Kyverno 1.10: Advanced Policy Engine and Security Enhancements

Introduction

Kyverno 1.10, released on March 28, 2023, is most relevant if you’re hardening clusters without turning every deploy into a support ticket. The real value is in rollout safety: tighter controls with fewer false positives, clearer policy outcomes, and smoother day-2 response when something is blocked.

Policy Engine Improvements

• Policy validation enhancements provide more expressive rules and better error messages.
• Background scanning improvements enable continuous policy enforcement across existing resources.
• Policy reporting provides detailed insights into policy violations and compliance status.
• Policy libraries expansion offers more pre-built policies for common use cases.

Mutation Capabilities

1. Mutation rules enhancements enable more sophisticated resource transformations.
2. Image mutation improvements provide better container image security and standardization.
3. Resource injection enables automatic addition of security contexts and labels.
4. Template improvements allow more flexible mutation patterns.

Security Enhancements

• Admission control improvements reduce latency and improve throughput for policy evaluation.
• Certificate management enhancements provide better TLS certificate handling.
• RBAC integration enables fine-grained permissions for policy management.
• Audit logging tracks all policy decisions and violations for compliance.

Developer Experience

• CLI improvements simplify policy testing and validation workflows.
• Documentation enhancements provide better guides and examples.
• Testing tools enable easier policy development and validation.
• IDE integration provides better policy authoring experience.

Getting Started

kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.10.0/install.yaml

Create a policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: enforce
  rules:
  - name: check-labels
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Label 'app' is required"
      pattern:
        metadata:
          labels:
            app: "?*"

Summary

Kyverno 1.10 provides teams with advanced policy capabilities for securing and standardizing Kubernetes deployments.