Overview

Kyverno applies policy as code using Kubernetes-style policies, with support for CEL-based policy types and an ambition to extend that approach beyond Kubernetes. Its stable policy types cover validation, mutation, generation, deletion, and verification of container image signatures and attestations. That breadth suits teams combining admission guardrails with resource automation; it is more than a focused validation tool requires.

The project is open source under the Apache License 2.0 and is a CNCF Graduated project, with graduation recorded in March 2026. It documents a 2023 third-party security audit and security assessments conducted during its CNCF graduation process. These are useful project-level security signals, not a substitute for planning how Kyverno will operate in a particular cluster.

Key features

Policy enforcement and automation

Validation can enforce rules on resources, while mutation, generation, and deletion allow policy to shape resource handling beyond accepting or rejecting requests. Signature and attestation checks extend policy to container-image trust. Teams that want one Kubernetes-native policy system spanning these tasks have a strong case for Kyverno; those needing only a narrow admission check may not need its full scope.

Testing and workflow integration

The Kyverno CLI tests policies in CI against Kubernetes resource manifests before they are applied to a live cluster. That gives teams a way to catch policy problems before admission affects workloads. Documentation also covers Helm, YAML manifests, GitHub Actions, and GitOps tools such as ArgoCD, fitting teams that manage cluster configuration through established deployment pipelines.

Pricing

Kyverno costs 0.00 USD per free. The free plan is the open-source project under the Apache License 2.0, so teams can adopt the policy engine without a paid tier. No seat or usage cap is stated in the plan terms. Support is directed through Kubernetes Slack channels, GitHub, and a mailing list, rather than a paid support plan described here.

Platforms

Kyverno is self-hosted and installed inside a Kubernetes cluster; Helm is recommended for production, with YAML manifests also available. A standard installation requires the admission controller, while background, reports, and cleanup controllers are optional. Production installations should use high availability mode. CLI binaries are available for Linux, macOS, and Windows. The platform labels also include API, but the defining deployment requirement is a Kubernetes cluster.

Resource webhooks default to fail-closed. If the API server cannot reach Kyverno, matching resource requests can fail, making availability and recovery planning essential for teams applying policies to critical cluster workflows.

Who it's for

Kyverno is best suited to platform engineering teams responsible for security, compliance, automation, or governance in Kubernetes environments. It is a good fit when policy needs to be tested in CI and then enforced at admission, and when operators can own a highly available cluster installation. It is a weaker fit for teams without Kubernetes operational capacity or those unwilling to accept request failures when the policy service is unreachable.

Teams adopting current policy types should also account for migration: legacy ClusterPolicy and CleanupPolicy types are deprecated in v1.19 and scheduled for removal in v1.20. New work should avoid relying on those legacy types.

Pros and cons

Pros: One stable policy system covers validation, resource changes, deletion, and image signature or attestation checks, supporting broader governance workflows.
Pros: CLI policy testing against manifests in CI helps surface issues before resources reach a live cluster.
Pros: Open-source Apache 2.0 licensing and documented project security assessments make adoption and project review more transparent.
Cons: The required admission controller and recommendation for production high availability add cluster-operational responsibility.
Cons: Default fail-closed webhooks can block matching requests during Kyverno connectivity failures.
Cons: Deprecated legacy policy types create migration work for installations still using them.

Alternatives

For another free, self-hosted option, consider Kubewarden; its stated platforms include Linux, macOS, Windows, and self-hosted deployment.

Powerpipe is another free, open-source option, with Linux, macOS, Windows, web, and self-hosted platforms. Consider it when those platform choices better match your environment.

CGPulse suits readers looking for a freemium cloud-governance product with web and API platforms; its free plan includes 2 cloud accounts, 10 scans per month, 1 tracked initiative, 5 auto-fixes per month, and watermarked PDF reports. OmniGCloud is another freemium option, with API, web, and self-hosted platforms; its free plan includes one connector, a single SaaS workspace, basic CSV export, and a basic audit trail.

CloudBolt may suit teams seeking a free cloud management platform: its free plan offers core CMP capabilities for up to 100 resources. Cloud Custodian is a free Apache 2.0 option for readers comparing open-source tools across Linux, macOS, Windows, and self-hosted platforms. For teams working specifically with AWS, AWS Control Tower has no additional charge for Control Tower itself, though underlying AWS services incur usage charges.

emma Governance offers custom pricing for organizations seeking a tailored governance product. The Cloud Governance Software, Kubernetes Security Software, Container Security Software, Infrastructure Policy as Code Tools, and Infrastructure as Code Security Software lists provide broader category comparisons.

Verdict

Choose Kyverno if your platform team needs Kubernetes-native policy enforcement, automation, and CI testing in one open-source tool. Its breadth is the main reason to adopt it; the need to operate a highly available admission service, plus fail-closed behavior and legacy-policy migration, are the strongest reasons to look elsewhere.

	AWS Config	Kyverno
Free plan	No	Yes
Free trial	No	No
Paid from	—	Free
Open source	No	No
Platforms	api, Web	api, Linux, macOS, self-hosted, Windows
Cloud coverage	single-cloud	—
Policy as code	Yes	—
Compliance frameworks	Yes	—
Drift detection	Yes	—
Automated remediation	Yes	—

AWS Config vs Kyverno

AWS Config

Kyverno