# Kyverno

> Apache-2.0 CNCF Kubernetes policy engine — policies as YAML, not Rego

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://kyverno.io  
**GitHub:** https://github.com/kyverno/kyverno  
**Added:** 2026-10-09

---

## The Hook

Kyverno is a Kubernetes-native policy engine: validate, mutate, generate, and clean up resources, and verify image signatures, with policies written as Kubernetes YAML instead of a separate policy language.

## What's Good

Apache-2.0, CNCF project (kyverno/kyverno), v1.19.1. Runs as an admission controller plus background scans and policy reports; CLI for testing policies in CI; large community policy library. Image verification pairs with Sigstore signing — the cosign gem already names Kyverno as its admission-control partner. ★~8.2k.

## The Catch

Enforces at admission time, so a bad policy (or an unavailable webhook with fail-closed settings) can block deploys cluster-wide — roll out in audit mode first. YAML policies get awkward for complex logic; Rego-based engines express that more cleanly. Vs kubescape (posture and compliance scanning) and topaz (application authorization): Kyverno is the in-cluster admission policy lane.

## Verdict

Apache-2.0 Kubernetes admission policy engine when policies should be plain YAML — start in audit mode; reach for Rego when logic gets complex.