Kyverno

Apache-2.0 CNCF Kubernetes policy engine — policies as YAML, not Rego

DevOps / Security · Apache-2.0 · 8.3k

Reviewed 2026-10-09 · last push 2026-10-19 · repo checked 2026-10-19

What's Good

Apache-2.0, CNCF project (kyverno/kyverno), v1.19.1. Runs as an admission controller plus background scans and policy reports; CLI for testing policies in CI; large community policy library. Image verification pairs with Sigstore signing — the cosign gem already names Kyverno as its admission-control partner. ★~8.2k.

The Catch

Enforces at admission time, so a bad policy (or an unavailable webhook with fail-closed settings) can block deploys cluster-wide — roll out in audit mode first. YAML policies get awkward for complex logic; Rego-based engines express that more cleanly. Vs kubescape (posture and compliance scanning) and topaz (application authorization): Kyverno is the in-cluster admission policy lane.

Verdict

Apache-2.0 Kubernetes admission policy engine when policies should be plain YAML — start in audit mode; reach for Rego when logic gets complex.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/kyverno.svg)](https://stackgems.com/gems/kyverno)

HTML

<a href="https://stackgems.com/gems/kyverno"><img src="https://stackgems.com/badge/kyverno.svg" alt="Kyverno reviewed on Stack Gems" height="20"></a>

DevOps →

Related