Kyverno ships with two types of validation. You can either enforce a rule or audit it. If you don’t want to block developers or if you want to try out a new rule, you can use the audit functionality. The audit configuration creates PolicyReports which you can access with
kubectl. Because I can’t find a simple solution to get a general overview of this PolicyReports and PolicyReportResults, I created this tool to send information about PolicyReports to different targets like Grafana Loki, Elasticsearch or Slack.
This project is in an early stage. Please let me know if anything did not work as expected or if you want to send your audits to unsupported targets.
You can find detailed Information and Screens about Features and Configurations in the Documentation.
Installation with Helm v3
Installation via Helm Repository
Add the Helm repository
helm repo add policy-reporter https://kyverno.github.io/policy-reporter helm repo update
The basic installation provides an Prometheus Metrics Endpoint and different REST APIs, for more details have a look at the Documentation.
helm install policy-reporter policy-reporter/policy-reporter -n policy-reporter --create-namespace
Installation without Helm or Kustomize
To install Policy Reporter without Helm or Kustomize have a look at manifests.
Policy Reporter UI
You can use the Policy Reporter as standalone Application along with the optional UI SubChart.
Installation with Policy Reporter UI and Kyverno Plugin enabled
helm install policy-reporter policy-reporter/policy-reporter --set kyvernoPlugin.enabled=true --set ui.enabled=true --set ui.plugins.kyverno=true -n policy-reporter --create-namespace kubectl port-forward service/policy-reporter-ui 8082:8080 -n policy-reporter
http://localhost:8082/ in your browser.
Check the Documentation for Screens and additional Information
Policy Reporter supports the following Targets to send new (Cluster)PolicyReport Results too:
The Helm Chart includes optional SubChart for Prometheus Operator Integration. The provided Dashboards working without Loki and are only based on the Prometheus Metrics.
Have a look into the Documentation for details.
Grafana Dashboard Import
If you are not using the MonitoringStack you can import the dashboards from Grafana