Beyond Admission: How Kyverno Extends Native Policies for Full Lifecycle Management
summary
Kyverno extends Kubernetes admission by adding MutatingPolicy support that can mutate at admission and also mutate existing resources in-cluster, a CLI that runs kyverno apply and kyverno test to validate policies (example: a deployment missing a squad label fails), and background scanning that finds and reports violations across live clusters. New report output follows the OpenReport format so an image scanner and Kyverno share the same policy reports; mutations and reconciler conflicts are handled via ownership and service‑side apply.
AI-written summary · about
chapters (15)
- 0:00Kyverno introduction
- 1:23Native admission policies
- 3:09Kyverno policy types
- 6:45Policy lifecycle challenges
- 7:48Local policy testing
- 9:13Unit testing policies
- 9:56Extending native policies
- 12:04Background scanning
- 12:46Mutating resources
- 15:42Reporting and observability
- 18:54Kyverno lifecycle summary
- 19:39Q&A on reconciliation
- 22:27Mutating mode reporting
- 24:32Access control reporting
- 26:39Advanced CLI testing
related talks
31mKubernetes Native Policy Management with Kyverno!
49mKubernetes Policy as Code with Kyverno
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
27mUnderstanding Kyverno in a Visual Way
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
46mKyverno: Compliance Inside Your Kubernetes Cluster
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters
05mBeyond Guardrails: Resource Lifecycle Automation With Kyverno