluster operators create ClusterPolicy resources to define admission rules. Policies can validate (block non-conforming resources), mutate (inject defaults), or generate (create derived resources). PolicyException resources in the kyverno namespace allow exempting specific workloads from policy rules. Background scanning continuously checks existing resources against policies.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/platform/talos/controllers/kyverno/README.md.

Cluster Deployment​

Kyverno — Talos cluster

Cluster-specific notes only. General product info, "why we use it", and alternatives live in docusaurus/docs/platform/kyverno.mdx.

Deviations from defaults​

Defaults live in docusaurus/docs/platform/kyverno.mdx — document anything this cluster does differently here, with a one-line reason.

Kubernetes Metadata
Rendered manifests (kustomize build)
apiVersion: v1
data:
  values.yaml: |
    # CRD installation moved to dedicated block
    crds:
      install: true

    admissionController:
      replicas: 3
      container:
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            memory: 512Mi
      # Webhook timeout is now usually nested under webhooks
      webhooks:
        timeoutSeconds: 5

    backgroundController:
      replicas: 2 # Recommended for HA
      container:
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            memory: 256Mi

    cleanupController:
      replicas: 2 # Recommended for HA
      container:
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            memory: 256Mi

    features:
      backgroundScan:
        enabled: true
        backgroundScanWorkers: 2
        backgroundScanInterval: 23h
      policyExceptions:
        enabled: true
        namespace: "kyverno"
kind: ConfigMap
metadata:
  name: kyverno-values-bh6278f7gg
  namespace: kyverno