Policies and Rules

Get an overview of how Kyverno policies and rules work.

A Kyverno policy is a collection of rules. Each rule consists of a match declaration, an optional exclude declaration, and one of a validate, mutate, generate, or verifyImages declaration. Each rule can contain only a single validate, mutate, generate, or verifyImages child declaration.

Kyverno Policy

Policies can be defined as cluster-wide resources (using the kind ClusterPolicy) or namespaced resources (using the kind Policy). As expected, namespaced policies will only apply to resources within the namespace in which they are defined while cluster-wide policies are applied to matching resources across all namespaces. Otherwise, there is no difference between the two types.

Additional policy types include Policy Exceptions and Cleanup Policies which are separate resources and described further in the documentation.

Learn more about Applying Policies and Writing Policies in the upcoming chapters.


Last modified October 09, 2023 at 1:51 PM PST: Move dot in Kyverno Policies documentation page (#980) (da9d0b0)