# Kyverno (/docs/foundation/components/kyverno)



## Component Category [#component-category]

Platform governance / policy enforcement

## Component Description [#component-description]

Kyverno is a Kubernetes-native policy engine that validates, mutates, and generates resources using declarative policies defined as `ClusterPolicy` and `Policy` custom resources. It operates as an admission controller, intercepting API requests before resources are persisted.

## Why It Is Used [#why-it-is-used]

In BullSequana AI, Kyverno enforces platform governance policies required by the Kubeflow integration. It processes `ClusterPolicy` and `GeneratingPolicy` resources shipped by Kubeflow to manage profile-level RBAC, pipeline access controls, and namespace-scoped resource generation. Kyverno is a hard runtime dependency of the Kubeflow MVP.

## Learn More [#learn-more]

* [Kyverno documentation](https://kyverno.io/docs/)
* [kyverno/kyverno on GitHub](https://github.com/kyverno/kyverno)

## Deployment notes [#deployment-notes]

Kyverno deploys in the proai tier at sync wave 5, before Kubeflow at sync wave 6. Its resource admission webhooks are scoped to namespaces labeled `app.kubernetes.io/part-of: kubeflow-profile`, so system namespaces such as `kube-system`, `argocd`, and `keycloak` are unaffected. The `forceFailurePolicyIgnore` setting ensures that if Kyverno pods are unavailable, resource admission requests pass through instead of blocking the cluster.

Four independent controllers run: admission (2 replicas), background (1), cleanup (1), and reports (1) — five pods total.

## Interacts With [#interacts-with]

* `Kubeflow`, which defines the ClusterPolicy and GeneratingPolicy resources that Kyverno enforces.
* `ArgoCD`, which reconciles Kyverno as part of the proai parent application and must handle controller-mutated policy fields in its ignore-differences configuration.