pal-e-docs

Phase 19: Policy-as-Code (Kyverno)

phase-platform-19-policy-kyverno Phase

phase
Project

Phase 19: Policy-as-Code (Kyverno)

Goal: Deploy Kyverno for Kubernetes admission control — enforce image registry allowlists, resource governance, and baseline security policies across all namespaces.
Owner: Dev agent
Repo: forgejo_admin/pal-e-platform
Depends on: Phase 8 (Network Security — Kyverno is the admission control layer above NetworkPolicies)
Tier: 2 — Hardening. Admission policies prevent bad changes from reaching the cluster. Kyverno over OPA/Gatekeeper because policies are native Kubernetes YAML — no Rego language to learn, AI agents can write and review them natively.
DORA: CFR — admission policies catch misconfigurations before they become incidents. Every rejected bad manifest is a change failure that never happened.

Scope

  • Deploy Kyverno via Helm in kyverno namespace
  • ClusterPolicies (baseline):
  • Namespace exceptions: System namespaces (kube-system, cnpg-system) get audit-only mode, not enforce
  • Kyverno Prometheus metrics → Grafana policy violation dashboard
  • Alertmanager integration: alert on policy violations in enforce mode
  • SOP: sop-policy-as-code — how to add/update policies, exception process

Deliverables

  • TBD — filled after completion
  • plan-pal-e-platform — parent plan
  • phase-pal-e-platform-network-security — Phase 8, Kyverno is the layer above
  • phase-platform-20c-supply-chain-signing — Kyverno enforces "only signed images deploy"
  • sop-network-security — existing security SOP, Kyverno extends it