Kyverno policies

kyverno apply <policy.yaml>

Applies Kyverno policies to Kubernetes resources, validating manifests (and the cluster) with rules in native syntax.

Run it when you want K8s policies with native syntax: Kyverno defines policies in Kubernetes format (no Rego — the difference vs OPA) and applies them at admission (and in validation with kyverno apply in the pipeline). It's K8s policy with the smallest learning curve: rules (pods without privileged, limits, labels) in Kubernetes YAML. In K8s DevSecOps, Kyverno is the native alternative to Gatekeeper: kyverno apply validates manifests in the pipeline, and policies in the cluster control admission.

Don't use it without deployment: cluster policies require Kyverno installation; kyverno apply (pipeline validation) works without the cluster. Complex policies (those Rego expresses better) may require OPA: the choice between Kyverno (native) and Gatekeeper (Rego) depends on the team. And watch out: organizational policies are defined with the team — community ones (the policy library) are the starting point. Auditing existing resources (not just admission) is part of the flow.