Kyverno overview

Kubernetes-native policy engine that uses admission webhooks to validate, mutate, and generate resources based on declarative policies written as Kubernetes CRDs. Unlike OPA/Gatekeeper which requires learning Rego, Kyverno policies are expressed as familiar YAML with pattern matching and overlay semantics. In Krate, Kyverno enforces org-level PolicyProfiles — controlling which container images agents can use, what RBAC bindings are permitted, resource quota enforcement, and security baseline compliance. Supports policy reports, background scanning, and exception management.