Install Kyverno

Kyverno is a tool for managing security policies in Kubernetes. It lets you define rules for apps and cluster resources and automatically check whether they are followed.

For example, you can:

  • Allow the use of Docker images only from trusted registries.
  • Verify Docker image authenticity and integrity with digital signatures before deployment.
  • Prevent containers from running with elevated privileges.
  • Restrict containers’ access to the file systems of cluster nodes.
  • Isolate network traffic between environments belonging to different companies.
  • Add custom CA certificates to BRIX containers.

Installing Kyverno involves two steps:

  1. Install the Kyverno service.
  2. Install Kyverno security policies.

Stage 1. Install the Kyverno service

 

Step 1. Download the Helm chart and configuration file

To install over the internet, get the configuration file values-kyverno.yaml by running the following commands:

helm repo add brix365 https://charts.brix365.com
helm repo update
helm show values brix365/kyverno > values-kyverno.yaml

Get the configuration file for an offline installation

  1. On a computer with internet access, download the BRIX images and upload them to your local image registry by running the following commands:

helm repo add brix365 https://charts.brix365.com
helm repo update
helm pull brix365/kyverno

For details, see Download BRIX images.

  1. Copy the downloaded chart archive kyverno-X.Y.Z.tgz to the server where you will install it.
  1. Extract the chart and copy the default configuration file values.yaml to values-kyverno.yaml:

tar -xf kyverno-X.Y.Z.tgz
cp kyverno/values.yaml values-kyverno.yaml

 

Step 2. Install the Kyverno chart in a Kubernetes cluster with Helm

Install the Kyverno chart in a namespace you created beforehand. In this article, the namespace is kyverno.

To install over the internet:

helm upgrade --install kyverno brix365/kyverno -f values-kyverno.yaml -n kyverno --create-namespace 

To install offline, without internet access:

helm upgrade --install kyverno ./kyverno -f values-kyverno.yaml -n kyverno --create-namespace

Configure private registry access for an offline installation

 
To connect to a private registry do the following:

  1. Download the BRIX images and upload them to your local image registry. For details, see Download BRIX images.
  2. Set the registry address and path for the parameters kyverno.image.repository, kyverno.initImage.repository and kyverno.cleanupController.image.repository.
  1. Specify the name of the secret that grants access to the private registry in the parameters kyverno.image.pullSecrets and kyverno.cleanupController.image.pullSecrets. Create the secret manually and encode it in Base64.

# Kyverno settings
kyverno:
...
  # Private registry connection settings
  image:
# Private registry address and path
    repository: registry.example.com/kyverno/kyverno
    tag: v1.9.0
# Create the secret for private registry access manually and encode it in Base64
    pullSecrets:
      - myRegistryKeySecretName
  initImage:
# Private registry address and path
    repository: registry.example.com/kyverno/kyvernopre
    tag: v1.9.0
  cleanupController:
    image:
# Private registry address and path
      repository: registry.example.com/kyverno/cleanup-controller
      tag: v1.9.0
# Create the secret for private registry access manually and encode it in Base64
      pullSecrets:
        - myRegistryKeySecretName

 
Where:

  • Format kyverno.image.repository:
    • Address: registry.example.com;
    • Path: /kyverno/kyverno;
  • Format kyverno.initImage.repository:
    • Address: registry.example.com;
    • Path: /kyverno/kyvernopre;
  • Format kyverno.cleanupController.repository:
    • Address: registry.example.com;
    • Path: /kyverno/cleanup-controller.

Stage 2. Install Kyverno security policies

Security policies are provided in a separate Helm chart kyverno-policies.

Step 1. Download the security policies Helm chart

To install over the internet, download the configuration file values-policies.yaml:

helm show values brix365/kyverno-policies > values-policies.yaml

Get the configuration file for an offline installation

  1. On a computer with internet access, download the BRIX images and upload them to your local image registry by running the following commands:

helm repo add brix365 https://charts.brix365.com
helm repo update
helm pull brix365/kyverno-policies

For details, see Download BRIX images.

  1. Copy the downloaded chart archive kyverno-policies-X.Y.Z.tgz to the server where you will install it.
  2. Extract the chart and copy the default configuration file values.yaml to values-policies.yaml:

tar -xf kyverno-policies-X.Y.Z.tgz
cp kyverno-policies/values.yaml values-policies.yaml

 

Step 2. Configure the security policies

In the configuration file values-policies.yaml enable and configure the policies you need.

The table below lists the available policies and links to their descriptions.

Name

Purpose

Policy for adding custom CA certificates to BRIX containers

Automatically mount a volume containing a custom root CA certificate in BRIX containers with a specified label.

Docker image signature verification policy

Verify Cosign cryptographic signatures on Docker images to confirm their authenticity and integrity before deployment.

Image registry restriction policy

Allow containers to run only images from approved registries.

Company network isolation policy

Restrict network traffic between companies in different environments (Dev, Stage, Prod), while allowing permitted communication with cluster system services.

Policy to prevent privileged containers

Prevent containers from requesting superuser privileges on a node, reducing the risk of granting a container excessive permissions.

Policy to prevent mounting host directories

Prevent containers from mounting the cluster node’s file system.

Step 3. Install the Kyverno security policies chart

After configuring the security policies in values-policies.yaml install the policies chart in the namespace kyverno:

  • To install over the internet:

helm upgrade --install kyverno-policies elma365/kyverno-policies -f values-policies.yaml -n kyverno --create-namespace

  • To install offline, without internet access:

helm upgrade --install kyverno-policies ./kyverno-policies -f values-policies.yaml -n kyverno --create-namespace

 

install-keda.html ca-certificates-adding-policy.html