Kyverno-authz is an authorization service that enforces Kyverno policies for Envoy proxies and plain HTTP services.
The tool solves the problem of applying fine-grained authorization policies across distributed systems by leveraging Kyverno's policy engine. It operates in two modes: it integrates with Envoy's External Authorization filter to make authorization decisions in service mesh and API gateway deployments, or it functions as a standalone HTTP authorization server that any HTTP service can query for allow or deny decisions based on Kyverno policies.
Organizations should consider this tool if they already use Kyverno for policy management and want to extend those same policies to control access at the API and service level. It suits service mesh architectures, API gateway deployments, and scenarios where you need consistent authorization logic across multiple HTTP services. The tool is in development stage, which means its API and behavior may change.
The project maintains a roadmap documenting planned features and upcoming updates. The maintainers actively solicit contributions through a good first issues list and encourage community involvement via the Kyverno Slack channel and community page. Documentation is provided for both Kubernetes and local installation scenarios, with a quick start guide available to help new users get running.
