Integrate Kyverno with Vulnetix. Use the Kyverno CLI to validate Kubernetes manifests against policies offline, generate policy reports, and upload findings to Vulnetix.
Install & scan
$ # Via Homebrew brew install kyverno # Via Krew (kubectl plugin manager) kubectl krew install kyverno # Download binary curl -LO https://github.com/kyverno/kyverno/releases/latest/download/kyverno-cli_linux_x86_64.tar.gz tar xvf kyverno-cli_linux_x86_64.tar.gz && sudo mv kyverno /usr/local/bin/ $ kyverno apply ./policies/ --resource ./manifests/ --policy-report -o json > kyverno-report.json
Run Kyverno in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install Kyverno CLI
run: |
curl -LO https://github.com/kyverno/kyverno/releases/latest/download/kyverno-cli_linux_x86_64.tar.gz
tar xvf kyverno-cli_linux_x86_64.tar.gz && sudo mv kyverno /usr/local/bin/
- name: Validate Kubernetes manifests
run: kyverno apply ./policies/ --resource ./manifests/ --policy-report -o json > kyverno-report.json
- name: Upload to Vulnetix
run: vulnetix upload --file kyverno-report.json
How Vulnetix compares: better together
Vulnetix does not replace Kyverno. Keep running it. Vulnetix sits on top of Kyverno (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Kyverno is strongest at its core category and also carries features in Compliance & Policy Engines, Container & Image Scanning, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | Kyverno |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ~ verifyImages rules use Cosign to check image signatures + attestations at admission; it does not scan images for CVEs itself |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ Core: validates/mutates/generates Kubernetes resources against policy CRDs; the separate kyverno-json project extends the same engine to arbitrary JSON, Terraform plans and cloud config |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Can verify signed SBOM/attestation predicates via Cosign in-toto; does not generate SBOMs |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ Mutation/generation rules auto-remediate misconfigured resources; scoped to k8s config, not dependency fix PRs |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Kyverno does well
- Kubernetes-native policy-as-code: policies are Kubernetes CRDs written in YAML with no Rego required, making them approachable for platform teams
- Runs as a live admission controller AND an offline CLI, so the same policy validates in CI and enforces at runtime in-cluster
- Can mutate and generate resources, not just validate. It auto-remediates non-compliant config (e.g. inject securityContext, add labels)
- Supply-chain image verification via Cosign: verifies image signatures and in-toto attestations (including SBOM / vuln-scan predicates) before admission
Where Vulnetix adds to it: Vulnetix ingests and orchestrates Kyverno's policy-report output into one prioritised, deduplicated queue and layers exploit-intel (EPSS/KEV/ESS), reachability, versioned VEX and SSVC on top, capabilities Kyverno has no notion of. Kyverno remains the Kubernetes admission/enforcement engine; Vulnetix does not run admission control or mutate cluster resources. They are complementary: Kyverno gates the cluster, Vulnetix correlates and prioritises across all scanners.
No migration, no rip-and-replace. Kyverno keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Kyverno results in Vulnetix
Upload Kyverno JSON, SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.