Skip to content
SPECIFICTION
Get listed

Kyverno

kyverno.io

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit kyverno.io
Spec score 8.7 #3 of 26 in Container Security Software

What it is

Kyverno is a free, open-source policy engine for defining and enforcing policy as code in Kubernetes. Its stable policy types can validate, mutate, generate or delete resources, and verify container image signatures and attestations. The Kyverno CLI can test policies against Kubernetes resource manifests in CI before they are applied to a live cluster. Documentation describes use with Helm, YAML manifests, GitHub Actions and GitOps tools such as ArgoCD. Kyverno is installed in a Kubernetes cluster; Helm is recommended for production, and YAML manifests are also available. A standard installation requires an admission controller, while background, reports and cleanup controllers are optional. Production installations should use high availability mode. The project supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission. Its webhooks default to fail-closed, so matching requests can fail if the API server cannot reach Kyverno. The project documents Cosign signatures for images and manifests, and lists CLI binaries for Linux, macOS and Windows.

Spec sheet

What it does
Kyverno is a cloud-native policy engine for automating Kubernetes security, compliance, governance and best-practice checks.Read 15 Oct 2026 · kyverno.io
Purpose
Kyverno is a Kubernetes-native policy engine for defining and enforcing policy as code.Read 4 Oct 2026 · github.com
Intended users
The project describes Kyverno as designed for platform engineering teams and enabling security, compliance, automation, and governance through policy as code.Read 4 Oct 2026 · github.com
Deployment
Kyverno is installed in a Kubernetes cluster, with Helm recommended for production deployments and YAML manifests also available.Read 4 Oct 2026 · kyverno.io
Integrations
CNCF lists common integrations with Argo CD, Backstage, Flux and Kubernetes for GitOps and platform governance.Read 15 Oct 2026 · cncf.io
Security
Kyverno’s documentation describes Cosign signatures for container images and manifests and lists release artifacts including CLI binaries for Linux, macOS, and Windows.Read 4 Oct 2026 · kyverno.io
Support
The project directs users to its Kubernetes Slack channels, GitHub, and mailing list for questions and discussion.Read 4 Oct 2026 · kyverno.io
Founded
2019Read 28 Sep 2026 · kyverno.io
API repository
The CEL-based APIs are maintained in a separate kyverno/api repository to simplify importing Kyverno types into Go projects.Read 15 Oct 2026 · cncf.io
Availability
A standard installation has a required admission controller and optional background, reports, and cleanup controllers; production installations should use high availability mode.Read 4 Oct 2026 · kyverno.io
CI integration
Official documentation provides GitHub Actions workflows for testing policies in continuous integration.Read 15 Oct 2026 · kyverno.io
CI testing
The Kyverno CLI can test policies in CI pipelines against Kubernetes resource manifests before they are applied to a live cluster.Read 4 Oct 2026 · kyverno.io
Cleanup
The current CEL policy model includes DeletingPolicy types for scheduled deletion of matching resources.Read 15 Oct 2026 · kyverno.io
CLI
The Kyverno CLI validates and tests policies against manifests before deployment and runs standalone or as a kubectl plugin.Read 15 Oct 2026 · kyverno.io
CLI operating systems
Release artifacts include CLI binaries for Linux, macOS and Windows architectures.Read 15 Oct 2026 · kyverno.io
CNCF graduation
CNCF announced Kyverno graduation on March 24, 2026 after production adoption, governance review and security assessment.Read 15 Oct 2026 · cncf.io
Company headquarters and size
LinkedIn lists Kyverno as a nonprofit software-development organization headquartered in San Jose, California, with 51–200 employees.Read 15 Oct 2026 · linkedin.com
Company origin
Nirmata created Kyverno in 2019 and donated it to CNCF in 2020.Read 15 Oct 2026 · nirmata.com
Documentation
The documentation covers installation, policy types, testing, reporting, monitoring, tracing, security, troubleshooting, high availability and CLI usage.Read 15 Oct 2026 · release-1-11-0.kyverno.io
Exceptions
PolicyException resources provide flexible exemptions from selected policies.Read 15 Oct 2026 · kyverno.io
Generation
Generate rules create resources from policy definitions and can continuously synchronize generated resources.Read 15 Oct 2026 · kyverno.io
High availability
Kyverno supports multiple replicas for selected controllers to improve availability and scalability.Read 15 Oct 2026 · kyverno.io
Image verification
ImageValidatingPolicy and legacy verifyImages rules verify container signatures and attestations, including Cosign and Notary authorities.Read 15 Oct 2026 · kyverno.io
Installation
Kyverno supports Helm and YAML installation, with Helm recommended for production customization and upgrades.Read 15 Oct 2026 · kyverno.io
Legacy policy limit
The documentation marks legacy ClusterPolicy and CleanupPolicy types deprecated in v1.19 and says they are scheduled for removal in v1.20.Read 4 Oct 2026 · kyverno.io
Licence
The project is open source under the Apache License 2.0.Read 15 Oct 2026 · github.com
Limit: admission availability
An independent architecture review warns that a slow or unavailable Kyverno webhook can block pod creation because it sits in the admission path.Read 15 Oct 2026 · refplat.org
Limit: complex logic expressiveness
The same review says YAML policies can be less expressive than Rego for complex cross-resource validation and aggregation queries.Read 15 Oct 2026 · refplat.org
Limit: no local REPL equivalent
The review reports no local REPL equivalent to opa eval, although Kyverno CLI provides policy tests.Read 15 Oct 2026 · refplat.org
Limit: webhook timeout risk
The review notes that policies exceeding the default ten-second webhook timeout can cause admission failures.Read 15 Oct 2026 · refplat.org
Mutation
Mutation rules modify matching resources using strategic-merge patches or RFC 6902 JSON patches.Read 15 Oct 2026 · main.kyverno.io
Non-Kubernetes payloads
Kyverno documentation says policies can target JSON payloads such as Terraform, cloud resources and service authorization data.Read 15 Oct 2026 · kyverno.io
Notable release
Kyverno 1.18, announced May 5, 2026, added HTTP policy-execution safeguards, CVE mitigations, CLI support for more policy types and performance improvements.Read 15 Oct 2026 · cncf.io
Operational consideration
Kyverno’s resource webhooks default to fail-closed, so matching resource requests can fail when the API server cannot reach Kyverno.Read 4 Oct 2026 · kyverno.io
Policy actions
Its stable policy types can validate, mutate, generate, and delete resources, and verify container image signatures and attestations.Read 4 Oct 2026 · kyverno.io
Policy authoring
Policies can be written in YAML and Common Expression Language without learning a separate Kyverno language.Read 15 Oct 2026 · kyverno.io
Policy language
Kyverno supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission.Read 4 Oct 2026 · kyverno.io
Policy reports
Kyverno generates Kubernetes PolicyReport resources containing current pass and fail results for matching resources.Read 15 Oct 2026 · main.kyverno.io
Praise: familiar policy format
Baeldung praises Kubernetes-resource policies because users do not need to learn a new policy language.Read 15 Oct 2026 · baeldung.com
Praise: Kubernetes-native simplicity
Plural describes Kyverno as a simpler YAML-based choice when policy scope is focused on Kubernetes cluster governance.Read 15 Oct 2026 · plural.sh
Praise: readable Kubernetes integration
CloudSec Burrito highlights direct Kubernetes-resource integration, YAML policies and validation, mutation, generation and image verification.Read 15 Oct 2026 · cloudsecburrito.com
Project status
The CNCF lists Kyverno as a Graduated project, with graduation recorded in March 2026.Read 4 Oct 2026 · cncf.io
Rating on TrustRadius
No overall score because there are not enough ratings, from 1 reviewRead 15 Oct 2026 · trustradius.com
SBOM
Each Kyverno release publishes a CycloneDX software bill of materials.Read 15 Oct 2026 · kyverno.io
SDK
Kyverno maintains a dedicated SDK repository for developers building controllers and tools that interact with Kyverno.Read 15 Oct 2026 · cncf.io
Security audit
The 2023 Ada Logics audit identified ten security issues including six CVEs, fixed in Kyverno 1.10.6 and 1.11.1, and found no policy-bypass situations.Read 15 Oct 2026 · kyverno.io
Security review
The project documents a 2023 third-party security audit and security assessments conducted as part of its CNCF graduation process.Read 4 Oct 2026 · kyverno.io
Security signing
Kyverno container images, manifests and Helm charts are signed with Cosign keyless signatures.Read 15 Oct 2026 · kyverno.io
Self-hosting
Kyverno runs as admission and background controllers inside a Kubernetes cluster that the operator manages.Read 15 Oct 2026 · kyverno.io
Support channels
Official support routes include GitHub issues, GitHub discussions, Slack and community meetings.Read 15 Oct 2026 · github.com
Validation
Validation rules can block noncompliant resources in Enforce mode or record violations in Audit mode.Read 15 Oct 2026 · kyverno.io

Plans and prices

Kyverno Free Open-source project · Apache License 2.0 Read 4 Oct 2026 · github.com
Open-source core Free No paid tier shown Kubernetes policy engine · self-hosted deployment Read 15 Oct 2026 · trustradius.com

Every Kyverno plan and price →

Strong points and limits

Strong points

  • Validates, mutates, generates and deletes resources
  • Verifies image signatures and attestations
  • CLI tests policies against manifests in CI
  • Works with Helm, YAML, GitHub Actions and ArgoCD
  • Free open-source project under Apache License 2.0

Limits

  • Must be installed in a Kubernetes cluster
  • Production installations should use high availability mode
  • Fail-closed webhooks can block matching requests
  • Legacy ClusterPolicy and CleanupPolicy types are deprecated

Who it suits

Kyverno is designed for platform engineering teams using policy as code for security, compliance, automation and governance. It suits teams deploying and managing Kubernetes clusters.

Kyverno in depth

Read the full write-up

Kyverno is a Kubernetes-native policy engine for platform teams that need to encode rules for cluster resources. Its policy actions and CI testing make it a capable choice for governance and security workflows, but its cluster deployment and fail-closed admission behavior require operational ownership.

Overview

Kyverno applies policy as code using Kubernetes-style policies, with support for CEL-based policy types and an ambition to extend that approach beyond Kubernetes. Its stable policy types cover validation, mutation, generation, deletion, and verification of container image signatures and attestations. That breadth suits teams combining admission guardrails with resource automation; it is more than a focused validation tool requires.

The project is open source under the Apache License 2.0 and is a CNCF Graduated project, with graduation recorded in March 2026. It documents a 2023 third-party security audit and security assessments conducted during its CNCF graduation process. These are useful project-level security signals, not a substitute for planning how Kyverno will operate in a particular cluster.

Key features

Policy enforcement and automation

Validation can enforce rules on resources, while mutation, generation, and deletion allow policy to shape resource handling beyond accepting or rejecting requests. Signature and attestation checks extend policy to container-image trust. Teams that want one Kubernetes-native policy system spanning these tasks have a strong case for Kyverno; those needing only a narrow admission check may not need its full scope.

Testing and workflow integration

The Kyverno CLI tests policies in CI against Kubernetes resource manifests before they are applied to a live cluster. That gives teams a way to catch policy problems before admission affects workloads. Documentation also covers Helm, YAML manifests, GitHub Actions, and GitOps tools such as ArgoCD, fitting teams that manage cluster configuration through established deployment pipelines.

Pricing

Kyverno costs nothing. The free plan is the open-source project under the Apache License 2.0, so teams can adopt the policy engine without a paid tier. No seat or usage cap is stated in the plan terms. Support is directed through Kubernetes Slack channels, GitHub, and a mailing list, rather than a paid support plan described here.

Platforms

Kyverno is self-hosted and installed inside a Kubernetes cluster; Helm is recommended for production, with YAML manifests also available. A standard installation requires the admission controller, while background, reports, and cleanup controllers are optional. Production installations should use high availability mode. CLI binaries are available for Linux, macOS, and Windows. The platform labels also include API, but the defining deployment requirement is a Kubernetes cluster.

Resource webhooks default to fail-closed. If the API server cannot reach Kyverno, matching resource requests can fail, making availability and recovery planning essential for teams applying policies to critical cluster workflows.

Who it's for

Kyverno is best suited to platform engineering teams responsible for security, compliance, automation, or governance in Kubernetes environments. It is a good fit when policy needs to be tested in CI and then enforced at admission, and when operators can own a highly available cluster installation. It is a weaker fit for teams without Kubernetes operational capacity or those unwilling to accept request failures when the policy service is unreachable.

Teams adopting current policy types should also account for migration: legacy ClusterPolicy and CleanupPolicy types are deprecated in v1.19 and scheduled for removal in v1.20. New work should avoid relying on those legacy types.

Pros and cons

Pros: One stable policy system covers validation, resource changes, deletion, and image signature or attestation checks, supporting broader governance workflows.

Pros: CLI policy testing against manifests in CI helps surface issues before resources reach a live cluster.

Pros: Open-source Apache 2.0 licensing and documented project security assessments make adoption and project review more transparent.

Cons: The required admission controller and recommendation for production high availability add cluster-operational responsibility.

Cons: Default fail-closed webhooks can block matching requests during Kyverno connectivity failures.

Cons: Deprecated legacy policy types create migration work for installations still using them.

Alternatives

For another free, self-hosted option, consider Kubewarden; its stated platforms include Linux, macOS, Windows, and self-hosted deployment.

Powerpipe is another free, open-source option, with Linux, macOS, Windows, web, and self-hosted platforms. Consider it when those platform choices better match your environment.

CGPulse suits readers looking for a freemium cloud-governance product with web and API platforms; its free plan includes 2 cloud accounts, 10 scans per month, 1 tracked initiative, 5 auto-fixes per month, and watermarked PDF reports. OmniGCloud is another freemium option, with API, web, and self-hosted platforms; its free plan includes one connector, a single SaaS workspace, basic CSV export, and a basic audit trail.

CloudBolt may suit teams seeking a free cloud management platform: its free plan offers core CMP capabilities for up to 100 resources. Cloud Custodian is a free Apache 2.0 option for readers comparing open-source tools across Linux, macOS, Windows, and self-hosted platforms. For teams working specifically with AWS, AWS Control Tower has no additional charge for Control Tower itself, though underlying AWS services incur usage charges.

emma Governance offers custom pricing for organizations seeking a tailored governance product. The Cloud Governance Software, Kubernetes Security Software, Container Security Software, Infrastructure Policy as Code Tools, and Infrastructure as Code Security Software lists provide broader category comparisons.

Verdict

Choose Kyverno if your platform team needs Kubernetes-native policy enforcement, automation, and CI testing in one open-source tool. Its breadth is the main reason to adopt it; the need to operate a highly available admission service, plus fail-closed behavior and legacy-policy migration, are the strongest reasons to look elsewhere.

Verdict

Kyverno provides policy enforcement and CI testing for Kubernetes, with deployment and controller requirements to plan for. Review its fail-closed behavior and deprecated policy types before adopting it.

Where Specifiction places it

Alternatives to KyvernoAll alternatives →