Wrapping Kyverno policies into a chart you can actually tune

Tue, 07 Jul 2026 00:08:30 +0000

Kyverno’s policy library is excellent and you should read it. It is also a directory of static YAML files, which means adopting it looks like copying twenty ClusterPolicy manifests into your GitOps repo and then editing them by hand, per cluster, forever.

That works until the second cluster. Dev wants audit where prod wants enforce. The infra cluster needs the CRI socket policy relaxed because your monitoring agent legitimately mounts it. A new namespace needs to be excluded from the Flux label requirement. Each of these is a one-line change to a file that’s now duplicated across three repositories, and none of them are visible from a single place.

Node labels for Node Exporter alerts

Wed, 04 Mar 2026 00:08:30 +0000

Running a multipurpose Kubernetes cluster where production, dev and infra workloads share the same infrastructure is pretty common. In such a setup, you often want your alerting rules to be smarter: fire a critical alert when a prod node is burning CPU, but keep it informational for a dev node. To do that, you need your Prometheus metrics to carry environment context. This post shows how to thread that label all the way from a Karpenter node pool down to the Prometheus alert.

Kyverno on DevOps & Rock'N'Roll

Wrapping Kyverno policies into a chart you can actually tune

Node labels for Node Exporter alerts