- Home
- Cloud Governance Software
- Kyverno
Kyverno
What it is
Kyverno is an open-source policy engine for Kubernetes that lets platform teams define and enforce policy as code. Its stable policy types can validate, change, create, or delete resources, and check container image signatures and attestations. The Kyverno CLI can test policies in CI against Kubernetes resource manifests before they are applied to a live cluster. Kyverno supports CEL-based policy types and documents workflows involving Helm, YAML manifests, GitHub Actions, and GitOps tools such as ArgoCD. It is installed in a Kubernetes cluster; Helm is recommended for production, and YAML manifests are also available. A standard installation requires an admission controller, while background, reports, and cleanup controllers are optional. Production installations should use high availability mode. The project documents Cosign signatures for container images and manifests, and publishes CLI binaries for Linux, macOS, and Windows. Kyverno is free under the Apache License 2.0 and is designed for platform engineering teams working on security, compliance, automation, and governance.
For and against
For
- Free, open-source software under Apache License 2.0
- Validates, mutates, generates, and deletes resources
- Tests policies against manifests in CI
- Works with Helm, YAML, GitHub Actions, and GitOps tools
Against
- Requires installation in a Kubernetes cluster
- Matching requests can fail if Kyverno is unreachable
- Legacy ClusterPolicy and CleanupPolicy types are deprecated
The verdict
Kyverno combines resource policy enforcement with CI policy testing and image-signature checks. Plan for its required admission controller and fail-closed webhook behavior when designing cluster operations.
Who it suits
Kyverno suits platform engineering teams that want to manage Kubernetes security, compliance, automation, or governance through policy as code. It may also fit teams that want to test policies in CI before applying manifests to a cluster.
Plans and prices
Open-source core
Kubernetes policy engine · self-hosted deployment
Read 15 Oct 2026 · trustradius.com
Kyverno
Open-source project · Apache License 2.0
Read 4 Oct 2026 · github.com
On the record
- API repository
- The CEL-based APIs are maintained in a separate kyverno/api repository to simplify importing Kyverno types into Go projects.cncf.io · read 15 Oct 2026
- Availability
- A standard installation has a required admission controller and optional background, reports, and cleanup controllers; production installations should use high availability mode.kyverno.io · read 4 Oct 2026
- CI integration
- Official documentation provides GitHub Actions workflows for testing policies in continuous integration.kyverno.io · read 15 Oct 2026
- CI testing
- The Kyverno CLI can test policies in CI pipelines against Kubernetes resource manifests before they are applied to a live cluster.kyverno.io · read 4 Oct 2026
- Cleanup
- The current CEL policy model includes DeletingPolicy types for scheduled deletion of matching resources.kyverno.io · read 15 Oct 2026
- CLI
- The Kyverno CLI validates and tests policies against manifests before deployment and runs standalone or as a kubectl plugin.kyverno.io · read 15 Oct 2026
- CLI operating systems
- Release artifacts include CLI binaries for Linux, macOS and Windows architectures.kyverno.io · read 15 Oct 2026
- CNCF graduation
- CNCF announced Kyverno graduation on March 24, 2026 after production adoption, governance review and security assessment.cncf.io · read 15 Oct 2026
- Company headquarters and size
- LinkedIn lists Kyverno as a nonprofit software-development organization headquartered in San Jose, California, with 51–200 employees.linkedin.com · read 15 Oct 2026
- Company origin
- Nirmata created Kyverno in 2019 and donated it to CNCF in 2020.nirmata.com · read 15 Oct 2026
- Deployment
- Kyverno is installed in a Kubernetes cluster, with Helm recommended for production deployments and YAML manifests also available.kyverno.io · read 4 Oct 2026
- Documentation
- The documentation covers installation, policy types, testing, reporting, monitoring, tracing, security, troubleshooting, high availability and CLI usage.release-1-11-0.kyverno.io · read 15 Oct 2026
- Exceptions
- PolicyException resources provide flexible exemptions from selected policies.kyverno.io · read 15 Oct 2026
- Generation
- Generate rules create resources from policy definitions and can continuously synchronize generated resources.kyverno.io · read 15 Oct 2026
- High availability
- Kyverno supports multiple replicas for selected controllers to improve availability and scalability.kyverno.io · read 15 Oct 2026
- Image verification
- ImageValidatingPolicy and legacy verifyImages rules verify container signatures and attestations, including Cosign and Notary authorities.kyverno.io · read 15 Oct 2026
- Installation
- Kyverno supports Helm and YAML installation, with Helm recommended for production customization and upgrades.kyverno.io · read 15 Oct 2026
- Integrations
- CNCF lists common integrations with Argo CD, Backstage, Flux and Kubernetes for GitOps and platform governance.cncf.io · read 15 Oct 2026
