Kyverno
Kubernetes policy engine for validation, mutation, and resource generation.
Component Category
Platform governance / policy enforcement
Component Description
Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates resources using declarative policies defined as ClusterPolicy and Policy custom resources. It operates as an admission controller, intercepting API requests before resources are persisted.
Why It Is Used
In BullSequana AI, Kyverno enforces platform governance policies required by the Kubeflow integration. It processes ClusterPolicy and GeneratingPolicy resources shipped by Kubeflow to manage profile-level RBAC, pipeline access controls, and namespace-scoped resource generation. Kyverno is a hard runtime dependency of the Kubeflow MVP.
Learn More
Deployment notes
Kyverno deploys in the proai tier at sync wave 5, well before Kubeflow (sync wave 60). Its admission webhooks are scoped to namespaces labeled app.kubernetes.io/part-of: kubeflow-profile, so system namespaces (kube-system, argocd, keycloak, etc.) are unaffected. The forceFailurePolicyIgnore setting ensures that if Kyverno pods are unavailable, admission requests pass through instead of blocking the cluster.
Four independent controllers run: admission (2 replicas), background (1), cleanup (1), and reports (1) — five pods total.
Interacts With
Kubeflow, which defines the ClusterPolicy and GeneratingPolicy resources that Kyverno enforces.ArgoCD, which reconciles Kyverno as part of the proai parent application and must handle controller-mutated policy fields in its ignore-differences configuration.