Whitepaper

The Kyverno Operator's Playbook

Every request to your cluster passes through Kyverno. In 2026, four critical-to-high CVEs hit settings most teams never revisit. Here's how to harden, test, patch and upgrade it.

By the Kyverno maintainers at NirmataFor SecOps and platform teams

Four stages, repeated every release

Running Kyverno well isn't a one-time install. It's a lifecycle.

1 · Harden the baseline

Most Kyverno incidents start with a default nobody revisited, not a novel exploit.

  • Set failurePolicy: Fail and run at least three replicas of each controller, so an outage doesn't admit everything.
  • Keep verifyImages rules enforcing, not stuck in audit mode.
  • Sign policy bundles and verify them on every cluster. Scope RBAC and PolicyException access tightly.
Version check

Is the Kyverno you run still getting patches?

Upstream Kyverno patches only its latest minor, v1.19, until v1.20 ships (projected Nov 2026). Pick your version:

Not sure? kubectl get deploy -n kyverno -o jsonpath='{..image}'

The backport gap

Can't upgrade every quarter?

Upstream Kyverno patches only its latest release. Nirmata Enterprise for Kyverno backports CVE fixes, including Kyverno engine fixes, to every supported release for 18 months. You upgrade on your own schedule, not upstream's.

See how backports work →

Score your deployment

Five questions, one point each. Answer honestly.

0/5

Check your answers in about a minute

# 1. Any fail-open webhooks? kubectl get validatingwebhookconfigurations \ -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.webhooks[*].failurePolicy}{"\n"}{end}' # 2. Which Kyverno version are you actually running? kubectl get deploy -n kyverno \ -o jsonpath='{range .items[*]}{.spec.template.spec.containers[*].image}{"\n"}{end}' # 3. Everything else: RBAC, network policies, replicas, PDBs, probes, reports offload nctl kyverno health

nctl is free and runs offline, with no policy engine in the cluster. Get nctl →

Talk to the team that created Kyverno

Planning the 1.20 migration, stuck on an out-of-support version, or scaling Kyverno across a fleet? Talk to the maintainers, or see how Enterprise Kyverno keeps older releases patched.