# kyverno/kyverno

Unified Policy as Code

Repository: https://github.com/kyverno/kyverno
Canonical: https://ross.abutalabs.com/products/kyverno
Homepage: https://kyverno.io
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kubernetes, compliance, governance, policy-as-code, security
Last push: 2026-08-26T16:14:22+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 2767, "days_push": 7, "days_rel": 13, "gap_med": 17.5, "n_releases_24m": 31}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8075, forks 1555 (observed 2026-08-28T04:10:12.480372+00:00)

## What it is
Kyverno is a Kubernetes-native policy engine for policy as code, letting platform teams author validate, mutate, generate, and cleanup policies as YAML/CEL Kubernetes resources. It runs as an admission controller in clusters and also works outside Kubernetes via CLI, SDK, and web service for any JSON payload.

## Use cases
- enforce security and compliance policies on kubernetes resources
- validate kubernetes manifests in ci pipelines before deployment
- mutate or generate kubernetes resources automatically
- verify container image signatures for supply chain security
- validate terraform plans and dockerfiles with policies
- clean up stale kubernetes resources on a schedule
- write policy as code without learning rego

## When to choose
- you want kubernetes-native policies in YAML and CEL with no new language
- you need admission control, background scans, and policy reports in one engine
- you want to shift policy checks left into GitOps/CI pipelines
- you need image verification and policy exceptions at scale

## When to avoid
- you are not using Kubernetes or JSON/YAML payloads and need general-purpose policy evaluation
- your team already has deep Rego/Open Policy Agent expertise and OPA meets your needs
- you need a lightweight client-side linter only with no cluster component

## Facets
- artifact type: service
- maturity: stable
- function: security, configuration-management, cli, middleware, developer-tools
- domain: security, cloud-computing, infrastructure-as-code, self-hosted
- platform: go, cli, cloud, self-hosted
- tags: policy-as-code, admission-controller, kubernetes, cel, compliance, governance, supply-chain-security, cncf, mutate, validate, devops, containers, docker

## Member repositories
- kyverno/kyverno (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:12.480372+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:31:20.795509+00:00, confidence not recorded.
  - readme: https://github.com/kyverno/kyverno (fetched 2026-08-28T04:10:12.480372+00:00, sha 8ed5591eb934)
  - homepage: https://kyverno.io (fetched 2026-08-29T08:29:00.216795+00:00, sha 8a6cfcdf4ec6)
  - site_page: https://kyverno.io/docs/introduction (fetched 2026-08-29T08:29:00.225913+00:00, sha 2aee5acf70ca)
  - site_page: https://kyverno.io/docs/policy-types/validating-policy (fetched 2026-08-29T08:29:00.227556+00:00, sha 8a848dfa8e3c)
  - site_page: https://kyverno.io/docs/applying-policies (fetched 2026-08-29T08:29:00.229318+00:00, sha 0cff124ea840)
  - site_page: https://kyverno.io/docs/guides/evaluating-policy-engines (fetched 2026-08-29T08:29:00.231933+00:00, sha c76463944f09)
  - site_page: https://kyverno.io/docs/crds (fetched 2026-08-29T08:29:00.234703+00:00, sha b638301b3096)
- Data as of 2026-08-30T08:39:29.467469+00:00.