Kyverno

Kyverno validates, mutates, and generates Kubernetes resources based on policies written as ordinary Kubernetes YAML manifests, so a team doesn't need to learn a new policy language to enforce rules like requiring resource limits or blocking privileged containers. It runs as an admission controller, rejecting non-compliant resources before they're created.

Kyverno is a fit for Kubernetes-focused teams that want policy enforcement without learning Rego, a YAML-native alternative to Open Policy Agent (also in this catalog) for teams that specifically don't want to introduce a separate policy language.