Kyverno
Kubernetes-native policy engine using YAML-based policies without learning Rego.
Kyverno is a CNCF graduated Kubernetes-native policy engine that validates, mutates, and generates resources using YAML-based policies (no Rego required). Features: validate/mutate/generate/verify image policies, background scanning, policy reports, and audit/enforce modes. Easier to learn than OPA for teams already comfortable with Kubernetes YAML.
- Best for: Policy & Governance
- Pricing: Free and open-source (Apache 2.0)
Disclosure: We may earn a commission if you click this link and make a purchase, at no additional cost to you.
Visit KyvernoKyverno Hub
Explore Kyverno
Compare Kyverno With
Features
Audit Mode
Report violations without blocking
Audit mode for reporting
CI/CD Integration
Policy checks in pipelines
CI/CD via Kyverno CLI
Cost Estimation
Estimate cloud costs before deployment
Not a cost estimation tool
Custom Policies
Write organization-specific policies
Validate, mutate, generate, and verify image policies
Enforce Mode
Block non-compliant resources
Enforce mode for blocking
Infrastructure Policy
Enforce policies on Terraform/CloudFormation
Kubernetes-only, no Terraform integration
Kubernetes Admission Control
Validate/mutate resources at API server admission
Core feature: K8s admission controller
Policy Reporting
Dashboard and reports on compliance
PolicyReport CRD for compliance reporting
Policy as Code
Define policies in version-controlled code
YAML-based policies (no Rego needed)
Regulatory Compliance
Pre-built policies for SOC2, HIPAA, PCI-DSS
Pre-built policies for Pod Security Standards
Best For
Find the right DevOps tools for your specific needs. Kyverno is featured in these buying guides: