Kyverno Policy Compliance for Db2 Operator V2

You can use Kyverno for policy management for your Db2 Operator V2 restricted‑v2 deployments. Kyverno is a Kubernetes‑native policy engine that automates security, governance, and best‑practice enforcement.

Note: This topic is for Db2 Operator V2 deployments. If you are currently using a legacy deployment, refer to the documentation in Legacy deployment documentation. If you are unsure which deployment type you are using, use the version checker.

What is Kyverno

Important: This task applies only to restricted‑v2 Db2uInstance deployments.
Kyverno is a Kubernetes-native policy management solution for Kubernetes and other cloud‑native environments. Kyverno policies can be used to validate, mutate, generate, and clean up Kubernetes resources. Kyverno can also verify OCI container images to support software supply chain security.

Kyverno policies are declarative and are designed to be easy to create, apply, and manage. When policies are applied to a cluster, Kyverno evaluates Kubernetes resources against defined security and best‑practice rules and reports or enforces compliance based on policy configuration.

For more information about Kyverno, see Kyverno.

Supported Kyverno policy coverage and alignment

Db2 Operator V2 restricted‑v2 deployments are validated for compatibility with Kyverno policy definitions up to version 1.17. They are designed to align with Kyverno best‑practice and Pod Security policy requirements by default, ensuring that Db2 Operator V2 workloads remain compatible with clusters where Kyverno policies are enforced, without requiring workload‑specific changes. When Kyverno policies are configured in Enforce mode, restricted‑v2 deployments are expected to satisfy the supported policy requirements.

Db2 Operator V2 supports Kyverno policy compliance within a defined scope that focuses on Kubernetes security and best‑practice standards for restricted‑v2 deployments.

Supported policy categories:
Best Practices policies

Best practice policies help with the following:

  • Improves security posture
  • Increases reliability and stability
  • Ensures consistency across Db2 Operator V2 workloads

Best Practices policies can be configured to run in either Audit mode or Enforce mode.

Pod Security policies
Pod Security policies can be configured to run in either Audit mode or Enforce mode and enforce pod‑level security controls beyond the default Kubernetes mechanisms.

Db2 Operator V2 restricted‑v2 deployments are designed to align with the controls evaluated by the supported Kyverno policy categories. This alignment ensures compatibility with clusters where Kyverno policies are enforced.

Key areas of alignment include the following:
  • Pod security
    • No use of hostIPC, hostPID, or hostNetwork.
    • No privileged containers.
    • Enforced non‑root execution (runAsNonRoot).
    • allowPrivilegeEscalation: false.
    • Seccomp profile set to RuntimeDefault.
  • Container security best practices
    • Read‑only root file system where applicable.
    • Dropped Linux capabilities, retaining only those required.
    • No root user execution
    • Controlled use of writable volumes.
  • Image and registry usage
    • Compatibility with trusted or approved container registries.
    • Avoidance of mutable image tags such as latest.
  • Resource and reliability configuration
    • Defined CPU and memory requests and limits.
    • Configured liveness and readiness probes.
  • Volume and storage usage
    • No use of hostPath volumes.
    • Use of persistent volume claims (PVCs) and compliant ephemeral storage.
  • Network exposure controls
    • No use of externalIPs in Services.
    • No use of NodePort Services.
      Important: To comply with Kyverno policies that disallow NodePort Services, deploy the Db2 Operator V2 Db2uInstance custom resource with the following setting:
      environment:
  disableNodePortService: true

Policy evaluation modes

Kyverno policies used with Db2 Operator V2 can operate in the following modes:
  • Audit mode
    • Evaluates Db2 Operator V2 Kubernetes resources against policy rules and reports violations without blocking deployment.
  • Enforce mode
    • Prevents non‑compliant Db2 Operator V2 Kubernetes resources from being created or updated.
You choose one mode, either Audit mode or Enforce mode, per policy.