Kyverno

7.0easy start · #7 of 24
in Infrastructure Policy as Code Tools

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on api, Linux, Mac, self-hosted, Windows.

Kyverno is ranked #7 of 24 in infrastructure policy as code tools on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

Kyverno plans and pricing

All plans

Kyverno Free Open-source project · Apache License 2.0 github.com · 4 Oct 2026

Compared on infrastructure policy as code tools

Kubernetes security: Yes
Admission control: Yes
Deployment model: self_hosted

Best Kyverno alternatives

See all 20

Terraform 0 of 4 in the starter kit Lesson 18.0 Google Cloud Terraform Policy Validation 0 of 4 in the starter kit Lesson 27.4 Open Policy Agent 0 of 4 in the starter kit Lesson 37.4 Conftest 0 of 4 in the starter kit Lesson 47.3 Chef Infra 0 of 4 in the starter kit Lesson 57.1 Google Config Sync 0 of 4 in the starter kit Lesson 67.0

The record

Purpose: Kyverno is a Kubernetes-native policy engine for defining and enforcing policy as code.
Policy language: Kyverno supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission.
Policy actions: Its stable policy types can validate, mutate, generate, and delete resources, and verify container image signatures and attestations.
CI testing: The Kyverno CLI can test policies in CI pipelines against Kubernetes resource manifests before they are applied to a live cluster.
Integrations: The documentation describes using Kyverno with Helm, YAML manifests, GitHub Actions, and GitOps tools such as ArgoCD.
Deployment: Kyverno is installed in a Kubernetes cluster, with Helm recommended for production deployments and YAML manifests also available.
Availability: A standard installation has a required admission controller and optional background, reports, and cleanup controllers; production installations should use high availability mode.
Security: Kyverno’s documentation describes Cosign signatures for container images and manifests and lists release artifacts including CLI binaries for Linux, macOS, and Windows.
Security review: The project documents a 2023 third-party security audit and security assessments conducted as part of its CNCF graduation process.
Operational consideration: Kyverno’s resource webhooks default to fail-closed, so matching resource requests can fail when the API server cannot reach Kyverno.
Legacy policy limit: The documentation marks legacy ClusterPolicy and CleanupPolicy types deprecated in v1.19 and says they are scheduled for removal in v1.20.
Support: The project directs users to its Kubernetes Slack channels, GitHub, and mailing list for questions and discussion.
Intended users: The project describes Kyverno as designed for platform engineering teams and enabling security, compliance, automation, and governance through policy as code.
Project status: The CNCF lists Kyverno as a Graduated project, with graduation recorded in March 2026.
Price from: Free

Where it ranks on The Geeks Club

Best Infrastructure Policy as Code Tools in 2026#7 of 24
Best Container Security Software in 2026#8 of 24
Best Kubernetes Security Software in 2026#2 of 24
Best Infrastructure as Code Security Software in 2026#9 of 22
Best Cloud Governance Software in 2026#3 of 22

Is Kyverno yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Kyverno

Sources

github.com/kyverno/kyverno· checked 4 Oct 2026
kyverno.io/docs/policy-types/overview/· checked 4 Oct 2026
kyverno.io/docs/guides/testing-policies/· checked 4 Oct 2026
kyverno.io/docs/installation/installation/· checked 4 Oct 2026
kyverno.io/docs/guides/security/· checked 4 Oct 2026
kyverno.io/community/· checked 4 Oct 2026
cncf.io/projects/kyverno/· checked 4 Oct 2026
kyverno.io· checked 28 Sept 2026