# Kyverno (/docs/runtime/components/kyverno)



Component Category [#component-category]

Platform governance / policy enforcement

Component Description [#component-description]

Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates resources using declarative policies defined as `ClusterPolicy` and `Policy` custom resources. It operates as an admission controller, intercepting API requests before resources are persisted.

Why It Is Used [#why-it-is-used]

In BullSequana AI, Kyverno enforces platform governance policies required by the Kubeflow integration. It processes `ClusterPolicy` and `GeneratingPolicy` resources shipped by Kubeflow to manage profile-level RBAC, pipeline access controls, and namespace-scoped resource generation. Kyverno is a hard runtime dependency of the Kubeflow MVP.

Learn More [#learn-more]

* [Kyverno documentation](https://kyverno.io/docs/)
* [kyverno/kyverno on GitHub](https://github.com/kyverno/kyverno)

Deployment notes [#deployment-notes]

Kyverno deploys in the proai tier at sync wave 5, well before Kubeflow (sync wave 60). Its admission webhooks are scoped to namespaces labeled `app.kubernetes.io/part-of: kubeflow-profile`, so system namespaces (kube-system, argocd, keycloak, etc.) are unaffected. The `forceFailurePolicyIgnore` setting ensures that if Kyverno pods are unavailable, admission requests pass through instead of blocking the cluster.

Four independent controllers run: admission (2 replicas), background (1), cleanup (1), and reports (1) — five pods total.

Interacts With [#interacts-with]

* `Kubeflow`, which defines the ClusterPolicy and GeneratingPolicy resources that Kyverno enforces.
* `ArgoCD`, which reconciles Kyverno as part of the proai parent application and must handle controller-mutated policy fields in its ignore-differences configuration.