🛡️
Security

Kyverno

Kubernetes policy engine — validate, mutate, and generate resources

🐧 Linux🍎 Mac🪟 Windows
Reviewed: Tested on: Kubernetes 1.29 · Terraform 1.8 · Ubuntu 22.04

What is this?

Kyverno enforces policies on Kubernetes resources — block bad configs before they reach the cluster.

📁

Config files for Kyverno

Where to create or edit the main configuration — paths below match the setup steps.

  • policy.yaml

    Location: Kubernetes cluster — kubectl apply

    Admission policies — validate, mutate, generate

📥

Step 01

Install Kyverno

(01)Install Kyverno

Linux
1kubectl create namespace kyverno
2kubectl apply -f https://github.com/kyverno/kyverno/releases/download/v1.12.0/install.yaml
⚙️

Step 02

Configure Kyverno

(01)Configure Kyverno

Linux
1cat > require-labels.yaml << 'EOF'
2apiVersion: kyverno.io/v1
3kind: ClusterPolicy
4metadata:
5  name: require-app-label
6spec:
7  validationFailureAction: Enforce
8  rules:
9    - name: check-app-label
10      match:
11        any:
12          - resources:
13              kinds: [Pod]
14      validate:
15        message: "label 'app' is required"
16        pattern:
17          metadata:
18            labels:
19              app: "?*"
20EOF
21kubectl apply -f require-labels.yaml
✅

Step 03

Verify

(01)Verify installation

Linux
1kubectl get pods -n kyverno
2kubectl get clusterpolicy
🔧

Step 04

Common Problems

#1Policy not blocking invalid resources

Linux
1kubectl get clusterpolicy
2kubectl describe clusterpolicy require-app-label
3# Test with a pod missing label:
4kubectl run test --image=nginx --dry-run=server -o yaml | kubectl apply -f -

📋Config templates

1 YAML template for Kyverno. Copy and deploy after setup.

1 ready-to-copy template. Expand one, copy the YAML, then run the deploy commands.

deployment.yml

Deployment with resource requests/limits and local image

yaml
1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  labels:
5    app: api-deploy
6  name: api-deploy
7spec:
8  replicas: 1
9  selector:
10    matchLabels:
11      app: api-deploy
12  template:
13    metadata:
14      labels:
15        app: api-deploy
16    spec:
17      containers:
18        - image: api:local
19          name: api
20          imagePullPolicy: IfNotPresent
21          ports:
22            - containerPort: 3000
23          resources:
24            limits:
25              memory: "512Mi"
26              cpu: "500m"
27            requests:
28              memory: "256Mi"
29              cpu: "250m"

services.yml

NodePort Service exposing the API on port 32000

yaml
1apiVersion: v1
2kind: Service
3metadata:
4  labels:
5    app: api-deploy
6  name: api-deploy-service
7spec:
8  type: NodePort
9  selector:
10    app: api-deploy
11  ports:
12    - port: 3000
13      protocol: TCP
14      targetPort: 3000
15      nodePort: 32000
📄

Step 01

Apply to Kubernetes

(01)Build image and load into cluster

Linux
1# Build local image
2docker build -t api:local .
3 
4# For Minikube / Kind — load image into cluster
5minikube image load api:local
6# OR: kind load docker-image api:local

(02)Apply manifests

Linux
1kubectl apply -f deployment.yml
2kubectl apply -f services.yml
3kubectl get pods,svc
4curl http://localhost:32000  # or minikube service api-deploy-service