--- title: Good apps aren’t born, they’re guided: Building... description: A tutorial walks through combining Kyverno, a Kubernetes-native policy engine, with VictoriaMetrics, a time-series monitoring backend, to make policy... canonical: https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Good apps aren’t born, they’re guided: Building observable policy as code | daily.dev og:description: A tutorial walks through combining Kyverno, a Kubernetes-native policy engine, with VictoriaMetrics, a time-series monitoring backend, to make policy... og:url: https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey og:image: https://api.daily.dev/og/posts/lcEoE1Sey.png og:image:alt: Good apps aren’t born, they’re guided: Building observable policy as code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Good apps aren’t born, they’re guided: Building observable policy as code **[CNCF](https://daily.dev/sources/cncf)** · 14 min read · 1 upvotes · 0 comments ## Summary A tutorial walks through combining Kyverno, a Kubernetes-native policy engine, with VictoriaMetrics, a time-series monitoring backend, to make policy enforcement observable rather than a black box. It introduces a five-policy lifecycle framework (validating, mutating, generating, image-validating, and deleting policies) with concrete YAML manifests, kubectl test scenarios showing allowed and blocked deployments, and a vmagent scrape configuration to forward Kyverno metrics into VictoriaMetrics. It closes with PromQL queries and Grafana dashboard metrics (like kyverno_admission_requests_total) for tracking admission request volume, allow/block ratios, and resource distribution, plus guidance on managing high-cardinality metrics via VictoriaMetrics' Cardinality Explorer. Full manifests and dashboards are available in a linked open-source GitHub repository. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I monitor Kyverno policy enforcement events in Grafana? Configure vmagent to scrape the Kyverno metrics service on port 8000 and remote-write the data into VictoriaMetrics, then build Grafana panels using PromQL queries against metrics like kyverno_admission_requests_total. Grouping by request_allowed shows how many admission requests were allowed versus blocked, while grouping by resource_kind shows which resource types are most affected by enforcement. _Teams wiring policy enforcement into dashboards can find implementation walkthroughs like this one on daily.dev._ ### How can I automatically inject missing labels on Kubernetes pods to enforce observability metadata standards? Use a Kyverno mutating ClusterPolicy with a patchStrategicMerge rule that adds required labels such as environment and team at resource creation time. Pair it with a validating policy that blocks pods missing required labels like app, environment, and team, so mutation reduces developer friction while validation still enforces compliance if the mutation is incomplete. _Developers setting up automatic policy remediation on Kubernetes can track approaches like this on daily.dev._ ### How do I prevent unapproved container images from running in a Kubernetes cluster? Create a Kyverno validating ClusterPolicy that pattern-matches allowed image sources, for example restricting spec.containers[].image to nginx*, so any pod requesting a disallowed image like busybox is denied at admission time with an explicit error identifying the failing policy. This enforces trusted-registry restrictions as a supply-chain security control. _Engineers hardening container supply-chain policy can follow implementations like this via daily.dev._ ## Similar posts on daily.dev - [Kyverno Explained: Why Modern Platforms Need Policy-as-Code](https://daily.dev/posts/kyverno-explained-why-modern-platforms-need-policy-as-code-wuk8roaoy) · Medium · 1 upvotes · 0 comments - [Policy-as-Code: Flexible Kubernetes governance with Kyverno](https://daily.dev/posts/policy-as-code-flexible-kubernetes-governance-with-kyverno-wvztjd4cj) · CNCF · 0 upvotes · 0 comments - [Vetting Kubernetes configuration with Kyverno prior to deployment](https://daily.dev/posts/vetting-kubernetes-configuration-with-kyverno-prior-to-deployment-m3cfjuial) · ITNEXT · 1 upvotes · 0 comments - [GitOps policy-as-code: Securing Kubernetes with Argo CD and Kyverno](https://daily.dev/posts/gitops-policy-as-code-securing-kubernetes-with-argo-cd-and-kyverno-w29f1taqc) · CNCF · 4 upvotes · 0 comments - [Jim Bugwadia on why finding a Kubernetes problem is only half the battle for Kyverno users](https://daily.dev/posts/jim-bugwadia-on-why-finding-a-kubernetes-problem-is-only-half-the-battle-for-kyverno-users-bvgrfhwbj) · The New Stack · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#observability](https://daily.dev/tags/observability), [#policy-as-code](https://daily.dev/tags/policy-as-code), [#kyverno](https://daily.dev/tags/kyverno) [View this post on daily.dev](https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Good apps aren’t born, they’re guided: Building observable policy as code","url":"https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey"},"datePublished":"2026-08-12T11:20:16.361Z","dateModified":"2026-09-14T06:53:57.642Z","description":"A tutorial walks through combining Kyverno, a Kubernetes-native policy engine, with VictoriaMetrics, a time-series monitoring backend, to make policy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5dee03b989f0153b0de76e44cefc51dc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5dee03b989f0153b0de76e44cefc51dc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CNCF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CNCF","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/55536a03390741eebd96d2f9b74d2d8d","url":"https://daily.dev/sources/cncf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,observability,policy-as-code,kyverno","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CNCF","item":"https://daily.dev/sources/cncf"},{"@type":"ListItem","position":3,"name":"Good apps aren’t born, they’re guided: Building observable policy as code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/good-apps-aren-t-born-they-re-guided-building-observable-policy-as-code-lceoe1sey#faq","mainEntity":[{"@type":"Question","name":"How do I monitor Kyverno policy enforcement events in Grafana?","acceptedAnswer":{"@type":"Answer","text":"Configure vmagent to scrape the Kyverno metrics service on port 8000 and remote-write the data into VictoriaMetrics, then build Grafana panels using PromQL queries against metrics like kyverno_admission_requests_total. Grouping by request_allowed shows how many admission requests were allowed versus blocked, while grouping by resource_kind shows which resource types are most affected by enforcement. Teams wiring policy enforcement into dashboards can find implementation walkthroughs like this one on daily.dev."}},{"@type":"Question","name":"How can I automatically inject missing labels on Kubernetes pods to enforce observability metadata standards?","acceptedAnswer":{"@type":"Answer","text":"Use a Kyverno mutating ClusterPolicy with a patchStrategicMerge rule that adds required labels such as environment and team at resource creation time. Pair it with a validating policy that blocks pods missing required labels like app, environment, and team, so mutation reduces developer friction while validation still enforces compliance if the mutation is incomplete. Developers setting up automatic policy remediation on Kubernetes can track approaches like this on daily.dev."}},{"@type":"Question","name":"How do I prevent unapproved container images from running in a Kubernetes cluster?","acceptedAnswer":{"@type":"Answer","text":"Create a Kyverno validating ClusterPolicy that pattern-matches allowed image sources, for example restricting spec.containers[].image to nginx*, so any pod requesting a disallowed image like busybox is denied at admission time with an explicit error identifying the failing policy. This enforces trusted-registry restrictions as a supply-chain security control. Engineers hardening container supply-chain policy can follow implementations like this via daily.dev."}}]} ```