$ show kyverno/policies
This repository is a comprehensive library of Kyverno policies for Kubernetes, providing a curated collection of Validating, Mutating, Generating, and Cleanup policies. It covers Pod Security Standards (baseline and restricted), best practices, RBAC restrictions, image registry controls, and integrations with ecosystem tools like Istio, Linkerd, Karpenter, and ArgoCD. The policies are written as YAML manifests using Kyverno's CEL-based API (policies.kyverno.io/v1) and are accompanied by extensive test suites using both Chainsaw and Kyverno CLI frameworks. The repository serves as a reference implementation and distribution channel for Kyverno users, with standardized metadata (ArtifactHub), CI/CD pipelines, and contribution guidelines. While not a traditional application, it functions as a policy-as-code library with a strong emphasis on security and operational best practices.
The LLM identified 3 files worth highlighting for reuse:
Reusable Chainsaw step template that asserts a ValidatingPolicy is ready by checking its status condition. This pattern can be extracted and used in any Kyverno policy testing project to reduce boilerplate and ensure consistent readiness checks.
Reusable GitHub Action that runs Chainsaw tests with sharding support. It handles test execution, result collection, and failure reporting. Can be extracted for any project using Chainsaw for Kubernetes testing, providing a robust CI pattern.
Reusable GitHub Action that sets up a KinD cluster and installs Kyverno for testing. It is parameterized and can be used in any Kyverno policy testing workflow, encapsulating the complex setup steps in a composable action.