kyverno/kyverno

Health v2 · maintenance only

Adoption not part of the score

8075 stars · 1555 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Kyverno is a Kubernetes-native policy engine for policy as code, letting platform teams author validate, mutate, generate, and cleanup policies as YAML/CEL Kubernetes resources. It runs as an admission controller in clusters and also works outside Kubernetes via CLI, SDK, and web service for any JSON payload.

Use cases

• enforce security and compliance policies on kubernetes resources
• validate kubernetes manifests in ci pipelines before deployment
• mutate or generate kubernetes resources automatically
• verify container image signatures for supply chain security
• validate terraform plans and dockerfiles with policies
• clean up stale kubernetes resources on a schedule
• write policy as code without learning rego

When to choose

• you want kubernetes-native policies in YAML and CEL with no new language
• you need admission control, background scans, and policy reports in one engine
• you want to shift policy checks left into GitOps/CI pipelines
• you need image verification and policy exceptions at scale

When to avoid

• you are not using Kubernetes or JSON/YAML payloads and need general-purpose policy evaluation
• your team already has deep Rego/Open Policy Agent expertise and OPA meets your needs
• you need a lightweight client-side linter only with no cluster component

Facets

service · maturity stable

security configuration-management cli middleware developer-tools security cloud-computing infrastructure-as-code self-hosted go cli cloud self-hosted policy-as-code admission-controller kubernetes cel compliance governance supply-chain-security cncf mutate validate devops containers docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kyverno/kyverno")