Installing Kyverno & Kyverno Policies

Kyverno is an application to manage Kubernetes security policies. Security policies appear in Kyverno as Kubernetes resources. Kyverno supports kubectl, git, and kustomize. You can use the Kyverno command line interface to test policies and validate resources as part of the CI/CD pipeline.

Kyverno policies is a Kyverno extension. Kyverno policies includes an implementation of Kubernetes Pod Security Standards (PSS). The original policies are stored in a separate Kyverno-policies repository.

You can send notifications from Kyverno to other systems using the Policy reporter extension.

Getting startedGetting started

Make sure that the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If any rule is missing, add it.

Installation using Yandex Cloud MarketplaceInstallation using Yandex Cloud Marketplace

1. Navigate to the folder dashboard and select Managed Service for Kubernetes.
2. Click the name of the Managed Service for Kubernetes cluster you need and select the Marketplace tab.
3. Under Application available for installation, select Kyverno & Kyverno Policies and click Go to install.
4. Configure the application:
   • Namespace: Create a new namespace, e.g., kyverno-space. If you leave the default namespace, Kyverno may work incorrectly.
   • Application name: Specify the application name.
   • Activating Kyverno Policies: Select to install the Kyverno Policies extension.
   • Pod Security Standard profile: Select a Pod Security Standard profile:
     • baseline: Policy with minimum restrictions which prevents known risks of privilege abuse.
     • restricted: Policy with severe restrictions aligned with the latest pod security practices.
     • privileged: Unrestricted policy granting maximum privileges.
   • Validation failure action: Select a response to Kyverno triggering:
     • audit: Notify.
     • enforce: Block.
5. Click Install.
6. Wait for the application to change its status to Deployed.

Installation using a Helm chartInstallation using a Helm chart

1. Install Helm v3.8.0 or higher.

2. Install kubect and configure it to work with the new cluster.

3. To install a Helm chart with Kyverno, run the following command:

   helm pull oci://cr.yandex/yc-marketplace/multi-kyverno \
     --version 1.0.0 \
     --untar && \
   helm install \
     --namespace <namespace> \
     --create-namespace \
     multi-kyverno ./multi-kyverno/
   

   If you set namespace to the default namespace, Kyverno may work incorrectly. We recommend you to specify a value different from all existing namespaces (e.g., kyverno-space).

   Note

   If you are using a Helm version below 3.8.0, append the export HELM_EXPERIMENTAL_OCI=1 && \ string to the command to enable Open Container Initiative (OCI) support in the Helm client.

Application versionsApplication versions

For each Kubernetes version, a certain Kyverno version is supported. The required Kyverno version is installed by default depending on your Kubernetes version.

Uninstalling the applicationUninstalling the application

If you no longer need the Kyverno application, uninstall it:

Use casesUse cases

• Setting up Kyverno & Kyverno Policies.

See alsoSee also

• Kyverno documentation.