Kyverno

Kyverno is a cloud-native policy engine. In Kubernetes, it receives admission requests from the API server and evaluates policies that match the requested resource. A policy can allow or reject the request, change the resource, create related resources, remove resources, or verify container images.

Kyverno exists because Kubernetes configuration is flexible and shared across application, platform, and operations teams. A policy gives those teams a separate, declarative place to express security, compliance, and operational rules. You manage the policy as a Kubernetes resource and keep it with the same review and delivery process as other configuration.

The mental model