KubeArmor vs Kyverno
KubeArmor
kubearmor.ioKyverno
kyverno.ioSide by side
| Figure | KubeArmor | Kyverno |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Kubernetes Security Software | 8.6 (#3) | 8.6 (#4) |
| Spec score · Container Security Software | 8.6 (#4) | 8.7 (#3) |
| Deployment | The support matrix documents Kubernetes, non-Kubernetes container, virtual-machine, and bare-metal workload deployments. | Kyverno is installed in a Kubernetes cluster, with Helm recommended for production deployments and YAML manifests also available. |
| Founded | 2020 | 2019 |
| Installation | The getting-started guide installs KubeArmor on a Kubernetes cluster using Helm and kubectl. | Kyverno supports Helm and YAML installation, with Helm recommended for production customization and upgrades. |
| Integrations | Project repositories include OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, a GitHub Action, and a Rancher UI extension. | CNCF lists common integrations with Argo CD, Backstage, Flux and Kubernetes for GitOps and platform governance. |
| Policy actions | Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring supports audit only. | Its stable policy types can validate, mutate, generate, and delete resources, and verify container image signatures and attestations. |
| Project status | KubeArmor is a community-governed open-source project and a CNCF Sandbox project. | The CNCF lists Kyverno as a Graduated project, with graduation recorded in March 2026. |
| Purpose | KubeArmor is an open-source, cloud-native runtime security system that hardens workloads and enforces security policies. | Kyverno is a Kubernetes-native policy engine for defining and enforcing policy as code. |
| Support | Project-level questions can be directed to the maintainer group by email, CNCF Slack, GitHub Discussions, or GitHub Issues. | The project directs users to its Kubernetes Slack channels, GitHub, and mailing list for questions and discussion. |
| What it does | KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking operations for pods, containers, and nodes. | Kyverno is a cloud-native policy engine for automating Kubernetes security, compliance, governance and best-practice checks. |
Plans
In their own words
KubeArmor
KubeArmor is an open-source runtime security system for enforcing policies on cloud-native workloads. It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM, with eBPF for alerts, telemetry, and container-process tracking. Policies can restrict process execution, file access, networking operations, and resource use. Container policies support Allow, Audit, and Block actions, with Block as the default; system-call monitoring is audit-only. Kubernetes policies can target pods through labels and label expressions, and rules can match paths, network protocols, capabilities, and system calls. The deployment matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts. It lists Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, and DigitalOcean Kubernetes, but support varies by operating system, architecture, and enforcement mode. Some environments are observability-only, and VMware Tanzu entries are under construction. KubeArmor is a community-governed CNCF Sandbox project. The free plan is free; installation guidance uses Helm and kubectl.
Kyverno
Kyverno is a free, open-source policy engine for defining and enforcing policy as code in Kubernetes. Its stable policy types can validate, mutate, generate or delete resources, and verify container image signatures and attestations. The Kyverno CLI can test policies against Kubernetes resource manifests in CI before they are applied to a live cluster. Documentation describes use with Helm, YAML manifests, GitHub Actions and GitOps tools such as ArgoCD. Kyverno is installed in a Kubernetes cluster; Helm is recommended for production, and YAML manifests are also available. A standard installation requires an admission controller, while background, reports and cleanup controllers are optional. Production installations should use high availability mode. The project supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission. Its webhooks default to fail-closed, so matching requests can fail if the API server cannot reach Kyverno. The project documents Cosign signatures for images and manifests, and lists CLI binaries for Linux, macOS and Windows.