Installing Kyverno & Kyverno Policies

Kyverno is an application to manage Kubernetes security policies. Security policies appear in Kyverno as Kubernetes resources. Kyverno supports kubectl, git, and kustomize. You can use the Kyverno command line interface to test policies and validate resources as part of the CI/CD pipeline.

Kyverno policies is a Kyverno extension. Kyverno policies includes an implementation of Kubernetes Pod Security Standards (PSS). The original policies are stored in a separate Kyverno-policies repository.

You can send notifications from Kyverno to other systems using the Policy reporter extension.

Getting startedGetting started

Make sure that the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If any rule is missing, add it.

Installation using Yandex Cloud MarketplaceInstallation using Yandex Cloud Marketplace

1. Go to the folder page and select Managed Service for Kubernetes.
2. Click the name of the Managed Service for Kubernetes cluster you need and select the Marketplace tab.
3. Under Application available for installation, select Kyverno & Kyverno Policies and click Go to install.
4. Configure the application:
   • Namespace: Select or create a namespace for Kyverno. Make sure it contains no applications or objects; otherwise, Kyverno will not run properly.
   • Application name: Specify the app name.
   • Activating Kyverno Policies: Select to install the Kyverno Policies extension.
   • Pod Security Standard profile: Select a Pod Security Standard profile:
     • baseline: Policy with minimum restrictions which prevents known risks of privilege abuse.
     • restricted: Policy with severe restrictions aligned with the latest pod security practices.
     • privileged: Unrestricted policy granting maximum privileges.
   • Validation failure action: Select a response to Kyverno triggering:
     • audit: Notify.
     • enforce: Block.
5. Click Install.
6. Wait for the application to change its status to Deployed.

Installation using a Helm chartInstallation using a Helm chart

1. Install Helm v3.8.0 or higher.

2. Install kubectl and configure it to work with the created cluster.

3. To install a Helm chart with Kyverno, run the following command:

   helm pull oci://cr.yandex/yc-marketplace/multi-kyverno \
     --version 1.0.0 \
     --untar && \
   helm install \
     --namespace <namespace> \
     --create-namespace \
     multi-kyverno ./multi-kyverno/
   

   Select a namespace that does not contain any applications or objects, or else Kyverno will not run properly.

   Note

   If you are using a Helm version below 3.8.0, append the export HELM_EXPERIMENTAL_OCI=1 && \ string to the command to enable Open Container Initiative (OCI) support in the Helm client.

Application versionsApplication versions

For each Kubernetes version, a certain Kyverno version is supported. The required Kyverno version is installed by default depending on your Kubernetes version.

Uninstalling the applicationUninstalling the application

If you no longer need the Kyverno application, uninstall it:

Use casesUse cases

• Setting up Kyverno & Kyverno Policies.

See alsoSee also

• Kyverno documentation.