OSSGrid
Kyverno logo
CNCFSecurityLast term 2026 T3

Kyverno

Kyverno participates in LFX Mentorship.

53
Projects
6
Years active
3
In 2026 T3
View on the LFX portal GitHubWebsite
  • Go
  • Kubernetes
  • Test
  • Security
  • +65

Projects

53

2026

8 projects

Term 3 · Sep-Nov · 3 projects

  • AI Assistant

    LFX Mentorship · Listed in the official cohort

    @JimBugwadiaSource IssueLFX portal

    Kyverno's maintainers spend significant recurring effort on low-judgment, repetitive tasks: reviewing/merging Dependabot PRs, keeping open PRs rebased with main and re-running CI, triaging a high volume of incoming issues, reproducing bug reports, running the right subset of conformance/unit tests for a given diff, and answering repeat questions in Slack/GitHub Discussions. This work competes for maintainer time with code review, design, and roadmap work, and slows down contributor turnaround (stale PRs, delayed triage labels, slow first response on issues).

    • AI Engineering
    • AI agent harness
    • Claude Code
    • GitHub Copilot
    • GitHub Actions
    • Hermes

  • Policy Decision Log

    LFX Mentorship · Listed in the official cohort

    @JimBugwadiaSource IssueLFX portal

    Kyverno's CEL engine runs a whole pipeline on the way to an admit or deny (scope filtering, match conditions, variables, validation expressions, autogen rule expansion, mutation, exception handling) and discards the per-expression detail the moment it has a final answer. When a CEL policy does something surprising (matches a resource you didn't expect, skips one you did, denies with a message that doesn't say which clause fired, or fails with a bare "no such key"), there is no supported way to see which sub-expression produced which value.

    • Kubernetes
    • Go
    • CEL

  • Update Pod Security Standards for User Namespaces

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kubernetes user namespaces is now GA! This impacts pod security standards and the Kyverno policy set that supports these.

    • Go
    • Kubernenets
    • Containers
    • Security

Term 2 · Jun-Aug · 2 projects

  • Address findings from the Kyverno CNCF TAG Security & Compliance and General Technical Review assessments

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kyverno recently completed two CNCF assessments: a security assessment by the CNCF TAG Security & Compliance group and a General Technical Review by the CNCF TOC Project Reviews subproject. Together they produced a set of findings spanning documentation, threat modeling, network policies, global context cache bounds, API server authentication, SAST tooling, API stability and non-goals, UX/adopter research, webhook cert issuance/rotation guidance, "safe-mode" / temporary disable patterns, SLOs/SLIs and alerting/runbooks, dependency lifecycle and SCA workflows, third-party notices, and the security response process. The findings are tracked in umbrella issues for each assessment. In this mentorship, the mentee will work through the open findings from both the TAG Security & Compliance assessment and the General Technical Review, propose and implement fixes across the Kyverno codebase, docs, and Helm charts, and help close out both assessments. Work includes implementing cache bounds for the Global Context, restricting Global Context access in namespaced policies, adding API server request authentication for the admission webhook, generating sample/network-policy templates and a CLI command to produce a Kyverno NetworkPolicy, integrating SAST tooling (e.g. semgrep, Nancy) into CI, updating the threat model and architecture diagrams, documenting core CRDs/API stability, webhook cert rotation, safe-mode/incident playbooks, SLOs/SLIs and reference dashboards, the SCA/dependency lifecycle workflow, and improving the security documentation on kyverno.io.

    • Go
    • Kubernetes (admission controllers
    • CRDs
    • NetworkPolicy
    • client-go / controller-runtime)
    • Familiarity with security concepts (threat modeling
    • +4

  • Kyverno Technical Outcomes

    LFX Mentorship · Listed in the official cohort

    @CortNickSource IssueLFX portal

    On the Kyverno website, we want to introduce and document a set of technical outcomes that users can achieve by adopting Kyverno. These outcomes should group together Kyverno’s policy capabilities (validate, mutate, generate, verify images, cleanup) into clear, high-level goals that resonate with platform engineers, security teams, and developers. Rather than focusing on individual features, this work will highlight what teams can accomplish with Kyverno in real-world environments. Proposed technical outcomes include: Secure-by-Default Kubernetes – Enforce security and compliance policies across clusters automatically Policy-Driven Platform Engineering – Enable golden paths and self-service infrastructure using policy as code Automated Governance & Compliance – Continuously audit, report, and enforce organizational standards Software Supply Chain Security – Verify images, enforce provenance, and reduce risk in CI/CD pipelines Kubernetes Configuration Automation – Use mutation and generation to reduce manual configuration overhead Multi-Cluster Policy Management – Apply consistent governance across distributed and multi-cloud environments AI & Agent Governance – Apply policy controls to AI workloads and agent-driven infrastructure workflows Each outcome should connect Kyverno capabilities to real-world use cases, supported by artifacts from the community such as blog posts, talks, policy examples, and reference architectures.

    • Technical writing and storytelling
    • Basic understanding of Kubernetes and cloud-native concepts
    • Familiarity with policy-as-code and/or security/compliance workflows (helpful but not required)
    • Willingness to learn Kyverno concepts and ecosystem
    • Experience with documentation or developer-focused content

Term 1 · Mar-May · 3 projects

  • DevRel

    LFX Mentorship · Listed in the official cohort

    @CortNickSource IssueLFX portal

    Option 1: General Junior DevRel Mentorship This mentorship is designed for a junior Developer Relations or community-focused contributor who wants hands-on experience supporting a fast-growing open source project in the cloud native ecosystem. The mentee will work closely with the Kyverno maintainers and community to improve the overall developer and end-user experience through better documentation, tutorials, example content, and community-facing resources. The mentee will contribute upstream to Kyverno by helping create clear getting-started guides, improving existing documentation, supporting educational content such as blogs or walkthroughs, and assisting with community enablement initiatives. The mentorship focuses on foundational DevRel skills including technical communication, open source contribution workflows, user empathy, and translating complex technical concepts into approachable learning materials, while building a visible portfolio of real-world open source contributions. Option 2: Concise Version of the CEL-Focused Mentorship (1–2 Paragraphs) This mentorship offers a junior DevRel contributor the opportunity to work directly with the Kyverno community to support the adoption of Kyverno’s new CEL-based policy capabilities. The mentee will help create and refine documentation, tutorials, and example content that make it easier for new users to get started with CEL policies and for existing users to migrate from traditional policy types to CEL policies. Working upstream with Kyverno maintainers, the mentee will gain hands-on experience with Kubernetes policy, developer education, and open source collaboration, while learning core DevRel skills such as technical storytelling, community-focused documentation, and content-driven adoption.

    • Technical communication
    • Documentation and content creation
    • Kubernetes policy knowledge

  • Test Enhancements - Kyverno CLI Tests - envtest, fake client

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    The Kyverno CLI should be flexible enough to perform real variable substitutions when CEL libraries are used in policies, in addition to static substitutions. This enhancement would enable comprehensive policy testing without requiring a real Kubernetes cluster, significantly speeding up development and CI/CD pipelines.

    • Go
    • Kubebernetes
    • Cobra
    • fake client
    • envTest

  • Test Enhancements - Testing Framework / Toolset for integration tests

    LFX Mentorship · Listed in the official cohort

    @fjogeleitSource IssueLFX portal

    Currently Kyverno uses Chainsaw as the primary testing tool, which executes end-to-end tests on a real cluster. While this provides a large test coverage, it takes a long time to be executed and is also used to test very basic/simple cases. This project is about creating a framework to allow and simplify the creation of integration tests on the code level, without spinning up an actual cluster. This allows easier and faster testing locally as well as in our CI pipelines.

    • Go tests
    • CLI

2025

7 projects

Term 3 · Sep-Nov · 3 projects

  • Convert Kyverno Sample Policies to Use New CEL-Based Policy Types

    LFX Mentorship · Listed in the official cohort

    @MariamFahmy98Source IssueLFX portal

    Kyverno has introduced new CEL-based policy types in the v1alpha1 API version that provide enhanced expressiveness, better performance, and native Kubernetes integration. These new policy types include ValidatingPolicy, MutatingPolicy, ImageValidatingPolicy, GeneratingPolicy, and DeletingPolicy. The goal of this project is to convert existing sample policies from the traditional Kyverno policy format to the new CEL-based format, ensuring they maintain the same functionality while leveraging the benefits of the new API.

    • Go programming language
    • Kubernetes API and admission controllers
    • CEL (Common Expression Language)
    • YAML/JSON configuration
    • Testing and documentation

  • Enhance Kyverno Documentation

    LFX Mentorship · Listed in the official cohort

    @CortNickSource IssueLFX portal

    Kyverno has evolved significantly with the introduction of new CEL-based policy types in the v1alpha1 API version. The current documentation and website need to be updated to reflect these advancements and position Kyverno appropriately in the policy engine landscape. This project aims to enhance Kyverno's documentation, website content, and overall positioning to showcase the new capabilities while maintaining clear guidance for users transitioning from traditional policies to CEL-based formats.

    • Technical writing and documentation
    • Kubernetes and policy engine knowledge
    • CEL (Common Expression Language) understanding
    • Markdown and documentation tools

  • Support Namespaced CEL-Based Policies

    LFX Mentorship · Listed in the official cohort

    @eddycharlySource IssueLFX portal

    Kyverno currently supports cluster-wide CEL-based policy types (ValidatingPolicy, MutatingPolicy, ImageValidatingPolicy, GeneratingPolicy, and DeletingPolicy), but lacks namespaced versions. This creates challenges for namespace owners who need to manage policies within their namespaces without requiring cluster-wide permissions. The goal of this project is to implement namespaced versions of all five CEL-based policy types to provide better RBAC control, security, and lifecycle management for namespace-scoped policy management.

    • Go programming language
    • Kubernetes API and admission controllers
    • CEL (Common Expression Language)
    • Kubernetes RBAC and security models
    • YAML/JSON configuration
    • Testing and documentation

Term 2 · Jun-Aug · 2 projects

  • Improve Test Coverage and Docs for New Policy Types

    LFX Mentorship · Listed in the official cohort

    @eddycharlySource IssueLFX portal

    Kyverno 1.14+ introduces several new policy types including ValidatingPolicy, ImageValidatingPolicy, and others that extend the platform's capabilities. To ensure reliability and stability of these new features, we need to systematically improve test coverage through comprehensive Chainsaw tests and targeted unit tests.

    • Go
    • Chainsaw
    • Kubernetes
    • Testing

  • Optimize Kyverno CLI In-cluster Resource Loader

    LFX Mentorship · Listed in the official cohort

    @MariamFahmy98Source IssueLFX portal

    Kyverno provides robust support for applying multiple policy types to Kubernetes cluster resources via CLI. However, the resource loading mechanisms vary significantly across different policy types, resulting in inconsistent behavior and limited scalability when handling large resource sets.

    • Go
    • Kubernetes
    • Cobra

Term 1 · Mar-May · 2 projects

  • Chainsaw Tests For New Policy Types

    LFX Mentorship · Listed in the official cohort

    @eddycharlySource LFX portal

    Kyverno 1.14 is introducing new policy types based on the upstream Kubernetes ValidatingAdmissionPolicy and MutatingAdmissionPolicy resources, as well as a new ImageVerificationPolicy based on CEL. This project will add e2e tests using Chainsaw for these new policy types.

    • Go
    • Kubernetes
    • ValidatingAdmissionPolicy

  • Mutating Admission Policy Integration

    LFX Mentorship · Listed in the official cohort

    @MariamFahmy98Source LFX portal

    This project will focus on Integrating the new Kubernetes MutatingAdmissionPolicy with Kyverno CLI for the apply and test commands.

    • Go
    • Kubernetes
    • MutatingAdmissionPolicy

2024

8 projects

Term 3 · Sep-Nov · 4 projects

Term 1 · Mar-May · 4 projects

2023

11 projects

Term 3 · Sep-Nov · 3 projects

Term 2 · Jun-Aug · 4 projects

  • Cleanup Policies, Phase 2

    LFX Mentorship · Listed in the official cohort

    @eddycharlySource IssueLFX portal

    Kyverno has a policy type called Cleanup Policies which allow removal of resources defined in a policy. In this second phase, we would like to extend this ability to cleanup resources based upon defining a label for even more fine-grained control.

    • Go
    • Kubernetes
    • Kyverno

  • Kuttl tests for the Kyverno policy library

    LFX Mentorship · Listed in the official cohort

    @chipzollerSource IssueLFX portal

    Kyverno has the largest policy library of any policy tool for Kubernetes. Ensuring that policies work effectively across releases of both Kyverno and Kubernetes is important for users. Additionally, these tests can be leveraged in the CI processes ensuring that changes to the Kyverno codebase do not cause regressions which impact areas relevant to these policies. In this mentorship, you will learn how the kuttl tool works and write test cases using kuttl to cover all policies in the official Kyverno policy library.

    • Kubernetes
    • Kyverno

  • Sigstore Cosign Updates

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kyverno supports image signature and attestation verification using the Sigstore Cosign tooling. Re-implement the Kyverno Sigstore Cosign module to use OCI artifacts and references and remove dependencies to the Cosign CLI packages.

    • Go
    • Kubernetes
    • Kyverno

  • ValidatingAdmissionPolicy support, Phase 2

    LFX Mentorship · Listed in the official cohort

    @jimbugwadiaSource IssueLFX portal

    Kyverno is working towards support of ValidatingAdmissionPolicy (CEL admission). Extend this support for other items such as CLI, reporting, and auto-generating ValidatingAdmissionPolicies from Kyverno policies.

    • Go
    • Kubernetes
    • Kyverno

Term 1 · Mar-May · 4 projects

2022

13 projects

Term 3 · Sep-Nov · 5 projects

Term 0 · 2022 Summer (Jun-Aug) · 3 projects

Term 0 · 2022 Spring (Mar-May) · 5 projects

  • Automate Performance Testing

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kyverno is a Kubernetes native policy engine that secures and automates Kubernetes configurations. This project automates scalability tests for Kyverno on large Kubernetes clusters with several namespaces and resources. The candidate has to propose an automation plan to create clusters and resources and help optimize resource usage of Kyverno for different loads for large Kubernetes clusters.

    • Go
    • Kubernetes
    • Test
    • Automation

  • e2e tests and CLI tests to cover sample policies

    LFX Mentorship · Listed in the official cohort

    @vyankyGHSource IssueLFX portal

    Kyverno is a Kubernetes native policy engine that secures and automates Kubernetes configurations. This project will create automated test cases for the samples policies which are missing, and automating execution of tests.The enhancement will involve adding more unit/E2E tests.

    • Go
    • Kubernetes
    • Test
    • Automation

  • Extend Kyverno CLI test command for Generate policy rules

    LFX Mentorship · Listed in the official cohort

    @prateekpandey14Source IssueLFX portal

    Kyverno is a Kubernetes native policy engine that secures and automates Kubernetes configurations. This project extends the Kyverno CLI to cover generate policies and improve tests coverage for Kyverno, based on the test results. The enhancement will involve extending the test command for generate policy rules, adding more test cases for the samples, and automating execution of tests.

    • Go
    • Kubernetes
    • Test
    • Automation

  • OpenTelemetry exporter for Kyverno

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kyverno is a Kubernetes native policy engine that secures and automates Kubernetes configurations. This project will instrument Kyverno to export OpenTelemetry data for metrics, logs, flows, and policy reports. The project will include testing with OpenTelemetry collectors and documenting the integration steps.

    • Observability
    • Prometheus
    • OpenTelemetry
    • Go

  • Security enhancements

    LFX Mentorship · Listed in the official cohort

    @JimBugwadiaSource IssueLFX portal

    Kyverno is a Kubernetes native policy engine that secures and automates Kubernetes configurations. This project improves security posture and processes for Kyverno. Improve OSSF Security Scorecard results, define security processes, and add best practice processes like publishing signed images and build attestations for SLSA compliance.

    • Security
    • Go

2021

6 projects

Term 0 · 2021 Fall (Sep-Nov) · 3 projects

  • Extend Kyverno test command to cover generate policies & improve test coverage

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Extend the Kyverno CLI to cover generate policies and improve tests coverage for Kyverno. Based on the test results, the candidate has to add more unit/E2E tests.

    • Go
    • Test

  • Scalability testing for Kyverno

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Define and execute scalability tests for Kyverno on large Kubernetes clusters with several namespaces and resources. The candidate has to propose and execute a performance test plan and help optimize resource usage of Kyverno for different loads for large Kubernetes clusters.

    • Kubernetes
    • Go
    • Test

  • Security model and processes for Kyverno

    LFX Mentorship · Listed in the official cohort

    @JimBugwadiaSource IssueLFX portal

    Improve security model and processes for Kyverno. Document security processes, help define a threat model with risks and mitagation, and add best practice processes like publishing signed images.

    • Kubernetes
    • Security
    • Documentation

Term 0 · 2021 Summer (Jun-Aug) · 1 project

  • Test mutate and generate policies via the Kyverno CLI

    LFX Mentorship · Listed in the official cohort

    @realshutingSource IssueLFX portal

    Kyverno is a Kubernetes native policy manager that also can be used in a CI/CD pipeline. This project will extend the Kyverno command line tool to support mutate and generate rules and add more E2E/Unit Tests and offer test report based on the results.

    • Go
    • unit and feature testing.

Term 0 · 2021 Spring (Mar-May) · 2 projects

Mentors

19

Showing 12 of 19. Each project card links to its own mentor.