# Kyverno Published articles for Kyverno. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门 DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [configuration](), [dry-run](), [TLS (Transport Layer Security)](), [API]() Tags: [admission](), [api](), [apiserver](), [cel](), [configuration](), [distributed](), [kubernetes](), [kyverno](), [mutating](), [timeout](), [tls](), [v1-30-3](), [validating](), [webhook]() ### AI overview A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag. ### Source excerpt 钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。 ## Introducing OttoFlow: AI Workflows for Kubernetes DevFeed: [Introducing OttoFlow: AI Workflows for Kubernetes]() Original publisher: [Read original article]() Author: Shreyas Mocherla Published: 2026-08-26T18:34:15Z Content type: release Language: en Sources: [Nirmata]() Topics: [Artificial Intelligence](), [Kubernetes](), [Platform Engineering](), [GitOps]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [declarative](), [gitops](), [kubernetes](), [kyverno](), [llm](), [nothing](), [platform-engineering](), [product](), [workflows]() ### AI overview Nirmata introduces OttoFlow, an open-source system for building AI workflows on Kubernetes. It represents workflows as custom resources with typed DAG steps and limits AI to selected parts of the operations process, aiming to combine deterministic, reviewable automation with model-based reasoning. ### Source excerpt AI workflows for Kubernetes, without handing an agent your kubeconfig. OttoFlow makes a workflow a custom resource: typed DAG steps, AI only where it counts. ## Closing the Governance Gap in Nutanix Kubernetes Platform Environments DevFeed: [Closing the Governance Gap in Nutanix Kubernetes Platform Environments]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-08-24T18:04:51Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [nutanix](), [Kubernetes](), [Platform Engineering]() Tags: [build](), [compliance](), [governance](), [kubernetes](), [kyverno](), [nutanix](), [other](), [platform-engineering](), [upgrades]() ### AI overview Nirmata Enterprise for Kyverno is certified to run on Nutanix Kubernetes Platform through the Nutanix Cloud Platform. The article explains how installing it from the NKP Partner Catalog integrates policy governance, enforcement, and upgrades into the platform without a separate pipeline. ### Source excerpt Kyverno on Nutanix Kubernetes Platform is now certified. Install Nirmata Enterprise for Kyverno from the NKP Partner Catalog, no separate pipeline. ## Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads DevFeed: [Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads]() Original publisher: [Read original article]() Author: Jim Bugwadia Published: 2026-08-17T01:27:43Z Content type: release Language: en Sources: [Nirmata]() Topics: [Kyverno](), [Security](), [eBPF](), [configuration](), [Kubernetes]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [configuration](), [ebpf](), [kubernetes](), [kyverno](), [policy](), [product](), [security]() ### AI overview Nirmata introduces Nirmata Runtime for Kyverno, which extends workload controls beyond admission-time configuration checks by enforcing selected runtime behaviors in the kernel. The article describes BPF-LSM and cgroup-scoped eBPF enforcement for process execution, file access, network egress, and application protocols, plus DNS observation and reporting. ### Source excerpt Nirmata created Kyverno and donated it to the CNCF in 2020. Kyverno is now a graduated CNCF project and is widely used for enforcing and automating configuration security and best practices. However, admission control answers one question: does this spec look right? It cannot... The post Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads first appeared on Nirmata. ## Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically. DevFeed: [Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically.]() Original publisher: [Read original article]() Author: Akhil Chandran Published: 2026-08-14T11:29:37Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [GitOps](), [Kubernetes](), [pull-requests](), [argocd](), [flux]() Tags: [agent](), [ai](), [argocd](), [flux](), [gitops](), [kubernetes](), [kyverno](), [other](), [pull-requests]() ### AI overview Nirmata's Remediator Agent is designed to automate remediation of Kyverno policy violations within an existing GitOps workflow. It traces violations to their Git sources, proposes deterministic or LLM-generated fixes, commits changes, opens pull requests for review, and relies on ArgoCD or Flux CD to sync approved changes back to Kubernetes. ### Source excerpt Kyverno detects Kubernetes policy violations. Nirmata's Remediator Agent turns them into reviewed pull requests within your existing GitOps workflow. ## Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost DevFeed: [Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-08-12T20:52:35Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kubernetes](), [Cloud](), [Automation](), [data]() Tags: [agents](), [ai](), [automation](), [cloud](), [cloud-native](), [clusters](), [cncf](), [compute](), [cost-savings](), [deployment](), [devsecops](), [kubernetes](), [kyverno](), [policy-management](), [resource](), [verification]() ### AI overview Nirmata describes applying its Cost Analyzer and Resource Hygiene Cloud Agents across an enterprise customer's 40-cluster production Kubernetes fleet. The scans identified a roughly $107,000 monthly compute baseline and about 50% recoverable through right-sizing before stale-resource cleanup, while revealing recurring sources of waste and governance gaps. ### Source excerpt Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost Most Kubernetes Cost overruns don't come from one singularly bad decision. They come from dozens of reasonable ones -- made independently, by different teams, at different times -- that... The post Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost first appeared on Nirmata. ## AI governance gaps leave developer and agent access to AI tools insufficiently controlled DevFeed: [AI governance gaps leave developer and agent access to AI tools insufficiently controlled]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-08-05T01:56:41Z Content type: opinion Language: en Sources: [Nirmata]() Topics: [ai-governance](), [Security](), [Access Control](), [Authorization](), [developer-productivity](), [Monitoring](), [Large Language Model]() Tags: [access-control](), [ai](), [ai-governance](), [cloud-native](), [cncf](), [developer](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [llms](), [policy-management](), [risk-management](), [security](), [visibility]() ### AI overview The article presents aggregated responses from security leaders about AI governance in fast-moving engineering organizations. It identifies gaps in centralized access control, policy enforcement, session auditing, real-time visibility, and protection against exposing permissions or environment variables to LLMs. ### Source excerpt Three Questions We Asked About AI Governance -- And What the Answers Reveal Over the past few months, we've been having the same conversation on repeat with security leaders about AI at fast-moving engineering organizations. Different companies, different tech stacks, same three questions -- and,... The post The AI Innovation-Security Paradox first appeared on Nirmata. ## Critical Kyverno Vulnerability -- CVE-2026-54523 DevFeed: [Critical Kyverno Vulnerability -- CVE-2026-54523]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-07-29T01:08:41Z Content type: news Language: en Sources: [Nirmata]() Topics: [Kyverno](), [vulnerability](), [Exploit](), [Kubernetes](), [Cloud Native Ecosystem]() Tags: [2026](), [admission-controller](), [ai](), [cloud-native](), [cloud-native-ecosystem](), [cncf](), [cve](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [nctl-ai](), [platform-engineering](), [policy](), [policy-as-code](), [policy-management](), [release](), [upgrade](), [vulnerability]() ### AI overview The article reports CVE-2026-54523, a critical Kyverno vulnerability affecting versions 1.18.0 and 1.18.1. A tenant able to create a NamespacedMutatingPolicy could bypass namespace isolation and generate resources in other namespaces, potentially enabling cluster-wide privilege escalation. Kyverno 1.18.2 patches the vulnerability. ### Source excerpt Critical Kyverno Vulnerability -- CVE-2026-54523 On July 13, 2026, a critical vulnerability was disclosed in Kyverno, the Kubernetes-native policy engine used broadly across the cloud native ecosystem for policy-as-code enforcement. The vulnerability, tracked as CVE-2026-54523 (GHSA-79gf-7frw-68m9), allows a tenant with permission to create a NamespacedMutatingPolicy... The post Critical Kyverno Vulnerability -- CVE-2026-54523 first appeared on Nirmata. ## Accelerate teams with platform engineering and policy-as-code DevFeed: [Accelerate teams with platform engineering and policy-as-code]() Original publisher: [Read original article]() Author: Rafael Ferreira Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [DevOps](), [Security](), [Code](), [Deployment](), [opa](), [JSON](), [rego](), [YAML](), [Git]() Tags: [best-practices](), [deployment](), [developer](), [devops](), [engineering](), [git](), [json](), [kyverno](), [platform](), [platform-engineering](), [policy](), [rego](), [security]() ### AI overview This article explains how platform engineering uses internal platforms, golden paths, automation, and self-service to reduce developer cognitive load while improving security, compliance, cost control, and delivery speed. It also presents Policy-as-Code as a way to encode rules in versioned, testable definitions and validate them continuously before deployment, with tools such as OPA and Kyverno providing immediate feedback and audit trails. ### Source excerpt Move from DevOps to platform engineering. Learn golden paths, platform thinking, and why demand is rising for skilled platform engineers ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## From Tickets to Pull Requests: Running Cilium in a GitOps Platform DevFeed: [From Tickets to Pull Requests: Running Cilium in a GitOps Platform]() Original publisher: [Read original article]() Author: Dean Lewis Published: 2026-06-02T12:56:19Z Content type: tutorial Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Cilium](), [GitOps](), [argo-cd](), [Kyverno](), [ci]() Tags: [argo](), [argo-cd](), [ci](), [cilium](), [gitops](), [hubble-timescape](), [kyverno](), [network-policy](), [platform-engineering](), [pull-requests]() ### AI overview The article describes running Cilium as part of a GitOps platform using Argo CD, Kyverno, and isopolicy CI. ### Source excerpt Run Cilium as a GitOps platform: use Argo CD, Kyverno, and isopolicy CI. ## Spotlight on Policy Working Group DevFeed: [Spotlight on Policy Working Group]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2025-10-18T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [Security](), [Architecture & Design](), [Kyverno](), [JSON Schema]() Tags: [architecture](), [article](), [blog-post](), [json-schema](), [kubernetes](), [kyverno](), [security]() ### AI overview This retrospective examines the completed Kubernetes Policy Working Group, its goal of developing an overall architecture for current and future policy implementations, and insights from former co-chairs about policy management in the Kubernetes ecosystem. ### Source excerpt (Note: The Policy Working Group has completed its mission and is no longer active. This article reflects its work, accomplishments, and insights into how a working group operates.) In the complex world of Kubernetes, policies play a crucial role in managing and securing clusters. But have you ever wondered how these policies are developed, implemented, and standardized across the Kubernetes ecosystem? To answer that, let's take a look back at the work of the Policy Working Group. The Policy Working Group was dedicated to a critical mission: providing an overall architecture that encompasses both current policy-related implementations and future policy proposals in Kubernetes. Their goal was both ambitious and essential: to develop a universal policy architecture that benefits developers and end-users alike. Through collaborative methods, this working group strove to bring clarity and consistency to the often complex world of Kubernetes policies. By focusing on both existing implementations and future proposals, they ensured that the policy landscape in Kubernetes remains coherent and accessible as the technology evolves. This blog post dives deeper into the work of the Policy Working Group, guided by insights from its former co-chairs: Jim Bugwadia Poonam Lamba Andy Suderman Interviewed by Arujjwal Negi . These co-chairs explained what the Policy Working Group was all about. Introduction Hello, thank you for the time! Let's start with some introductions, could you tell us a bit about yourself, your role, and how you got involved in Kubernetes? Jim Bugwadia: My name is Jim Bugwadia, and I am a co-founder and the CEO at Nirmata which provides solutions that automate security and compliance for cloud-native workloads. At Nirmata, we have been working with Kubernetes since it started in 2014. We initially built a Kubernetes policy engine in our commercial platform and later donated it to CNCF as the Kyverno project. I joined the CNCF Kubernetes Policy Working Group to h ## Chainguard Releases 58 New Container Images in March 2024 DevFeed: [Chainguard Releases 58 New Container Images in March 2024]() Original publisher: [Read original article]() Published: 2024-04-04T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container images](), [supply-chain-security](), [Security](), [Kubernetes](), [.NET](), [VLC]() Tags: [chainguard](), [chainguard-images](), [conda](), [container-images](), [fips-compliance](), [helm](), [kubernetes](), [kyverno](), [net](), [security](), [software-supply-chain](), [velero]() ### AI overview Chainguard released 58 new container images in March 2024, including publicly available images for Velero and .NET. The article highlights FIPS compliance, smaller image size for Velero, daily builds from source, and performance optimizations for .NET images. ### Source excerpt Discover the latest Chainguard Images in March 2024, offering unparalleled security with low-to-zero CVEs for fortified software supply chain. ## The incremental path to container images: Chainguard Images DevFeed: [The incremental path to container images: Chainguard Images]() Original publisher: [Read original article]() Published: 2023-11-28T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container images](), [Vulnerabilities](), [Kubernetes](), [vulnerability management](), [Exploit]() Tags: [alpine](), [apk](), [chainguard-images](), [container-image](), [container-images](), [distroless-containers](), [hardened-images](), [helm](), [kubernetes](), [kyverno](), [prometheus](), [sigstore](), [vulnerabilities]() ### AI overview This article explains an incremental approach to migrating existing container images to Chainguard Images. It recommends starting with hardened Application Images that can often be adopted as drop-in replacements, then progressing toward Base Images. ### Source excerpt Explore how easy it is to migrate existing container images to Chainguard Images, whether you are adopting Application Images or Base Images.