Kyverno

Kyverno is an open-source policy engine for Kubernetes, best suited to platform teams that want security and governance rules enforced alongside resource automation. Its policy actions and CI testing make a broad workflow possible, but running it in a cluster—and planning for fail-closed admission webhooks—are central operational costs.

Overview

Kyverno expresses policy as code in Kubernetes-style terms and supports CEL-based policy types. The project also aims to bring Kubernetes-style policies beyond Kubernetes, though its deployment is still in a Kubernetes cluster. Its stable policy types cover validation, mutation, resource generation and deletion, plus verification of container image signatures and attestations. That range suits teams that want policy to shape both admission decisions and resource behavior; teams needing only a simple check may find the operational footprint hard to justify.

Kyverno is licensed under Apache License 2.0 and is a CNCF Graduated project, with graduation recorded in March 2026. The project documents a third-party security audit from 2023 and security assessments conducted during its CNCF graduation process. Those are useful project-level signals, not a substitute for deciding whether its deployment and availability requirements suit your clusters.

Key features

Policy enforcement and automation

Validation can enforce guardrails, while mutation, generation and deletion let teams encode resource changes and lifecycle actions. Image signature and attestation verification adds a supply-chain policy use case. Together, these capabilities can consolidate several policy needs in one engine, but they require teams to own the policies and the cluster service that evaluates them.

CI testing and integrations

The Kyverno CLI tests policies against Kubernetes resource manifests in CI before those resources reach a live cluster. That gives teams a way to catch policy problems earlier in a delivery workflow rather than relying solely on live admission. Documentation describes use with Helm, YAML manifests, GitHub Actions and GitOps tools such as ArgoCD, making it relevant to teams already working through those paths.

Availability and operations

A standard installation requires the admission controller; background, reports and cleanup controllers are optional. Helm is recommended for production, although YAML installation is also supported, and production installations should use high-availability mode. Resource webhooks default to fail-closed: if the API server cannot reach Kyverno, matching requests can fail. This behavior favors teams that prioritize enforcing policy over allowing requests through during an outage, but it makes availability planning essential.

Legacy ClusterPolicy and CleanupPolicy types are deprecated in v1.19 and scheduled for removal in v1.20, so existing users should account for migration rather than building new workflows around them. Release artifacts include CLI binaries for Linux, macOS and Windows. Users can turn to the project’s Kubernetes Slack channels, GitHub and mailing list for discussion and questions.

Pricing

Kyverno is free: the Kyverno plan costs nothing and is an open-source project under Apache License 2.0. There is no paid tier in the plan structure described here, so teams can use the policy engine without a software subscription. The trade-off is operational ownership: it is self-hosted in a Kubernetes cluster, with production availability and webhook behavior to manage.

Platforms

Kyverno is self-hosted and runs in Kubernetes. Its listed platform coverage includes API, Linux, macOS and Windows; the latter three align with the CLI release binaries. It is not a hosted service that removes the need to operate a cluster installation.

Who it's for

Kyverno is aimed at platform engineering teams using policy as code for security, compliance, automation and governance. It is a strong fit where teams want Kubernetes-native policy enforcement, pre-deployment manifest testing and multiple policy actions, and can support a highly available installation. It is less suitable for teams that cannot tolerate admission requests failing when Kyverno is unreachable or do not want to operate an in-cluster controller.

Pros and cons

• Broad policy actions: Validation, mutation, generation, deletion and image verification cover more than admission checks alone.
• Test before deployment: The CLI can check policies against manifests in CI before live-cluster application.
• Free and open source: Apache License 2.0 avoids a software subscription.
• Operational dependency: A required admission controller and recommended high availability add cluster-management work.
• Fail-closed webhooks: Matching resource requests can fail if the API server cannot reach Kyverno, making availability part of policy design.
• Legacy policy migration: ClusterPolicy and CleanupPolicy are deprecated in v1.19 and scheduled for removal in v1.20.

Alternatives

Consider these options when their scope or operating model better matches your needs:

• Cloud Custodian is a free, open-source option for teams seeking a policy tool across Linux, macOS, Windows or self-hosted environments rather than a Kubernetes-cluster installation.
• AWS Control Tower is worth considering for teams looking for an AWS service with no additional Control Tower charge; underlying AWS services are billed by usage.
• CGPulse offers a free plan with two cloud accounts, 10 scans per month, one tracked initiative, five auto-fixes per month and watermarked PDF reports; it may fit teams seeking a capped cloud-governance starting point.
• OmniGCloud has a free plan with one connector, a single SaaS workspace, basic CSV export and a basic audit trail for teams preferring that SaaS-oriented setup.
• Kubewarden is another free option with Linux, macOS, Windows and self-hosted platform coverage.
• Powerpipe is an open-source tool from Turbot and may suit teams comparing open-source policy tooling.
• AWS Config uses pay-as-you-go pricing based on usage and may suit teams looking for an AWS configuration service rather than a free Kubernetes-native policy engine.
• CoreStack Cloud Governance offers product, bundle or bundle-plus-assessments choices with custom pricing, for teams seeking a configurable paid governance offering.

For broader browsing, see Cloud Governance Software, Kubernetes Security Software, Container Security Software, Infrastructure as Code Security Software and Infrastructure Policy as Code Tools.

Verdict

Choose Kyverno if your platform team wants Kubernetes-native policy enforcement plus CI testing and can operate a highly available in-cluster service. Its free Apache-licensed model and range of policy actions are compelling; look elsewhere if you need a hosted option or cannot accept matching resource requests failing when Kyverno is unreachable.