Container Service for Kubernetes:Use Kyverno for policy governance

Kyverno runs as a dynamic admission controller in a Kubernetes cluster. It intercepts admission webhook requests from the API server, performs validation or mutation operations, then returns a decision to either allow or deny the request.

The following figure shows how Kyverno uses admission webhooks to validate policies and mutate resources during the API server's admission phase.

Use cases

The default ACK Security Policy Management feature is built on OPA Gatekeeper. It comes with a built-in container security policy policy library for common compliance and O&M use cases, satisfying general auditing and enforcement needs. It also supports deploying multiple policy instances and integrates with Simple Log Service (SLS) for enhanced observability.

Kyverno is a Kubernetes-native policy engine. It uses standard CustomResourceDefinitions (CRDs) to define and manage policies, providing a simple and user-friendly experience. Its core advantages include:

• YAML-based policies: Policies are written in standard YAML, consistent with other Kubernetes manifests. This lowers the learning curve by eliminating the need to learn a specialized language such as Rego.

• Rich feature set: Kyverno natively supports validate, mutate, and generate operations. This covers a wider range of automation and Policy-as-Code use cases.

• Scan existing resources: In addition to enforcing policies at admission time, Kyverno can also scan, report, mutate, and generate configurations for existing resources in the cluster.

• Automatic resource generation: Policies can automatically create related resources such as NetworkPolicies or ConfigMaps, enabling automated configuration.

While Kubernetes now offers native ValidatingAdmissionPolicy and MutatingAdmissionPolicy, Kyverno provides more comprehensive and enterprise-grade policy governance capabilities.

Recommended use cases:

• Custom policies: Quickly write and deploy policies for your CRDs.

• Mutating and generating policies: When you need to use the mutate or generate policies.

  Kyverno has comprehensive caching, external data integration, and reporting mechanisms. Its extended Common Expression Language (CEL) syntax library can meet the advanced Policy-as-Code needs of specific enterprise scenarios.

• Multi-cluster policy governance: Use the Kyverno CLI, APIs, or integrations with GitOps tools such as ArgoCD to achieve unified policy distribution and management across multiple clusters.