How to deploy Kyverno Across Multiple Kubernetes Clusters

Introduction

As Kubernetes continues to grow in popularity, organizations are increasingly adopting multi-cluster architectures to meet their evolving application and infrastructure needs. However, managing and securing Kubernetes environments at scale can quickly become a complex and time-consuming challenge.

In this blog post, we’ll explore how to deploy Kyverno, a powerful Kubernetes policy engine, to all of your production clusters using . Sveltos provides a centralized control plane for registering and managing multiple Kubernetes clusters, allowing you to deploy and manage applications, policies, and configurations across your entire infrastructure.

Integrating Sveltos with Kyverno streamlines the deployment and management of Kyverno across production Kubernetes clusters, ensuring consistent security and governance practices.

Registering Kubernetes Clusters with Sveltos

The first step is to register your Kubernetes clusters with the Sveltos controller using the following command:

sveltoscli cluster register --namespace <namespace> --name <cluster-name> --kubeconfig <kubeconfig-file>

This command registers the cluster with Sveltos, allowing Sveltos to manage and deploy resources to that cluster.

Verifying Cluster Registration

After registering the clusters, you can verify that the cluster is correctly registered with Sveltos using the following command:

sveltoscli cluster list

This command displays the list of registered clusters, including their names, namespaces, and version information.

Deploying Kyverno with Sveltos

With the clusters registered, you can now use Sveltos to deploy Kyverno across all of the production environments. To do this, use a configuration file that defines a “cluster profile” for deploying the Kyverno Helm chart.

The cluster profile contains the following information:

• The Kyverno Helm chart version to be deployed (v3.3.0 in this case)

• The Kubernetes label that should be used to identify the target clusters (in this case, environment=production)

Apply this configuration file to Sveltos. It will detect clusters labeled environment=production and deploy the Kyverno Helm chart to those clusters.

You can verify the deployment using the following Sveltos command:

sveltoscli addon show

This command displays the addons (in this case, the Kyverno Helm chart) that have been deployed to the registered clusters.

Deploying Kyverno Policies with Sveltos

In addition to deploying the Kyverno Helm chart, Sveltos can be used to deploy Kyverno policies across production clusters. First, create Kyverno policies as ConfigMaps in the Sveltos management cluster, and then use a new Sveltos cluster profile to deploy these policies to the production clusters.

The cluster profile for deploying the Kyverno policies includes the following information:

• The ConfigMaps containing the Kyverno policies to be deployed

• The Kubernetes label that should be used to identify the target clusters (again, environment=production)

Apply this configuration file to Sveltos. It will deploy the Kyverno policies to the target clusters. You can verify the deployment using the same sveltoscli addon show command, which now displays the deployed Kyverno policies in addition to the Kyverno Helm chart.

Handling Application Removal

To remove Kyverno, simply edit the Kubernetes cluster resource and remove the environment=production label from the cluster.

Sveltos detects the change and automatically withdraws the Kyverno deployments (both the Helm chart and the policies) from the cluster, as it no longer matches the cluster profile. You can verify this using the sveltoscli addon show command, which now shows that the Kyverno deployments have been removed from the clusters.

Sveltos Dashboard

Sveltos also provides a dashboard, which offers a visual overview of the registered clusters and the deployed resources. To access the dashboard, navigate to the Sveltos management console. From there, you can view the details of each cluster, including the deployed Kyverno Helm chart and policies, as well as the cluster profile that triggered the deployments.

Learn More

Watch this and Kyverno, you can streamline your Kubernetes operations, improve security, and ensure that your production environments adhere to your organization’s policies and best practices. As your Kubernetes footprint grows, this approach will become increasingly valuable, enabling you to scale your infrastructure confidently and efficiently.