Skip to content

Kyverno

Kyverno is the Kubernetes-native policy engine deployed by Big Bang. This repository packages the upstream Kyverno chart with Big Bang image, security, networking, OpenShift, and test integration.

Big Bang integration

Big Bang deploys the kyverno release to the kyverno namespace. The umbrella release creates the namespace and registry pull secret, supplies the package values, and manages Flux reconciliation. The engine release is installed when Kyverno, Kyverno Policies, or Kyverno Reporter is enabled, so those packages can share the engine.

Configure the engine with the canonical packages.kyverno entry when using packageConfiguration.version: v1; the legacy kyverno entry remains supported for the legacy configuration contract. Put package-chart configuration under the values parent. For the complete, version-matched chart configuration surface, see the Kyverno 1.19.1 chart values.

packageConfiguration:
  version: v1
packages:
  kyverno:
    enabled: true
    values: {}

The legacy equivalent is:

kyverno:
  enabled: true
  values: {}

Big Bang owns the source selection, Flux settings, global network and monitoring inputs, and ordering. This package owns the wrapper behavior passed to the chart. Do not copy individual upstream values into an umbrella override unless Big Bang must change the upstream default.

Controller and cluster lifecycle

Kyverno receives Kubernetes admission requests through its admission controller. The package also configures the upstream background, cleanup, and reports controllers. Big Bang defaults the admission controller to three replicas and sets controller images, pull secrets, resource and security-context overrides for the hardened package environment.

Kyverno CRDs, admission webhooks, and their migration jobs are cluster-scoped. The umbrella uses Flux CreateReplace CRD handling and ignores Flux drift for CRDs, Jobs, and StatefulSets. Review the selected Kyverno release notes before an upgrade and validate clean installation and upgrade behavior in a disposable cluster; webhook, CRD, RBAC, or controller failures can affect unrelated workloads.

The package enables Kyverno PolicyExceptions and constrains their default namespace to kyverno. It also supplies controller RBAC needed by the bundled integration, including background-controller support for generated resources. Policy semantics, policy exceptions, and policy authoring are owned by Kyverno Policies and by upstream Kyverno documentation, not this engine guide.

Network and mesh

Kyverno is intentionally outside the Istio service mesh. Big Bang disables Istio, ambient/HBONE, sidecar injection, and Istio authorization-policy integration for this package. On OpenShift, the wrapper supplies the required SCC binding and, when Istio integration is enabled for OpenShift, a NetworkAttachmentDefinition instead of sidecar injection.

When network policies are enabled, the package permits Kubernetes API access for the admission controller and migration job. The umbrella adds Kubernetes API access for the background, cleanup, and reports controllers as required by the selected platform. The admission controller may also receive private-registry access when the Kyverno Policies image-signature policy is enabled. Review any custom policy, registry, or controller-network requirements before narrowing or expanding these rules.

Observability

When Big Bang metric scraping is enabled, the umbrella enables the Kyverno Grafana integration and ServiceMonitors for the admission, background, cleanup, and reports controllers. Monitoring configuration and availability are umbrella-owned; use the selected Kyverno monitoring documentation for product-level metric details.

  • Kyverno Policies owns Big Bang policy definitions, configuration, exceptions, and authoring guidance. It depends on this engine release.
  • Kyverno Reporter owns reporter deployment, targets, UI, and reporting configuration. This guide does not document reporter operation.
  • Kyverno installation documentation covers standalone installation and general product operations. Do not manually remove webhooks or CRDs from a Big Bang-managed installation outside an approved lifecycle plan.