Skip to main content

Data Flow: Policy Enforcement

Purpose: For platform engineers, explains how policy enforcement works at resource admission time.

Flow Summary​

Components​

ComponentNamespaceRole
Kyverno EnginekyvernoEvaluates policies against incoming resources
Admission WebhookkyvernoIntercepts API server admission requests
ClusterPoliciescluster-scopedDefine validation, mutation, and generation rules

Sequence​

  1. User or controller submits a resource to the Kubernetes API server.
  2. API server sends an admission review request to the Kyverno webhook.
  3. Kyverno matches the resource against applicable ClusterPolicy rules (by kind, namespace, labels).
  4. Validate rules: check constraints (e.g., disallow-privileged, require-run-as-nonroot). Violations reject the request with an error message.
  5. Mutate rules: patch the resource (e.g., inject default security context, add labels).
  6. Generate rules: create companion resources (e.g., NetworkPolicy for new namespaces).
  7. Kyverno returns the admission response (allow + patches, or deny + message).
  8. Policy Reports are created for audit-mode policies (warn without blocking).

Baseline Policies (17)​

Key policies enforced by default:

  • disallow-privileged — blocks privileged containers
  • require-run-as-nonroot — enforces non-root UID
  • restrict-volume-types — limits to safe volume types
  • restrict-seccomp — requires RuntimeDefault or Localhost seccomp profile
  • disallow-host-namespaces — prevents hostPID/hostIPC/hostNetwork
  • restrict-capabilities — drops all, allows only a minimal set