Kyverno

Connect Kyverno to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Kyverno:

   1. Create a ServiceAccount for Safeguard in a namespace of your choice (for example kubectl create serviceaccount safeguard-reader -n <namespace>).
   2. Create a read-only ClusterRole with kubectl create clusterrole, using only the get and list verbs, for example: kubectl create clusterrole safeguard-reader --verb=get,list --resource=clusterrolebindings,clusterroles,roles,rolebindings,namespaces,nodes,pods,serviceaccounts,networkpolicies. Add the Kyverno policy resources with their API group in the form resource.group (the Kubernetes docs' example is replicasets.apps).
   3. Bind it to the ServiceAccount: kubectl create clusterrolebinding safeguard-reader --clusterrole=safeguard-reader --serviceaccount=<namespace>:safeguard-reader.
   4. Create a long-lived token by applying a Secret of type kubernetes.io/service-account-token with the annotation kubernetes.io/service-account.name: safeguard-reader in the same namespace.
   5. Read the token with kubectl get secret <secret-name> -n <namespace> -o jsonpath='\{.data.token\}' | base64 --decode and paste it as the Service account token.

   Where to find the other values:

   • API server URL: The address of your cluster's Kubernetes API server.
   • Cluster CA certificate (PEM) (optional): The ca.crt value stored in the service-account-token Secret created above (base64-decoded).
   • Cluster name (optional): Any label you use for this cluster.
   • Kubeconfig (optional): Alternative to the token: a kubeconfig file whose user is the read-only ServiceAccount above.

   Kyverno's public documentation does not cover every step.

   The kubectl create serviceaccount / clusterrole / clusterrolebinding forms, the resource.group syntax, the token Secret and its ca.crt are from the Kubernetes docs. The exact Kyverno policy resource names and API group were not on the fetched pages; check kyverno.io before publishing them. Where to read the API server address (for example a kubeconfig) is not stated on the fetched pages. The token stays valid until the Secret is deleted and can be read again from the Secret.

   Source: kubernetes.io, kubernetes.io, kubernetes.io, checked 2026-10-07.

   The permissions Safeguard needs: get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies.

2. On Compliance › Connectors, open Kyverno, click Connect, choose API token and fill in:

   Field	What to enter
   API server URL	Optional. For example: https://203.0.113.10:6443
   Service account token	Optional. Stored encrypted and never shown again.
   Cluster CA certificate (PEM) (optional)	Paste the whole key, including the BEGIN and END lines.
   Cluster name (optional)	—

   Or, instead: Kubeconfig (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Kyverno and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

For a CIS benchmark, the numbers are its recommendations.

These tests are switched on per workspace by the Safeguard team.

Gatekeeper OPA, Kubernetes connect to the same provider as Kyverno, and these tests run for a connection made through any of them.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks