● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
K

Kyverno

GraduatedProvisioning & Security
Open source · CNCF · CNCF Graduated · Apache-2.0

Kyverno is a policy engine built specifically for Kubernetes.

updated 2026-07-01

What it is

Kyverno is a policy engine built specifically for Kubernetes. Unlike general-purpose policy tools that bolt onto K8s, Kyverno uses native Kubernetes resources (YAML) to define policies, so you don't need to learn a separate policy language like Rego. It runs as an admission controller, validating, mutating, or generating resources as they're created or updated, and can also scan existing cluster state for compliance drift.

Core use cases: enforcing pod security standards, mutating resources (injecting sidecars, labels, resource limits), generating default resources (network policies, RBAC bindings) when namespaces are created, and validating image signatures/provenance for supply chain security.

Who builds it and why

Kyverno is a CNCF Graduated project, which means it's cleared the bar for production adoption, sustainability, and multi-vendor governance — CNCF doesn't graduate side projects. 526 contributors is a healthy number for a policy engine, indicating this isn't a single-vendor pet project even though Nirmata originated it. Specific founding details and organizational backing beyond CNCF stewardship are not publicly available in the data provided, but graduated status plus active commit history (last commit 2026-07-01) signals ongoing maintenance, not abandonware.

Production readiness signal

  • CNCF Graduated: highest maturity tier CNCF offers, alongside Kubernetes itself, Prometheus, and Envoy.
  • 7,889 GitHub stars: solid adoption signal for a niche infra tool, though lower than headline projects like OPA/Gatekeeper's ecosystem footprint.
  • 526 contributors: broad enough to survive maintainer turnover.
  • v1.18.1: mature version numbering suggests years of iteration, not a 1.0 rewrite risk.
  • Apache-2.0, Go: standard, no licensing landmines, consistent with the rest of the K8s ecosystem.

No public data on release cadence, CVE history, or enterprise reference customers — verify these yourself before betting production security posture on it.

Who should use this

  • Platform teams standardizing pod security, resource governance, or naming/labeling conventions across many namespaces or clusters.
  • Teams doing supply chain security work (image signature verification, SBOM attestation checks) who want this enforced at admission time, not just in CI.
  • Organizations that want policy-as-code but don't want to force every team to learn Rego/OPA syntax — YAML-native policies lower the barrier for platform engineers who aren't security specialists.
  • Multi-tenant clusters where auto-generating default NetworkPolicies or ResourceQuotas per namespace saves manual toil.

Who should NOT use this

  • Teams already invested in OPA/Gatekeeper with a working Rego policy library — rewriting isn't worth it unless Rego is actively causing pain.
  • Non-Kubernetes environments. Kyverno is Kubernetes-only. If you need policy enforcement across VMs, cloud APIs, or Terraform, look elsewhere (that's OPA's broader footprint).
  • Teams needing complex, highly conditional logic in policies. Rego is a real programming language; Kyverno's YAML-based approach hits limits faster for deeply nested conditional rules, even with its JMESPath support.
  • Very small clusters/teams with one or two engineers and no compliance mandate — admission webhooks add latency and failure modes (a misconfigured policy can block legitimate deploys); the operational overhead may not pay for itself yet.
  • Anyone expecting commercial support out of the box — see pricing below.

Alternatives

  • OPA/Gatekeeper — the incumbent CNCF policy engine using Rego; broader scope (works outside K8s too) but steeper learning curve.
  • Kubewarden — WASM-based policy engine, lets you write policies in Rust/Go/AssemblyScript instead of YAML or Rego; good if your team prefers general-purpose languages.
  • jsPolicy — JavaScript-based Kubernetes policy engine; smaller community than Kyverno or Gatekeeper.

Pricing

Fully open source, Apache-2.0, no paid tier from the project itself. Commercial support and enterprise features (policy reporting dashboards, etc.) are available through Nirmata, the company that originated the project, but core Kyverno functionality carries no license cost. Verify current commercial offering details directly with Nirmata — not publicly available in the data provided here.

Frequently asked

What is Kyverno?+
Kyverno is a policy engine built specifically for Kubernetes. Unlike general-purpose policy tools that bolt onto K8s, Kyverno uses native Kubernetes resources (YAML) to define policies, so you don't need to learn a separate policy language like Rego.
Who builds Kyverno?+
Kyverno is a CNCF Graduated project, which means it's cleared the bar for production adoption, sustainability, and multi-vendor governance — CNCF doesn't graduate side projects. 526 contributors is a healthy number for a policy engine, indicating this isn't a single-vendor pet project even though Nirmata originated it.
Is Kyverno production ready?+
CNCF Graduated: highest maturity tier CNCF offers, alongside Kubernetes itself, Prometheus, and Envoy. 7,889 GitHub stars: solid adoption signal for a niche infra tool, though lower than headline projects like OPA/Gatekeeper's ecosystem footprint. 526 contributors: broad enough to survive maintainer turnover. v1.18.
Who should use Kyverno?+
Platform teams standardizing pod security, resource governance, or naming/labeling conventions across many namespaces or clusters. Teams doing supply chain security work (image signature verification, SBOM attestation checks) who want this enforced at admission time, not just in CI.
Who should not use Kyverno?+
Teams already invested in OPA/Gatekeeper with a working Rego policy library — rewriting isn't worth it unless Rego is actively causing pain. Non-Kubernetes environments. Kyverno is Kubernetes-only. If you need policy enforcement across VMs, cloud APIs, or Terraform, look elsewhere (that's OPA's broader footprint).
What are the alternatives to Kyverno?+
OPA/Gatekeeper — the incumbent CNCF policy engine using Rego; broader scope (works outside K8s too) but steeper learning curve. Kubewarden — WASM-based policy engine, lets you write policies in Rust/Go/AssemblyScript instead of YAML or Rego; good if your team prefers general-purpose languages.
How much does Kyverno cost?+
Fully open source, Apache-2.0, no paid tier from the project itself. Commercial support and enterprise features (policy reporting dashboards, etc.) are available through Nirmata, the company that originated the project, but core Kyverno functionality carries no license cost.