Kyverno Policies

Jan 1, 0001

Definition

Kyverno is a Kubernetes-native policy engine designed to manage and enforce security and operational policies for Kubernetes resources. It allows users to define policies as Kubernetes resources, enabling automated validation, mutation, and generation of configurations. Kyverno policies help ensure compliance with security standards and operational best practices by automatically applying rules to Kubernetes resources at runtime.

Secure Settings Example

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  rules:
  - name: only-allow-trusted-registries
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Images must be pulled from trusted registries."
      pattern:
        spec:
          containers:
          - image: "trusted-registry.com/*"

Insecure Settings Example

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: allow-any-image
spec:
  rules:
  - name: allow-all-registries
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Allow any image registry."
      pattern:
        spec:
          containers:
          - image: "*"