Meet Kyverno a policy engine for Kubernetes

### Overview In this interview, host Swapnil Bhartiya speaks with Jim Bugwadia, co-founder and CEO of Nirmata, about the evolution of Kubernetes governance and the Kyverno policy engine project. Nirmata originated in the early days of containers and Kubernetes to address governance and operational policy needs across enterprises. Kyverno, originally developed as a module within Nirmata's platform, was open-sourced and donated to the Cloud Native Computing Foundation (CNCF), where it recently advanced from the sandbox stage to the incubation phase.

### Key Topics - **Evolution of Kubernetes Governance:** As Kubernetes became the standard container orchestrator across data center, cloud, and edge environments, enterprises required strong governance and centralized policy enforcement without hindering developer agility. - **CNCF Incubation Milestone:** Kyverno progressed from sandbox to CNCF incubation after a supermajority vote by the Technical Oversight Committee, demonstrating real-world production viability, growing its community by nearly 500%, and reaching approximately 260 million image pulls. - **Kyverno vs. OPA Gatekeeper:** While OPA Gatekeeper relies on an external policy language (Rego), Kyverno is designed natively for Kubernetes, utilizing standard declarative Kubernetes configurations without requiring users to learn a separate language. - **End-User Community Adoption:** Kyverno has built a strong end-user contributor base with thousands of deployments, including organizations like Vodafone, Deutsche Telekom, and Bloomberg.

### Technical Details - **Admission Controller Architecture:** Kyverno operates inside Kubernetes clusters as an admission controller, inspecting incoming API server requests to validate, mutate, or generate configurations on the fly. - **Policy and Security Capabilities:** Following the deprecation and removal of Pod Security policies in Kubernetes (deprecated in v1.22, removed in v1.25), Kyverno provides fine-grained workload security controls. It supports software supply chain security use cases, such as signing and verifying container images, checking attestations and provenance, and enforcing vulnerability exception policies from a library of over 200 sample policies. - **Configuration Generation and Automation:** Beyond validation and blocking, Kyverno automates operational primitives upon resource creation (e.g., automatically generating default secrets, RBAC rules, and network policies when a namespace is created). - **Roadmap Highlights:** Upcoming roadmap priorities include signing and verifying YAML configurations (collaborating with IBM Research Labs), performance and scalability enhancements, and OCI registry integration for storing Kyverno policies.

### Takeaways Kyverno provides a Kubernetes-native approach to policy management by treating policy as code using familiar Kubernetes idioms. Moving to CNCF incubation reflects its production readiness and widespread adoption among diverse enterprise and telecommunications environments.