Side by side
Cloud Custodian vs Kyverno
Both stand on cloud governance software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacSelf-hosted+1
Cloud Custodian offers policy-driven resource management across three major cloud providers, with preview and reporting options. Note the beta and alpha status of some integrations and the AWS constraint on event-triggered runs.
Visit Cloud Custodian Free plan Open source APILinuxMac+3
Kyverno combines in-cluster policy enforcement with CLI testing and several policy actions. Teams should account for its required admission controller, production availability guidance, and fail-closed webhook behavior.
Visit KyvernoThe facts
| Cloud Custodian | Kyverno | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Self-hosted, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 2 |
| Maker | Not published | Not published |
| Website | cloudcustodian.io | kyverno.io |
| On cloud governance software | #3 of 26 | #1 of 26 |
Cloud Custodian: what it does well
- Free and open source under Apache 2.0.
- Dry-run previews show matching resources before actions.
- Supports security, compliance, tagging, cleanup, and cost policies.
- Policies can run on events or cron schedules.
What to know first
- Kubernetes, Tencent Cloud, and OpenStack support is beta.
- Terraform integration is in alpha.
- AWS event-triggered policies are limited to the same region and account.
Kyverno: what it does well
- Validates, mutates, generates, and deletes resources
- Verifies container image signatures and attestations
- CLI tests policies against manifests in CI
- Works with Helm, GitHub Actions, and GitOps tools
- Free and open source
What to know first
- Requires installation in a Kubernetes cluster
- Production deployments should use high availability mode
- Fail-closed webhooks can block matching requests if unreachable
- Legacy policy types are scheduled for removal
Alternatives to Cloud Custodian Alternatives to Kyverno The whole list