Back to Policy & Governance

Kyverno

Kubernetes-native policy engine using YAML-based policies without learning Rego.

Free and open-source (Apache 2.0)

Kyverno is a CNCF graduated Kubernetes-native policy engine that validates, mutates, and generates resources using YAML-based policies (no Rego required). Features: validate/mutate/generate/verify image policies, background scanning, policy reports, and audit/enforce modes. Easier to learn than OPA for teams already comfortable with Kubernetes YAML.

  • Best for: Policy & Governance
  • Pricing: Free and open-source (Apache 2.0)

Disclosure: We may earn a commission if you click this link and make a purchase, at no additional cost to you.

Visit Kyverno

Kyverno Hub

Explore Kyverno

Features

Audit Mode

Report violations without blocking

Audit mode for reporting

CI/CD Integration

Policy checks in pipelines

CI/CD via Kyverno CLI

Cost Estimation

Estimate cloud costs before deployment

Not a cost estimation tool

Custom Policies

Write organization-specific policies

Validate, mutate, generate, and verify image policies

Enforce Mode

Block non-compliant resources

Enforce mode for blocking

Infrastructure Policy

Enforce policies on Terraform/CloudFormation

Kubernetes-only, no Terraform integration

Kubernetes Admission Control

Validate/mutate resources at API server admission

Core feature: K8s admission controller

Policy Reporting

Dashboard and reports on compliance

PolicyReport CRD for compliance reporting

Policy as Code

Define policies in version-controlled code

YAML-based policies (no Rego needed)

Regulatory Compliance

Pre-built policies for SOC2, HIPAA, PCI-DSS

Pre-built policies for Pod Security Standards

Best For

Find the right DevOps tools for your specific needs. Kyverno is featured in these buying guides:

Related Links