Kubernetes-native policy management and security engine

Component Information

Property	Value
Chart Version	3.5.2
Chart Type	application
Upstream Project	kyverno
Maintainers	Platform Engineering Team (repo)

Why Kyverno?

Kyverno uses Kubernetes-native resources (policies are CRDs, like any other manifest) and doesn’t require learning a specialized language like Rego. Policies are written in YAML, which means the learning curve is lower if you already understand Kubernetes manifests.

Beyond validation, Kyverno supports:

• Validation: Accept or reject resources based on rules
• Mutation: Modify resources on admission (e.g., inject labels, add sidecars)
• Generation: Create new resources when a trigger resource is created (e.g., generate NetworkPolicy for every new namespace)
• Image Verification: Validate container image signatures using Sigstore/Cosign

The platform currently uses Kyverno primarily for validation. The mutation and generation capabilities are available for future use as governance requirements evolve. Kyverno also integrates with FinOps tools like Kubecost.

Architecture Role

Kyverno operates at Layer 2 of the platform, the Automation & Governance layer. It sits in the admission control path, evaluating every resource before it’s persisted to etcd.

Key integration points:

• Kubernetes API: Kyverno registers as a validating and mutating webhook
• ArgoCD: Policies evaluate resources that ArgoCD deploys
• PolicyReport CRDs: Kyverno generates reports that Policy Reporter consumes
• Prometheus: Exposes metrics on policy evaluations, violations, and webhook performance

Most policies currently run in audit mode, meaning violations are reported but don’t block deployments. This follows the “paved road” philosophy: guide users toward best practices without creating friction. The exception is enforce-namespace-labels, which runs in enforce mode to guarantee that all namespaces have the metadata required for cost attribution and governance.

See Security & Policy Model for the platform’s governance architecture.

Configuration Values