Kyverno.

Kyverno is a CNCF Kubernetes policy engine that validates, mutates, and generates resources using policies written as native Kubernetes YAML rather than a new DSL. It belongs to the Cloud Security category of cybersecurity.

Kyverno is a CNCF Kubernetes policy engine that validates, mutates, and generates resources using policies written as native Kubernetes YAML rather than a new DSL.

Kyverno installs as an admission webhook and runs ClusterPolicy or Policy CRs expressed in YAML with selector, match, validate, mutate, generate and verifyImages rules. Because the policy language matches Kubernetes object structure, teams familiar with manifests can author rules without learning Rego. Kyverno also handles image verification (Cosign/Notation), background scans of existing resources, exception workflows, and generation of dependent objects (NetworkPolicy, RoleBinding) when new namespaces appear. It is commonly used to enforce Pod Security Standards, image-signing, label conventions, and supply-chain attestations, and competes with OPA Gatekeeper for the same admission-policy space.

Defences for Kyverno typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Kyverno Policy, ClusterPolicy.