# Kyverno Kyverno is a Kubernetes-native cloud-native policy engine for enforcing security, compliance, automation, and governance through policy-as-code. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## Closing the Governance Gap in Nutanix Kubernetes Platform Environments DevFeed: [Closing the Governance Gap in Nutanix Kubernetes Platform Environments]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-08-24T18:04:51Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [nutanix](), [Kubernetes](), [Platform Engineering]() Tags: [build](), [compliance](), [governance](), [kubernetes](), [kyverno](), [nutanix](), [other](), [platform-engineering](), [upgrades]() ### AI overview Nirmata Enterprise for Kyverno is certified to run on Nutanix Kubernetes Platform through the Nutanix Cloud Platform. The article explains how installing it from the NKP Partner Catalog integrates policy governance, enforcement, and upgrades into the platform without a separate pipeline. ### Source excerpt Kyverno on Nutanix Kubernetes Platform is now certified. Install Nirmata Enterprise for Kyverno from the NKP Partner Catalog, no separate pipeline. ## Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads DevFeed: [Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads]() Original publisher: [Read original article]() Author: Jim Bugwadia Published: 2026-08-17T01:27:43Z Content type: release Language: en Sources: [Nirmata]() Topics: [Kyverno](), [Security](), [eBPF](), [configuration](), [Kubernetes]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [configuration](), [ebpf](), [kubernetes](), [kyverno](), [policy](), [product](), [security]() ### AI overview Nirmata introduces Nirmata Runtime for Kyverno, which extends workload controls beyond admission-time configuration checks by enforcing selected runtime behaviors in the kernel. The article describes BPF-LSM and cgroup-scoped eBPF enforcement for process execution, file access, network egress, and application protocols, plus DNS observation and reporting. ### Source excerpt Nirmata created Kyverno and donated it to the CNCF in 2020. Kyverno is now a graduated CNCF project and is widely used for enforcing and automating configuration security and best practices. However, admission control answers one question: does this spec look right? It cannot... The post Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads first appeared on Nirmata. ## Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically. DevFeed: [Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically.]() Original publisher: [Read original article]() Author: Akhil Chandran Published: 2026-08-14T11:29:37Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [GitOps](), [Kubernetes](), [pull-requests](), [argocd](), [flux]() Tags: [agent](), [ai](), [argocd](), [flux](), [gitops](), [kubernetes](), [kyverno](), [other](), [pull-requests]() ### AI overview Nirmata's Remediator Agent is designed to automate remediation of Kyverno policy violations within an existing GitOps workflow. It traces violations to their Git sources, proposes deterministic or LLM-generated fixes, commits changes, opens pull requests for review, and relies on ArgoCD or Flux CD to sync approved changes back to Kubernetes. ### Source excerpt Kyverno detects Kubernetes policy violations. Nirmata's Remediator Agent turns them into reviewed pull requests within your existing GitOps workflow. ## Critical Kyverno Vulnerability -- CVE-2026-54523 DevFeed: [Critical Kyverno Vulnerability -- CVE-2026-54523]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-07-29T01:08:41Z Content type: news Language: en Sources: [Nirmata]() Topics: [Kyverno](), [vulnerability](), [Exploit](), [Kubernetes](), [Cloud Native Ecosystem]() Tags: [2026](), [admission-controller](), [ai](), [cloud-native](), [cloud-native-ecosystem](), [cncf](), [cve](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [nctl-ai](), [platform-engineering](), [policy](), [policy-as-code](), [policy-management](), [release](), [upgrade](), [vulnerability]() ### AI overview The article reports CVE-2026-54523, a critical Kyverno vulnerability affecting versions 1.18.0 and 1.18.1. A tenant able to create a NamespacedMutatingPolicy could bypass namespace isolation and generate resources in other namespaces, potentially enabling cluster-wide privilege escalation. Kyverno 1.18.2 patches the vulnerability. ### Source excerpt Critical Kyverno Vulnerability -- CVE-2026-54523 On July 13, 2026, a critical vulnerability was disclosed in Kyverno, the Kubernetes-native policy engine used broadly across the cloud native ecosystem for policy-as-code enforcement. The vulnerability, tracked as CVE-2026-54523 (GHSA-79gf-7frw-68m9), allows a tenant with permission to create a NamespacedMutatingPolicy... The post Critical Kyverno Vulnerability -- CVE-2026-54523 first appeared on Nirmata. ## From Tickets to Pull Requests: Running Cilium in a GitOps Platform DevFeed: [From Tickets to Pull Requests: Running Cilium in a GitOps Platform]() Original publisher: [Read original article]() Author: Dean Lewis Published: 2026-06-02T12:56:19Z Content type: tutorial Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Cilium](), [GitOps](), [argo-cd](), [Kyverno](), [ci]() Tags: [argo](), [argo-cd](), [ci](), [cilium](), [gitops](), [hubble-timescape](), [kyverno](), [network-policy](), [platform-engineering](), [pull-requests]() ### AI overview The article describes running Cilium as part of a GitOps platform using Argo CD, Kyverno, and isopolicy CI. ### Source excerpt Run Cilium as a GitOps platform: use Argo CD, Kyverno, and isopolicy CI.