Kyverno
Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates resources using policies defined as Kubernetes Custom Resources. It enforces security, compliance, and operational standards without requiring knowledge of a new policy language.
Kyverno applies policies to Kubernetes clusters using standard Kubernetes manifests rather than domain-specific languages. Policies are written as YAML ClusterPolicy or Policy resources that define rules for validating, mutating, or generating cluster resources.
It operates as a dynamic admission controller, intercepting API requests to approve, modify, or reject resource creation and modification. For example, a policy can enforce that all container images must come from a private registry, automatically add resource requests/limits, or require specific labels on deployments.
Kyverno policies can validate configurations against security standards, mutate resources to add defaults or annotations, and generate resources like network policies or RBAC rules. Its advantage is eliminating the need to learn a specialized policy syntax—developers work with familiar Kubernetes YAML.