AI
Kyverno Beyond the Admission Controller
Most people know Kyverno as a validating and mutating webhook. Frank Jogeleit opens by listing what that framing misses: background controllers that audit already-running workloads, generation policies that create resources like image pull secrets or resource quotas on demand, and cleanup policies that delete stale resources by label. Kyverno also validates any JSON payload, so it runs inside CI/CD pipelines against Dockerfiles and Terraform files without a cluster. A new OPC server lets it validate Envoy and MCP service requests with the same policy API.
Label-Driven RBAC for Ephemeral Namespaces
Deutsche Telekom runs 40 teams on shared Kubernetes clusters. When a team spins up an ephemeral namespace for feature development, someone must create roles and role bindings. Johannes Sonner’s solution uses namespace labels. A label like teamde.alpha/developer tells Kyverno to generate a RoleBinding that grants team alpha the developer ClusterRole, scoped to that namespace only. Administrators control which ClusterRoles exist. Teams control who gets bound to them via GitOps, applying four-eyes review to label changes in git.
Mutating Infrastructure-as-Code Operators to Fill Provider Gaps
Crossplane’s ACM certificate resource accepts a secret reference for a private key but not for a full certificate chain, because that field expects a plain string. Kyverno reads the chain from cert-manager’s secret and writes the string directly into the Crossplane resource on each update. No forked provider, no custom script. A parallel case covers the Pulumi operator: because it discards its pod after each run, node module caches disappear. A Kyverno mutating policy intercepts stack creation, provisions a PersistentVolume, and injects the volume definition so subsequent runs skip the full npm install.
Compliance Reporting Across 500 Microservices
With 40 teams, no one can track which services have health probes or canary rollouts configured. Kyverno audit-mode policies assess existing workloads without blocking anything. Policy Reporter collects those results as Prometheus metrics and surfaces them in Grafana dashboards. Teams opt out of irrelevant policy tiers, such as Argo Rollouts checks for batch jobs, by adding a label. Business stakeholders can check compliance state themselves in Grafana instead of asking the platform team. Deutsche Telekom distributes these policies via Helm charts through GitOps across multiple clusters.
Kyverno Roadmap: CLI Improvements and Open Reports
Release 1.18 focuses on the CLI. Several generate and mutate scenarios that currently cannot be simulated locally in a CI/CD pipeline will be added. The playground at playground.io lets anyone test policies without installing a cluster. The reporting CRDs, including the Policy Reporter standard, are moving to an independent organization called open-reports.io. Kube Warden and Falco Sidekick already consume the format. Release 1.20 plans to remove the deprecated ClusterPolicy CRD, so existing users should migrate to the CEL-based policy CRD now.
Notable Quotes
most of you know Kyerno as an admission controller means it’s registering inside your um Kubernetes cluster as an validating um web hook as well as an mutating uh web hook Frank Jogeleit · ▶ 00:58
we sometimes refer to kerno as the ultimate duct tape yeah we prefer a little bit of duct tape over custom implementation Johannes Sonner · ▶ 25:58
it’s super important to see Kyivero not as a security tool only Johannes Sonner · ▶ 24:31
if I write my own admission controller in Kubernetes, probably the cluster would be down 24/7 Johannes Sonner · ▶ 26:15
Key Takeaways
- Kyverno generates RoleBindings from namespace labels, giving teams GitOps-controlled RBAC without custom controllers.
- One mutating policy can patch Crossplane or Pulumi operator resources to close gaps that upstream providers leave open.
- Policy Reporter exposes Kyverno audit results as Prometheus metrics, turning compliance into a Grafana query.
About the Speaker(s)
Frank Jogeleit is a Senior Software Engineer at Nirmata and a Kyverno maintainer since 2021. He created Policy Reporter, a sub-project that surfaces Kyverno findings as metrics and dashboards.
Johannes Sonner is Platform Engineering Lead for the B2C Germany division at Deutsche Telekom, a provider with 260 million customers across 50 countries. He focuses on Kubernetes-based platform strategy, GitOps, CI/CD, and secure service exposure.