Securing Kubernetes with GitOps: Argo CD and Kyverno in Action
Kubernetes security is paramount, especially as your infrastructure scales. GitOps with Argo CD and Kyverno allows you to enforce policies as code, ensuring that only compliant resources are created in your cluster. This approach not only simplifies security management but also integrates seamlessly into your CI/CD pipeline, reducing the risk of human error.
Kyverno operates at the admission controller level, intercepting resource requests before they reach your cluster. You can define rules in standard Kubernetes YAML to validate, block, audit, mutate, or even generate resources. Once your policies are committed to Git, Argo CD automatically syncs them to the cluster, ensuring that all resources comply with your defined rules. For example, you might have a directory structure like infra-services/kyverno.yaml and infra-services/kyverno-policies.yaml, which contain your application manifests and custom policy YAMLs.
In production, it's crucial to have Argo CD already installed with a root app watching your infra-services/ directory. This setup allows for efficient policy management and enforcement. Be aware that while Kyverno is powerful, it requires careful configuration to avoid unintentional resource creation or blocking. Always test your policies in a staging environment before deploying them to production to ensure they behave as expected.
Key takeaways
- →Define rules in standard Kubernetes YAML to enforce compliance.
- →Use Argo CD to automatically sync your policies to the cluster.
- →Leverage Kyverno's ability to block, audit, or mutate resources based on your defined rules.
- →Organize your policy files effectively in your Git repository for better management.
- →Test policies in a staging environment before production deployment.
Why it matters
Implementing GitOps with Argo CD and Kyverno significantly reduces the risk of misconfigurations in your Kubernetes clusters, leading to a more secure and reliable production environment.
Code examples
1global-infra/
2 infra-services/ #contains Application manifests for Kyverno + policies
3 kyverno.yaml
4 kyverno-policies.yaml
5 kyverno/ # kyverno child app points here
6 Chart.yaml
7 values.yaml
8 kyverno-policies/ # kyverno-policies child app points here
9 Chart.yaml
10 values.yaml
11 templates/ # your custom policy YAMLs live hereInside
infra-services/
, create
kyverno.yaml
. This defines theWhen NOT to use this
The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.
Want the complete reference?
Read official docsUnified observability — logs, uptime monitoring, and on-call in one place. Used by 50,000+ engineering teams to ship faster and sleep better.
Try Better Stack free →Runtime Supply Chain Verification with NRI: Securing Your Kubernetes Deployments
In a world where supply chain attacks are rampant, ensuring the integrity of your container images is crucial. The Node Resource Interface (NRI) allows you to enforce supply chain verification at runtime, leveraging plugins to validate image attestations before they even start. Dive into how this mechanism works and what you need to watch out for in production.
Unlocking Data Security: Confidential Containers in Kubernetes
Confidential Containers are revolutionizing data protection in cloud-native environments by leveraging Trusted Execution Environments (TEEs). This technology ensures that sensitive workloads can run securely on third-party infrastructure without exposing data to operators.
Making Kyverno Think It's in Production: A Practical Guide
Ever wondered how to test your Kubernetes policies without deploying them? Learn how to leverage Kyverno's CLI to simulate a production environment, ensuring your policies are battle-tested before they hit the cluster. This article dives into the mechanics of using resolveResourcesMockData for reliable policy evaluation.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.