Kyverno & Kyverno Policies

Kyverno is an application to manage security policies in Kubernetes. Security policies appear in Kyverno as Kubernetes resources.
Kyverno supports tools, such as kubectl, git, and kustomize. You can use the Kyverno command-line interface to test policies and validate resources as part of the CI/CD pipeline.

Kyverno-policies is a Kyverno extension.
Kyverno-policies includes an implementation of Kubernetes Pod Security Standards (PSS). When you install the extension, you can select a policy mode: audit (notify only) or enforce (block). The original policies are stored in a separate Kyverno-policies repository.

You can send notifications from Kyverno to other systems using the kyverno-policy-reporter extensions. Kyverno-policy-reporter supports export to Yandex Object Storage (s3).

1. Install kubectl and configure it to work with your cluster.
2. Create a node group for Kyverno.
3. Configure the application:
   • Namespace: Select a namespace or create a new one. Make sure it contains no applications or objects; otherwise, Kyverno will not run properly.
   • Application name: Enter an application name.
   • Kyverno policies activation: Select the kyverno-policies extensions for an automatic install in Kyverno.
   • Pod Security Standard profile: Select the Pod Security Standard profile: baseline, restricted, or privileged. If the field is left blank, it will be set to baseline by default.
   • Validation failure action: Select a response to Kyverno triggering: audit (notify only) or enforce (block). If the field is left blank, it will be set to audit by default.
4. Click Install.

For more information about tracking when Kyverno is triggered, see the instructions.

If you no longer need the application, delete it. Next, clear the application’s webhook configurations, or else the cluster will not run properly.

Application versionsApplication versions

For each Kubernetes version, a certain Kyverno version is supported. The required Kyverno version is installed by default depending on your Kubernetes version.

• Managing the environment independently from workload configurations.
• Scanning the current workload to optimize Kubernetes cluster performance.
• Blocking or modifying API calls to optimize Kubernetes cluster performance.
• Validating, mutating, and generating Kubernetes resources.
• Ensuring the security of the OCI image supply chain.

Yandex Cloud technical support is available 24/7 to respond to requests. Available support modes and response times depend on your support plan. You can enable paid support in the management console. Learn more about requesting technical support.