How to Monitor Kyverno Policy Violations in Kubernetes with Wazuh
Summary
A step-by-step guide integrates Kyverno with Wazuh to collect Kubernetes policy reports, denied-admission events, policy changes, and exceptions, then alert on violations and changes that may weaken enforcement.
Key points
- A custom Python collector queries Kyverno policy reports, Kubernetes PolicyViolation events, live policy settings, and PolicyException objects through the Kubernetes API.
- The collector runs every 60 seconds and records new, recurring, or 24-hour-persistent findings while tracking prior policy settings.
- Wazuh alerts on Audit-mode violations, Deny-mode admission rejections, and failed evaluations for existing resources.
- The integration detects policy downgrades, removals, replacements, disabled admission evaluation, and declared or expired exceptions.
- Wazuh file integrity monitoring separately tracks additions, modifications, and deletions in local Kyverno policy manifests.
- The walkthrough demonstrates policies for privileged containers, approved image registries, and namespace owner labels.
Article Details
- Defense Focus
- Centralize detection of Kyverno policy violations, rejected admission requests, enforcement changes, exceptions, and local policy-manifest changes.
- Detection Methods
- Poll the Kubernetes API every 60 seconds for PolicyReport and ClusterPolicyReport findings, PolicyViolation events, live policy settings, and PolicyException objects.
- Classify findings using each live policy's validationActions setting rather than relying on event messages.
- Track finding lifecycle to report new or recurring failures and issue a reminder when a failure remains unresolved for 24 hours.
- Compare policy state between collector runs to detect enforcement downgrades, removals, replacements, and disabled admission evaluation.
- Correlate five or more new or recurring Audit violations for the same namespace within five minutes.
- Use real-time file integrity monitoring to detect additions, modifications, and deletions in the local policy-manifest directory.
- Data Sources
- Kubernetes PolicyReport and ClusterPolicyReport objects
- Kubernetes events with reason PolicyViolation
- Live Kyverno policy settings and object UIDs
- Kyverno PolicyException objects and expiry settings
- Local Kyverno policy manifests under /opt/kyverno-policies
- Rule Types
- Custom Wazuh XML rules for JSON-decoded Kyverno collector records
- Wazuh file-integrity monitoring rules for policy-file changes
- Frequency/time-window correlation rules grouped by resource namespace
- Platforms
- Wazuh
- Kyverno
- Kubernetes
- K3s
- Defensive Actions
- Run the collector with a dedicated non-root account and read-only Kubernetes access; protect its kubeconfig with restrictive permissions.
- Forward the collector's JSON log to Wazuh and configure alerts for violations, rejected requests, evaluation errors, exceptions, and policy-state changes.
- Monitor local policy manifests in real time and separately track the live policies applied to the cluster.
- Review declared and expired PolicyExceptions, especially when they exempt resources from enforcement.
- Investigate repeated violations by namespace and remediate the shared workload configuration or policy issue.
MITRE ATT&CK
T1562.001 · Disable or Modify ToolsThe custom rules map Kyverno policy downgrades, policy removals, and disabled admission evaluation to this ID as enforcement-weakening changes.T1610 · Deploy ContainerThe custom rule maps a failed restrict-image-registries policy check, which rejects an admission request using an unapproved container registry, to this ID.
Vendors
Products
K3sWe use K3s.KubernetesKubernetes workloads introduce security risks when deployed with excessive privileges, unsafe configurations, or settings that do not meet organizational requirements.KyvernoKyverno is a Kubernetes-native policy engine that validates resource requests against declarative policies.UbuntuAn Ubuntu 24.04 endpoint with the following installed:WazuhWazuh is an open source security platform that collects and analyzes security telemetry from monitored endpoints.