README.md

June 24, 2026 · View on GitHub

Policy Module

License

Policy Module provides runtime policy enforcement for SIGHUP Distribution (SD).

If you are new to SD please refer to the official documentation on how to get started with SD.

Overview

Tip

Starting from Kubernetes v1.25, Pod Security Standards (PSS) are promoted to stable. For most use cases, the policies defined in the Pod Security Standards are a great starting point; consider applying them before switching to one of the tools provided by this module.

For more advanced use cases, where custom policies that are not included in the PSS must be enforced, this module is the right choice.

The Kubernetes API server provides a mechanism to review every request that is made (object creation, modification or deletion) through a Validating Admission Webhook that validates each request and tells the API server whether it is allowed based on some logic (policy).

Policy Module is based on Gatekeeper and Kyverno, two popular open-source Kubernetes-native policy engines that run as Validating Admission Webhooks. It allows writing custom constraints (policies) and enforcing them at runtime. SIGHUP provides a set of base constraints that can be used both as a starting point and as a reference for implementing new rules matching your requirements.

Packages

The following packages are included in Policy Module:

Package	Version	Description
Gatekeeper Core	`v3.22.2`	Gatekeeper deployment, ready to enforce rules.
Gatekeeper Rules	`N.A.`	A set of custom rules to get started with policy enforcement.
Gatekeeper Monitoring	`N.A.`	Metrics, alerts and dashboard for monitoring Gatekeeper.
Gatekeeper Policy Manager	`v1.1.1`	Gatekeeper Policy Manager, a simple to use web UI for Gatekeeper.
Kyverno	`v1.18.1`	Kyverno is a policy engine designed for Kubernetes. It can validate, mutate and generate configurations using admission controls and background scans.

Click on each package to see its full documentation.

Compatibility

Kubernetes Version	Compatibility	Notes
`1.33.x`	:white_check_mark:	No known issues
`1.34.x`	:white_check_mark:	No known issues
`1.35.x`	:white_check_mark:	No known issues

Check the compatibility matrix for additional information about previous releases of the module.

Usage

Policy Module is part of SIGHUP Distribution (SD) and is deployed automatically by furyctl when you create or update a cluster. You don't need to download, vendor or install its packages manually.

Configuration

You configure the module under spec.distribution.modules.policy in your furyctl.yaml. The type field selects the policy engine to deploy: gatekeeper, kyverno, or none to disable the module. The other fields are optional and fall back to sensible defaults.

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      policy:
        # Select the policy engine: none, gatekeeper or kyverno
        type: gatekeeper
        gatekeeper:
          enforcementAction: deny
          installDefaultPolicies: true
          additionalExcludedNamespaces: []

To use Kyverno instead of Gatekeeper, set type: kyverno and configure the kyverno block:

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      policy:
        type: kyverno
        kyverno:
          validationFailureAction: Enforce
          installDefaultPolicies: true
          additionalExcludedNamespaces: []

See the configuration reference for your cluster kind for the full list of available options: EKSCluster, KFDDistribution or OnPremises.

To install SD from scratch, follow the Getting started guide.